LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted pdflatex.fmt file (or perhaps a crafted .o file) to llvm-lto. NOTE: this is disputed because the relationship between pdflatex.fmt and any LLVM language front end is not explained, and because a crash of the llvm-lto application should be categorized as a usability problem.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Huawei Euleros 2_0_sp10 | — | Upgrade llvmUpgrade llvm-help | Jul 16, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade llvmUpgrade llvm-libsUpgrade llvm-help | Jun 26, 2024 | Mar 27, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade llvm-helpUpgrade llvmUpgrade llvm-libs | Oct 8, 2024 | Mar 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub