CVE-2024-27322
Fixed in a distro release EPSS 23%CVSS 8.8
Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS (R Data Serialization) formatted file or R package to run arbitrary code on an end user’s system when interacted with.
Products: The R Project R, R-Project R
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | R | 4.3.2-1.amzn2023.0.3 |
| Amazon Linux 2023 | R-core | 4.3.2-1.amzn2023.0.3 |
| Amazon Linux 2023 | R-core-devel | 4.3.2-1.amzn2023.0.3 |
| Amazon Linux 2023 | R-devel | 4.3.2-1.amzn2023.0.3 |
| Amazon Linux 2023 | R-java | 4.3.2-1.amzn2023.0.3 |
| Amazon Linux 2023 | R-java-devel | 4.3.2-1.amzn2023.0.3 |
| Amazon Linux 2023 | libRmath | 4.3.2-1.amzn2023.0.3 |
| Amazon Linux 2023 | libRmath-devel | 4.3.2-1.amzn2023.0.3 |
| Amazon Linux 2023 | libRmath-static | 4.3.2-1.amzn2023.0.3 |
| Debian 12 | r-base | no fix |
| Debian 13 | r-base | 4.4.0-2 |
| Debian 14 | r-base | 4.4.0-2 |
| Ubuntu 18.04 LTS | r-base | no fix |
| Ubuntu 20.04 LTS | r-base | no fix |
| Ubuntu 22.04 LTS | r-base | no fix |
| Ubuntu 24.04 LTS | r-base | no fix |
| Ubuntu Pro 14.04 LTS | r-base | no fix |
| Ubuntu Pro 16.04 LTS | r-base | no fix |