CVE-2024-10525
Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback
Summary
Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback
Original description
The description as published by the source.
In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-10525 mosquitto Fixed in: 2.0.11-1+deb11u2
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- report gitlab.eclipse.org
- web lists.debian.org
- web mosquitto.org