{"id":"CVE-2023-42464","published":"2023-09-20T00:00:00Z","modified":"2024-08-02T19:23:39Z","title":"A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17","vendor":null,"product":null,"tier":"tail","description":{"text":"A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When parsing Spotlight RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the underlying protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a malicious actor may be able to fully control the value of the pointer and theoretically achieve Remote Code Execution on the host. This issue is similar to CVE-2023-34967.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.021,"percentile":0.81639,"provenance":"source"},"cwes":[],"references":[{"url":"https://netatalk.sourceforge.io/","tags":[]},{"url":"https://github.com/Netatalk/netatalk/issues/486","tags":[]},{"url":"https://www.debian.org/security/2023/dsa-5503","tags":["vendor-advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00031.html","tags":["mailing-list"]},{"url":"https://netatalk.sourceforge.io/CVE-2023-42464.php","tags":[]},{"url":"https://netatalk.sourceforge.io/3.1/htmldocs/afpd.8.html","tags":[]},{"url":"https://netatalk.io/security/CVE-2023-42464","tags":[]}],"priority":{"score":16.3,"factors":[{"name":"EPSS percentile","points":16.33}]},"euvd":{"id":"EUVD-2023-46904","exploited":false,"provenance":"source"},"lineage":{"parents":[{"from":"CVE-2023-34967","to":"CVE-2023-42464","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"This issue is similar to CVE-2023-34967.","from":"CVE.org","in":"CVE-2023-42464"}]}]}}