CVE-2024-10525
Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback
Résumé
Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-10525 mosquitto Corrigé dans: 2.0.11-1+deb11u2
Références
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- report gitlab.eclipse.org
- web lists.debian.org
- web mosquitto.org