CVE-2023-42363

2023-11-2722:15:07

Alpine Linux Development Team

security.alpinelinux.org

vulnerability

use-after-free

busybox

xasprintf function

xfuncs_printf.c:344

cve-2023-42363

unix

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

12.9%

JSON

A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.

OSVersionArchitecturePackageVersionFilename
Alpineedge-mainnoarchbusybox< 1.36.1-r27UNKNOWN
Alpine3.17-mainnoarchbusybox< 1.35.0-r31UNKNOWN
Alpine3.18-mainnoarchbusybox< 1.36.1-r7UNKNOWN
Alpine3.19-mainnoarchbusybox< 1.36.1-r17UNKNOWN
Alpine3.20-mainnoarchbusybox< 1.36.1-r27UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	edge-main	noarch	busybox	< 1.36.1-r27	UNKNOWN
Alpine	3.17-main	noarch	busybox	< 1.35.0-r31	UNKNOWN
Alpine	3.18-main	noarch	busybox	< 1.36.1-r7	UNKNOWN
Alpine	3.19-main	noarch	busybox	< 1.36.1-r17	UNKNOWN
Alpine	3.20-main	noarch	busybox	< 1.36.1-r27	UNKNOWN