CVE-2024-37535 Denial of service in n/a
An attacker can cause a denial of service via memory consumption in the GNOME VTE library by sending a malicious window resize escape sequence.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-37535?
CVE-2024-37535 is a medium-severity denial of service vulnerability in n/a, published on 9 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.
Weakness: CWE-400
Which versions are affected by CVE-2024-37535?
Linux distribution packages (23)
vte SUSE:Enterprise Storage 7.1 | All versions | 0.58.3-150200.3.3.1 |
vte SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 0.58.3-150200.3.3.1 |
vte SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 0.58.3-150200.3.3.1 |
vte SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 0.66.2-150400.3.5.1 |
vte SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 0.66.2-150400.3.5.1 |
vte SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 0.66.2-150400.3.5.1 |
vte SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 0.74.2-150600.3.3.1 |
vte SUSE:Linux Enterprise Module for Desktop Applications 15 SP5 | All versions | 0.66.2-150400.3.5.1 |
vte SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 | All versions | 0.74.2-150600.3.3.1 |
vte SUSE:Linux Enterprise Server 12 SP5 | All versions | 0.44.2-9.6.1 |
vte SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 0.58.3-150200.3.3.1 |
vte SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 0.58.3-150200.3.3.1 |
vte SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 0.66.2-150400.3.5.1 |
vte SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 0.44.2-9.6.1 |
vte SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 0.58.3-150200.3.3.1 |
vte SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 0.58.3-150200.3.3.1 |
vte SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 0.66.2-150400.3.5.1 |
vte SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 0.44.2-9.6.1 |
vte SUSE:Manager Proxy 4.3 | All versions | 0.66.2-150400.3.5.1 |
vte SUSE:Manager Server 4.3 | All versions | 0.66.2-150400.3.5.1 |
vte openSUSE:Leap 15.5 | All versions | 0.66.2-150400.3.5.1 |
vte openSUSE:Leap 15.6 | All versions | 0.74.2-150600.3.3.1 |
vte openSUSE:Tumbleweed | All versions | 0.76.3-3.1 |
How do I fix CVE-2024-37535?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-37535 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-37535 exists.
Sources
Also known as AZL-42631, AZL-43167, DEBIAN-CVE-2024-37535, GHSA-wrc7-97qh-j6mh, MGASA-2024-0219, OESA-2024-1803 and 11 more.