DEBIAN-CVE-2024-42040

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2024-42040
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-42040.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2024-42040
Upstream
Published
2024-08-23T15:15:16Z
Modified
2026-09-15T09:03:18Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
[none]
Details

Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an attacker on the local network to leak memory from four up to 32 bytes of memory stored behind the packet to the network depending on the later use of DHCP-provided parameters via crafted DHCP responses.

References

Affected packages

Debian:12 / u-boot

Package

Name
u-boot
Purl
pkg:deb/debian/u-boot?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2023.01+dfsg-2+deb12u3

Affected versions

2023.*
2023.01+dfsg-2
2023.01+dfsg-2+deb12u1
2023.01+dfsg-2+deb12u2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-42040.json"

Debian:13 / u-boot

Package

Name
u-boot
Purl
pkg:deb/debian/u-boot?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2025.01-3+deb13u1

Affected versions

2025.*
2025.01-3

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-42040.json"

Debian:14 / u-boot

Package

Name
u-boot
Purl
pkg:deb/debian/u-boot?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2025.01-3.2

Affected versions

2025.*
2025.01-3
2025.01-3.1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-42040.json"