INFSA-2024:5306: Orc security update

Information about definition

Identificator: INFSA-2024:5306

Type: security

Release date: 2024-08-27 10:17:09 UTC

Information about package

Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data. The "language" is a generic assembly language that represents many of the features available in SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.

Vulnerabilities description

  • CVE-2024-40897

    Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

Severity level

CVE Score CVSS 2.0 Score CVSS 3.x Score CVSS 4.0
no information 7.3 no information
Critical, important, moderate, low

Updated packages