CVE-2023-42464
Summary
| CVE | CVE-2023-42464 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2023-09-20 15:15:00 UTC |
|---|
| Updated | 2023-10-06 03:15:00 UTC |
|---|
| Description | A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When parsing Spotlight RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the underlying protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a malicious actor may be able to fully control the value of the pointer and theoretically achieve Remote Code Execution on the host. This issue is similar to CVE-2023-34967. |
|---|
NVD Known Affected Configurations (CPE 2.3)
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 200000 Ubuntu Security Notification for Netatalk Vulnerability (USN-6552-1)
- 503319 Alpine Linux Security Update for netatalk
- 506122 Alpine Linux Security Update for netatalk
- 6000112 Debian Security Update for netatalk (DLA 3584-1)
- 6000181 Debian Security Update for netatalk (DSA 5503-1)
- 754925 SUSE Enterprise Linux Security Update for netatalk (SUSE-SU-2023:3779-1)
