CVE-2024-3203

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-3203
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3203.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-3203
Downstream
Related
Published
2024-04-02T22:00:06.695Z
Modified
2026-07-15T01:48:53.536986552Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
c-blosc2 ndlz8x8.c ndlz8_decompress heap-based overflow
Details

A vulnerability, which was classified as critical, was found in c-blosc2 up to 2.13.2. Affected is the function ndlz8_decompress of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz8x8.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.14.3 is able to address this issue. It is recommended to upgrade the affected component. VDB-259050 is the identifier assigned to this vulnerability.

Database specific 
{
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3203.json",
    "cwe_ids": [
        "CWE-122"
    ]
}
References

Affected packages

Git / github.com/blosc/c-blosc2

Affected ranges

Type
GIT
Repo
https://github.com/blosc/c-blosc2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cfaa9c72f25566f630c5f3d32ac9321372c6c93f
Database specific 
{
    "cpe": "cpe:2.3:a:blosc:c-blosc2:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.13.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.13.0
2.13.1
2.13.2
v2.*
v2.0.0
v2.0.0-beta.1
v2.0.0-beta.3
v2.0.0-beta.4
v2.0.0-rc2
v2.0.0.beta.5
v2.0.0.rc1
v2.0.0a2
v2.0.0a3
v2.0.0a4
v2.0.0a5
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.11.0
v2.11.1
v2.11.2
v2.11.3
v2.12.0
v2.13.0
v2.13.1
v2.13.2
v2.14.0
v2.14.1
v2.14.2
v2.2.0
v2.3.0
v2.3.1
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.5.0
v2.6.0
v2.6.1
v2.7.0
v2.7.1
v2.8.0
v2.9.0
v2.9.1
v2.9.2
v2.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3203.json"