CVE-2024-58392

Name	CVE-2024-58392
Description	PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing PHYSFS_utf8stricmp() and hashing to over-read and crash the application.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1152517

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libphysfs (PTS)	bookworm, trixie	3.0.2-6	vulnerable
	forky, sid	3.2.0-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libphysfs	source	(unstable)	(unfixed)	unimportant		1152517

Notes

https://github.com/icculus/physfs/commit/8a90802778f14dea9c086fb5436839181a3222d5
https://github.com/icculus/physfs/issues/79
https://github.com/icculus/physfs/pull/80
Negligible security impact