VulnerabilityAnalyzed

CVE-2024-50610

GSL (GNU Scientific Library) through 2.8 has an integer signedness error in gsl_siman_solve_many in siman/siman.c.

LOW 3.6EPSS 0.28%

Does this matter?

Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.

Description

GSL (GNU Scientific Library) through 2.8 has an integer signedness error in gsl_siman_solve_many in siman/siman.c. When params.n_tries is negative, incorrect memory allocation occurs.

CVSS 3.1: 3.6 LOWCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS: 0.28% probability · 21th percentile
CISA KEV: Not listed
Weakness: CWE-190
Affected: gnu/gnu scientific library
Source: cve@mitre.org

References

https://git.savannah.gnu.org/cgit/gsl.git/log/siman/siman.cProduct
https://github.com/silviadefra/GolDRuSh/blob/main/vulnerabilities/gsl.mdExploit, Third Party Advisory
https://www.gnu.org/software/gsl/doc/html/siman.htmlProduct

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.