CVE-2023-46049

Katalog CVE

CVSS 5.3 · Medium EPSS 0,68%

Kerentanan NULL Pointer Dereference. Skor CVSS 3.1 5.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted pdflatex.fmt file (or perhaps a crafted .o file) to llvm-lto. NOTE: this is disputed because the relationship between pdflatex.fmt and any LLVM language front end is not explained, and because a crash of the llvm-lto application should be categorized as a usability problem.

Rincian

Terbit di NVD

27 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 51,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• http://seclists.org/fulldisclosure/2024/Jan/66
• https://github.com/llvm/llvm-project/issues/67388
• https://llvm.org/docs/Security.html
• http://packetstormsecurity.com/files/176820/llvm-LLVM-15-Null-Pointer.html