VDB
ALPINE-CVE-2024-40897
ALPINE-CVE-2024-40897
PUBLISHED
CVSS 6.699999809265137 MEDIUM
Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.
Risk Scores
CVSS 3.1
6.699999809265137
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.18 | orc | 0, 0.4.32-r0, 0.4.31-r2 |
| Alpine:v3.17 | orc | 0.4.30-r0, 0, 0.4.14-r0 |
| Alpine:v3.19 | orc | 0.4.34-r0, 0.4.22-r0, 0.4.23-r0 |
| Alpine:v3.21 | orc | 0, 0.4.14-r0, 0.4.17-r0 |
| Alpine:v3.23 | orc | 0, 0.4.14-r0, 0.4.16-r0 |
| Alpine:v3.22 | orc | 0.4.18-r0, 0.4.16-r0, 0.4.17-r0 |
| Alpine:v3.20 | orc | 0.4.14-r0, 0, 0.4.37-r0 |
| Alpine:v3.24 | orc | 0 |
Timeline
- Jul 26, 2024 CVE Published
- Apr 30, 2026 Distribution Patch
- Jun 15, 2026 CVE Updated