Integer Overflow or Wraparound Affecting bminor/newlib package, versions [,4.3.0)
Threat Intelligence
EPSS
0.06% (29th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UNMANAGED-BMINORNEWLIB-7725273
- published 21 Aug 2024
- disclosed 20 Aug 2024
- credit Kuan-Wei Chiu
Introduced: 20 Aug 2024
CVE-2024-30949 Open this link in a new tabHow to fix?
Upgrade bminor/newlib to version 4.3.0 or higher.
Overview
Affected versions of this package are vulnerable to Integer Overflow or Wraparound through the _gettimeofday function, due to the incorrect conversion of nanoseconds to microseconds, where the code erroneously multiplies the value by 1000 instead of dividing by 1000. An attacker can exploit this vulnerability by manipulating the time unit scaling.