CVE-2024-39720

highPriorität · verfolgen · 1EPSS 0.024 · 84. PerzentilDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

2.44% (84th) EPSS

CVSS 8.2 · high

Is it mine?

10 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytes starting with the GGUF custom magic header. By leveraging a custom Modelfile that includes a FROM statement pointing to the attacker-controlled blob file, the attacker can crash the application through the CreateModel route, leading to a segmentation fault (signal SIGSEGV: segmentation violation).

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobengovulncheck-vulndb-0.0.20241104T154416-150000.1.12.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobengovulncheck-vulndb-0.0.20241104T154416-150000.1.12.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobengovulncheck-vulndb-0.0.20241104T154416-150000.1.12.1.noarch as component of openSUSE Leap 15.5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobengovulncheck-vulndb-0.0.20241104T154416-150000.1.12.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobengovulncheck-vulndb-0.0.20241104T154416-5.1.noarch as component of SUSE Package Hub 12suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.2

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18.2highAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Hsecondary · ENISA EU

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:HsecondaryAusnutzbarkeit 3.9 · Auswirkung 4.2

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Hsecondary · OSV

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · SUSE Product Security

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: poc · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-125USCWE-125USCWE-125US

betroffene Produkte (10)

Betroffene Produkte und Versionsbereiche.

n/a n/a≤ n/aenisa_euvdEU
Novell Inc. OpenSUSE Leap≤ 15.6fstec_bduRU
Novell Inc. OpenSUSE Leap≤ 15.5fstec_bduRU
Novell Inc. SUSE Linux Enterprise Module for Package Hub≤ 15 SP6fstec_bduRU
Novell Inc. SUSE Linux Enterprise Module for Package Hub≤ 15 SP5fstec_bduRU
Novell Inc. SUSE Package Hub≤ 12fstec_bduRU
Novell Inc. openSUSE Tumbleweedalle Versionenfstec_bduRU
Сообщество свободного программного обеспечения Ollama≤ 0.1.46fstec_bduRU
ollama ollama< 0.1.46nvdUScpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*
Go github.com/ollama/ollama< 0.1.46osvUSpkg:golang/github.com/ollama/ollama

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

SUSE-SU-2024:3950-1Security update for govulncheck-vulndb2024-11-08csaf · suse_csafDE
Security update for govulncheck-vulndb
openSUSE-SU-2024:0350-1Security update for govulncheck-vulndb2024-11-05csaf · suse_csafDE
Security update for govulncheck-vulndb
GHSA-95j2-w8x7-hm88Ollama Out-of-bounds Read2024-10-31ghsa · osvUS
An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytes starting with the GGUF custom magic header. By leveraging a custom Modelfile that includes a FROM statement pointing to the attacker-controlled blob file, the attacker can crash the application through the CreateModel route, leading to a segmentation fault (signal SIGSEGV: segmentation violation).
GO-2024-3245Ollama Out-of-bounds Read in github.com/ollama/ollama2024-11-01vendor · osvUS
Ollama Out-of-bounds Read in github.com/ollama/ollama

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv nvd suse_csaf NVD CVE.org MITRE

veröffentlicht 2024-10-31geändert 2026-06-17

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan