CVE-2024-48854

Off-by-one error in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in the context of the process using the image codec.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.blackberry.com/pkb/s/article/140334	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:::::::*
	cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:::::::*
	cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:::::::*

History

21 Jan 2025, 18:07

Type	Values Removed	Values Added
Summary		(es) Un error de un dígito en el códec de imagen TIFF en las versiones 8.0, 7.1 y 7.0 de QNX SDP podría permitir que un atacante no autenticado provoque una divulgación de información en el contexto del proceso que utiliza el códec de imagen.
References	~~() https://support.blackberry.com/pkb/s/article/140334 -~~	() https://support.blackberry.com/pkb/s/article/140334 - Vendor Advisory
First Time		Blackberry Blackberry qnx Software Development Platform
CPE		cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:::::::* cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:::::::* cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:::::::*

14 Jan 2025, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-14 19:15

Updated : 2025-01-21 18:07

NVD link : CVE-2024-48854

Mitre link : CVE-2024-48854

CVE.ORG link : CVE-2024-48854

JSON object : View

Products Affected

blackberry

qnx_software_development_platform

CWE

CWE-193

Off-by-one Error

{"id": "CVE-2024-48854", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secure@blackberry.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-01-14T19:15:31.267", "references": [{"url": "https://support.blackberry.com/pkb/s/article/140334", "tags": ["Vendor Advisory"], "source": "secure@blackberry.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secure@blackberry.com", "description": [{"lang": "en", "value": "CWE-193"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-193"}]}], "descriptions": [{"lang": "en", "value": "Off-by-one error in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in the context of the process using the image codec."}, {"lang": "es", "value": "Un error de un d\u00edgito en el c\u00f3dec de imagen TIFF en las versiones 8.0, 7.1 y 7.0 de QNX SDP podr\u00eda permitir que un atacante no autenticado provoque una divulgaci\u00f3n de informaci\u00f3n en el contexto del proceso que utiliza el c\u00f3dec de imagen."}], "lastModified": "2025-01-21T18:07:08.960", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "058D8A14-E99C-4AA9-BE27-794B8D8B9E49"}, {"criteria": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0E19A3D-96D9-4DF2-8E56-E2D917B1A9EA"}, {"criteria": "cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CD7E9BB-7B9E-4022-BE18-EA9642F54064"}], "operator": "OR"}]}], "sourceIdentifier": "secure@blackberry.com"}