CVE-2023-6779 Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()

🗓️ 31 Jan 2024 14:07:41Reported by redhatType

Glibc off-by-one heap-based buffer overflow in __vsyslog_internal function affecting glibc 2.37 and newe

Reporter	Title	Published	Views	Family All 58
ATTACKERKB	CVE-2023-6779	31 Jan 202414:15	–	attackerkb
BDU FSTEC	The vulnerability of the __vsyslog_internal function in the glibc library, which allows a hacker to cause a service failure	14 Feb 202400:00	–	bdu_fstec
CBLMariner	CVE-2023-6779 affecting package glibc for versions less than 2.38-6	2 Jul 202423:30	–	cbl_mariner
Chainguard	CVE-2023-6779 vulnerabilities	31 Jan 202414:15	–	cgr
Circl	CVE-2023-6779	31 Jan 202415:22	–	circl
CNNVD	glibc buffer error vulnerability	30 Jan 202400:00	–	cnnvd
CVE	CVE-2023-6779	31 Jan 202414:07	–	cve
Debian	[SECURITY] [DSA 5611-1] glibc security update	30 Jan 202418:33	–	debian
Debian CVE	CVE-2023-6779	31 Jan 202414:07	–	debiancve
Tenable Nessus	Debian dsa-5611 : glibc-doc - security update	30 Jan 202400:00	–	nessus

[
  {
    "product": "glibc",
    "vendor": "n/a",
    "versions": [
      {
        "version": "2.39",
        "status": "unaffected"
      }
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 6",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "compat-glibc",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:6"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 6",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "glibc",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:6"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "compat-glibc",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "glibc",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "glibc",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "glibc",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ]
  },
  {
    "product": "Fedora",
    "vendor": "Fedora",
    "collectionURL": "https://packages.fedoraproject.org/",
    "packageName": "glibc",
    "defaultStatus": "affected"
  }
]

Source	Link
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/MWQ6BZJ6CV5UAW4VZSKJ6TO4KIW2KWAQ/
openwall	www.openwall.com/lists/oss-security/2024/01/30/6
security	www.security.netapp.com/advisory/ntap-20240223-0006/
access	www.access.redhat.com/security/cve/CVE-2023-6779
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/D2FIH77VHY3KCRROCXOT6L27WMZXSJ2G/
qualys	www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
packetstormsecurity	www.packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
security	www.security.gentoo.org/glsa/202402-01
seclists	www.seclists.org/fulldisclosure/2024/Feb/3

23 Feb 2024 16:05Current

8.6High risk

Vulners AI Score8.6

CVSS 3.18.2

EPSS0.00654

CWE-122