CVE-2024-40897

Name	CVE-2024-40897
Description	Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
orc (PTS)	bullseye	1:0.4.32-1	vulnerable
	bookworm	1:0.4.33-2	vulnerable
	forky, sid, trixie	1:0.4.41-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
orc	source	(unstable)	1:0.4.39-1

Notes

[bookworm] - orc <no-dsa> (Minor issue)
[bullseye] - orc <no-dsa> (Minor issue)
https://gstreamer.freedesktop.org/security/sa-2024-0003.html
Fixed by: https://gitlab.freedesktop.org/gstreamer/orc/-/commit/fb7db9ae3e8ac271651d1884a3611d30bac04a98 (0.4.39)