{"id":"USN-8838-1","summary":"catdoc vulnerabilities","details":"It was discovered that catdoc had an integer overflow when processing\nshared string tables in malformed spreadsheet files. An attacker could\npossibly use this issue to cause catdoc to crash or execute arbitrary code.\n(CVE-2024-48877)\n\nIt was discovered that catdoc had an integer overflow when processing file\nallocation tables in malformed document files. An attacker could possibly\nuse this issue to cause catdoc to crash or execute arbitrary code.\n(CVE-2024-52035)\n\nIt was discovered that catdoc incorrectly validated sector sizes when\nprocessing malformed document files, leading to an integer underflow. An\nattacker could possibly use this issue to cause catdoc to crash or execute\narbitrary code. (CVE-2024-54028)","modified":"2026-09-28T22:57:42.488551256Z","published":"2026-09-28T15:01:41Z","related":["UBUNTU-CVE-2024-48877","UBUNTU-CVE-2024-52035","UBUNTU-CVE-2024-54028"],"upstream":["CVE-2024-48877","CVE-2024-52035","CVE-2024-54028","UBUNTU-CVE-2024-48877","UBUNTU-CVE-2024-52035","UBUNTU-CVE-2024-54028"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8838-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-48877"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-52035"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-54028"}],"affected":[{"package":{"name":"catdoc","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/catdoc?arch=source&distro=esm-apps-legacy%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.94.3~git20160113.dbc9ec6+dfsg-1+deb9u1ubuntu0.1~esm1"}]}],"versions":["0.94.4-1.1","1:0.94.3~git20151007.fd634c2+dfsg-2","1:0.94.3~git20151007.fd634c2+dfsg-3","1:0.94.3~git20160113.dbc9ec6+dfsg-1","1:0.94.3~git20160113.dbc9ec6+dfsg-1+deb9u1build0.16.04.1"],"ecosystem_specific":{"binaries":[{"binary_name":"catdoc","binary_version":"1:0.94.3~git20160113.dbc9ec6+dfsg-1+deb9u1ubuntu0.1~esm1"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-48877"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2024-52035"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2024-54028"}],"ecosystem":"Ubuntu:Pro:16.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8838-1.json"}},{"package":{"name":"catdoc","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/catdoc?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.95-4.1ubuntu0.18.04.1~esm1"}]}],"versions":["1:0.95-3","1:0.95-4.1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"catdoc","binary_version":"1:0.95-4.1ubuntu0.18.04.1~esm1"}]},"database_specific":{"cves_map":{"cves":[{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-48877"},{"id":"CVE-2024-52035","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2024-54028","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:Pro:18.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8838-1.json"}},{"package":{"name":"catdoc","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/catdoc?arch=source&distro=esm-apps%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.95-4.1ubuntu0.20.04.1~esm1"}]}],"versions":["1:0.95-4.1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"catdoc","binary_version":"1:0.95-4.1ubuntu0.20.04.1~esm1"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:20.04:LTS","cves":[{"id":"CVE-2024-48877","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2024-52035","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2024-54028","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}]}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8838-1.json"}},{"package":{"name":"catdoc","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/catdoc?arch=source&distro=esm-apps%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.95-5ubuntu0.22.04.1~esm1"}]}],"versions":["1:0.95-4.1","1:0.95-4.2","1:0.95-5"],"ecosystem_specific":{"binaries":[{"binary_version":"1:0.95-5ubuntu0.22.04.1~esm1","binary_name":"catdoc"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8838-1.json","cves_map":{"ecosystem":"Ubuntu:Pro:22.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-48877"},{"id":"CVE-2024-52035","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2024-54028"}]}}},{"package":{"name":"catdoc","ecosystem":"Ubuntu:Pro:24.04:LTS","purl":"pkg:deb/ubuntu/catdoc?arch=source&distro=esm-apps%2Fnoble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.95-5ubuntu0.24.04.1~esm1"}]}],"versions":["1:0.95-5","1:0.95-5build1"],"ecosystem_specific":{"binaries":[{"binary_version":"1:0.95-5ubuntu0.24.04.1~esm1","binary_name":"catdoc"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8838-1.json","cves_map":{"ecosystem":"Ubuntu:Pro:24.04:LTS","cves":[{"id":"CVE-2024-48877","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2024-52035","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2024-54028","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]}]}}}],"schema_version":"1.9.0"}