Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.
CVSS Details
- CVSS 3.1 Base Score: 6.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-orcalma-upgrade-orc-compileralma-upgrade-orc-devel | Aug 22, 2024 | Jul 26, 2024 | |
| Alpine Linux | alpine-linux-upgrade-orc | Oct 1, 2024 | Jul 26, 2024 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-orcamazon-linux-ami-2-upgrade-orc-compileramazon-linux-ami-2-upgrade-orc-debuginfoamazon-linux-ami-2-upgrade-orc-develamazon-linux-ami-2-upgrade-orc-doc | Jan 10, 2025 | Jul 26, 2024 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-orcamazon-linux-2023-upgrade-orc-compileramazon-linux-2023-upgrade-orc-compiler-debuginfoamazon-linux-2023-upgrade-orc-debuginfoamazon-linux-2023-upgrade-orc-debugsourceamazon-linux-2023-upgrade-orc-develamazon-linux-2023-upgrade-orc-doc | Feb 17, 2025 | Jul 26, 2024 | |
| Debian | no-fix-debian-deb-package | May 15, 2025 | Jul 26, 2024 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-lang-orc | May 13, 2025 | Jul 26, 2024 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-orchuawei-euleros-2_0_sp10-upgrade-orc-help | Oct 8, 2024 | Jul 26, 2024 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-orchuawei-euleros-2_0_sp11-upgrade-orc-help | Oct 9, 2024 | Jul 26, 2024 | |
| Huawei Euleros 2_0_sp12 | huawei-euleros-2_0_sp12-upgrade-orchuawei-euleros-2_0_sp12-upgrade-orc-help | Nov 5, 2024 | Jul 26, 2024 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-orchuawei-euleros-2_0_sp9-upgrade-orc-help | Oct 8, 2024 | Jul 26, 2024 | |
| Oracle_linux | — | oracle-linux-upgrade-orcoracle-linux-upgrade-orc-compileroracle-linux-upgrade-orc-devel | Oct 16, 2024 | Jul 26, 2024 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-orcredhat-upgrade-orc-compilerredhat-upgrade-orc-compiler-debuginforedhat-upgrade-orc-debuginforedhat-upgrade-orc-debugsourceredhat-upgrade-orc-devel | Sep 13, 2024 | Jul 26, 2024 | |
| Rocky_linux | rocky-upgrade-orcrocky-upgrade-orc-compilerrocky-upgrade-orc-compiler-debuginforocky-upgrade-orc-debuginforocky-upgrade-orc-debugsourcerocky-upgrade-orc-devel | May 8, 2025 | Jul 26, 2024 | |
| Suse | — | suse-upgrade-liborc-0_4-0suse-upgrade-liborc-0_4-0-32bitsuse-upgrade-orcsuse-upgrade-orc-doc | Jul 31, 2024 | Jul 26, 2024 |
| Ubuntu | ubuntu-pro-upgrade-liborc-0-4-0ubuntu-pro-upgrade-liborc-0-4-devubuntu-upgrade-liborc-0-4-0ubuntu-upgrade-liborc-0-4-0t64 | Aug 19, 2024 | Jul 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub