Approved changes feed: RSS · Atom
cpe:2.3:a:apache:orc:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Orc (7d72cf61-4c39-581c-964f-2905d21f107e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/orc |
purl2cpe | 2026-06-01 10:14:32.681559 |
pkg:github/apache/orc |
purl2cpe | 2026-06-01 10:14:32.681561 |
pkg:maven/org.apache.orc/orc |
purl2cpe | 2026-06-01 10:14:32.681562 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-47436 |
vulnerable | 2026-06-08 07:27:14.383694 |
Apache ORC: Potential Heap Buffer Overflow during C++ LZO Decompression
Heap-based Buffer Overflow vulnerability in Apache ORC.
A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory corruption.
This issue affects Apache ORC C++ library: through 1.8.8, from 1.9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1.
Users are recommended to upgrade to version 1.8.9, 1.9.6, 2.0.5, and 2.1.2, which fix the issue.
Published: 2025-05-14T13:11:36.329Z
Updated: 2025-05-14T20:58:23.567Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-8015 |
vulnerable | 2026-06-08 05:12:04.991942 |
Details available
In Apache ORC 1.0.0 to 1.4.3 a malformed ORC file can trigger an endlessly recursive function call in the C++ or Java parser. The impact of this bug is most likely denial-of-service against software that uses the ORC file parser. With the C++ parser, the stack overflow might possibly corrupt the stack.
Published: 2018-05-18T17:00:00.000Z
Updated: 2024-09-16T18:44:19.917Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.