Bug 1226246 - VUL-0: CVE-2024-36761: lapce: naga: front-end aborts due to a stack overflow when given too many parenthesis as input
Summary: VUL-0: CVE-2024-36761: lapce: naga: front-end aborts due to a stack overflow ...
Status: NEW
Alias: None
Product: openSUSE Distribution
Classification: openSUSE
Component: Security (show other bugs)
Version: Leap 15.6
Hardware: Other Other
: P3 - Medium : Normal (vote)
Target Milestone: ---
Assignee: Soc Virnyl Estela
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/410376/
Whiteboard:
Keywords:
Depends on:
Blocks: CVE-2024-36761
  Show dependency tree / graph
 
Reported: 2024-06-12 19:17 UTC by Camila Camargo de Matos
Modified: 2024-06-19 12:24 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Camila Camargo de Matos 2024-06-12 19:17:11 UTC 
+++ This bug was initially created as a clone of Bug #1226242 +++

naga v0.14.0 was discovered to contain a stack overflow via the component /wgsl/parse/mod.rs.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36761
https://www.cve.org/CVERecord?id=CVE-2024-36761
https://github.com/MageWeiG/VulnerabilityCollection/blob/main/CVE-2024-36761/info.md
https://github.com/gfx-rs/naga/issues/2591
Comment 1 Camila Camargo de Matos 2024-06-12 19:17:36 UTC 
Package naga is embedded in openSUSE:Factory/lapce.