CVE-2024-43091
Public on 2024-11-13
Modified on 2026-10-02
Description
In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Firefox Extra | firefox | Not Affected | ||
| Amazon Linux 2023 | firefox | Not Affected | ||
| Amazon Linux 2027 Preview | firefox | Not Affected | ||
| Amazon Linux 2 - Core | gtk2 | Not Affected | ||
| Amazon Linux 2 - Core | gtk3 | Not Affected | ||
| Amazon Linux 2023 | gtk3 | Not Affected | ||
| Amazon Linux 2027 Preview | gtk3 | Not Affected | ||
| Amazon Linux 2023 | gtk4 | Not Affected | ||
| Amazon Linux 2027 Preview | gtk4 | Not Affected | ||
| Amazon Linux 2 - Core | thunderbird | Not Affected | ||
| Amazon Linux 2 - Core | webkitgtk3 | No Fix Planned | ||
| Amazon Linux 2 - Core | webkitgtk4 | 2026-10-12 | ALAS2-2026-3987 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 7.4 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | CVSSv3 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |