SUSE update for aalto-xml, flatten-maven-plugin, jctools, moditect, netty, netty-tcnative
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2024-47535 |
| CWE-ID | CWE-399 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
SUSE Package Hub 15 Operating systems & Components / Operating system Development Tools Module Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop 15 Operating systems & Components / Operating system SUSE Linux Enterprise Micro Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 Operating systems & Components / Operating system netty-tcnative Operating systems & Components / Operating system package or component netty Operating systems & Components / Operating system package or component netty-tcnative-javadoc Operating systems & Components / Operating system package or component jctools Operating systems & Components / Operating system package or component jctools-javadoc Operating systems & Components / Operating system package or component jctools-channels Operating systems & Components / Operating system package or component jctools-experimental Operating systems & Components / Operating system package or component netty-javadoc Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Resource management error
EUVDB-ID: #VU100259
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-47535
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to an unsafe reading of an environment file on Windows. A local user can create an overly large file and perform a denial of service (DoS) attack.
Update the affected package aalto-xml, flatten-maven-plugin, jctools, moditect, netty, netty-tcnative to the latest version.
Vulnerable software versionsSUSE Package Hub 15: 15-SP5 - 15-SP6
Development Tools Module: 15-SP5 - 15-SP6
SUSE Linux Enterprise Real Time 15: SP5 - SP6
openSUSE Leap: 15.5 - 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP5 - SP6
SUSE Linux Enterprise Server 15: SP5 - SP6
SUSE Linux Enterprise Desktop 15: SP5 - SP6
SUSE Linux Enterprise Micro: 5.5
SUSE Linux Enterprise High Performance Computing 15: SP5
netty-tcnative: before 2.0.69-150200.3.22.1
netty: before 4.1.115-150200.4.26.1
netty-tcnative-javadoc: before 2.0.69-150200.3.22.1
jctools: before 4.0.5-150200.3.9.1
jctools-javadoc: before 4.0.5-150200.3.9.1
jctools-channels: before 4.0.5-150200.3.9.1
jctools-experimental: before 4.0.5-150200.3.9.1
netty-javadoc: before 4.1.115-150200.4.26.1
CPE2.3- cpe:2.3:o:suse:suse_package_hub_15:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_package_hub_15:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:development_tools_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:development_tools_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:netty-tcnative:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:netty:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:netty-tcnative-javadoc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:jctools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:jctools-javadoc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:jctools-channels:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:jctools-experimental:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:netty-javadoc:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2024/suse-su-20244407-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
