Out-of-bounds Read Vulnerability in PhysicsFS Affects Multiple Versions by Icculus
CVE-2024-58392
4.8MEDIUM
What is CVE-2024-58392?
PhysicsFS, as of version 3.2.0, has been identified with an out-of-bounds read vulnerability in the function __PHYSFS_utf8codepoint(). This flaw enables attackers to read beyond designated memory buffers through an unintended off-by-one cursor advancement within six-octet UTF-8 sequences. By supplying a specially crafted archive containing entry names that conclude with six-octet sequences, attackers can exploit this vulnerability, leading to excessive memory reads during operations involving PHYSFS_utf8stricmp() and related hashing functions. Consequently, this could potentially crash the application, posing significant security risks for users.
Affected Version(s)
PhysicsFS 0 <= 3.2.0
References
CVSS V4
Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
guillaume-uH57J9
HaiND from the Post and Telecommunication Institute of Technology