CVE-2024-24189

A use-after-free vulnerability occurs when a program references a memory area that has already been freed. In the case of Jsish, this error occurs in the SplitChar function in the jsiUtils.c module. An attacker can remotely, without authentication and without user interaction, invoke this function in a way that causes improper memory management. Manipulation of the freed memory area can enable takeover of control over the program's execution flow.

An attacker can remotely gain full control over the vulnerable system, including causing disclosure of sensitive data, data modification, or complete loss of service availability (RCE or process crash).

Apply patches available from the vendor according to the references. It is recommended to monitor the project repository at https://github.com/pcmacdon/jsish for current information about fixes.

Jsish v3.5.0 (commit 42c694c)