CVE-2024-43768

NameCVE-2024-43768
DescriptionIn skia_alloc_func of SkDeflate.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1117470

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
skiaITP1117470

Notes

Firefox/Thunderbird embeds a copy of Skia, but the code isn't used/reachable as
confirmed by the Mozilla security team

Search for package or bug name: Reporting problems