CVE-2024-1013
CVE-2024-1013 is a high-severity vulnerability in Unixodbc with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-823.
Key facts
- Severity: High (CVSS 3.x base score 7.8)
- EPSS exploit prediction: 0% (20th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-16790
- Weakness: CWE-823
- Affected product: Unixodbc
- Published:
- Last modified:
Description
An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken.
Frequently asked questions
- What is CVE-2024-1013?
- An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken.
- How severe is CVE-2024-1013?
- CVE-2024-1013 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2024-1013 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-1013?
- CVE-2024-1013 affects Unixodbc. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-1013?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2024-1013 have an EU (EUVD) identifier?
- Yes. CVE-2024-1013 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-16790.
- When was CVE-2024-1013 published?
- CVE-2024-1013 was published on 2024-03-18 and last updated on 2026-06-17.
References
- https://access.redhat.com/security/cve/CVE-2024-1013
- https://bugzilla.redhat.com/show_bug.cgi?id=2260823
- https://github.com/lurcher/unixODBC/pull/157
Affected products (1)
- cpe:2.3:a:unixodbc:unixodbc:-:*:*:*:*:*:*:*
More vulnerabilities in Unixodbc
- CVE-2018-7485 — Critical (CVSS 9.8): The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order,…
- CVE-2018-7409 — Critical (CVSS 9.8): In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.
- CVE-2011-1145 — High (CVSS 7.8): The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a…
- CVE-2012-2658 — Low (CVSS 2.1): Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service…
- CVE-2012-2657 — Low (CVSS 2.1): Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a…
Other CWE-823 vulnerabilities
- CVE-2023-43553 — Critical (CVSS 9.8): Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
- CVE-2026-46244 — Critical (CVSS 9.1): In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff…
- CVE-2025-27059 — High (CVSS 8.8): Memory corruption while performing SCM call.
- CVE-2022-0729 — High (CVSS 8.8): Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440.
- CVE-2017-20211 — High (CVSS 8.6): UCanCode E-XD++ Visualization Enterprise Suite contains an untrusted pointer dereference vulnerability via the…
- CVE-2023-20187 — High (CVSS 8.6): A vulnerability in the Multicast Leaf Recycle Elimination (mLRE) feature of Cisco IOS XE Software for Cisco ASR 1000…