CVE-2024-43767

NameCVE-2024-43767
DescriptionIn prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1117470

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
skiaITP1117470

Notes

Firefox/Thunderbird embeds a copy of Skia, but the code isn't used/reachable as
confirmed by the Mozilla security team

Search for package or bug name: Reporting problems