CVE-2023-39976

2023-08-0806:15:46

Debian Security Bug Tracker

security-tracker.debian.org

libqb buffer overflow

log_blackbox.c

long log messages

header size

unix

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

27.1%

JSON

log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.

OSVersionArchitecturePackageVersionFilename
Debian12alllibqb<= 2.0.6-2libqb_2.0.6-2_all.deb
Debian11alllibqb<= 2.0.3-1libqb_2.0.3-1_all.deb
Debian10alllibqb< 1.0.5-1libqb_1.0.5-1_all.deb
Debian999alllibqb< 2.0.8-1libqb_2.0.8-1_all.deb
Debian13alllibqb< 2.0.8-1libqb_2.0.8-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	libqb	<= 2.0.6-2	libqb_2.0.6-2_all.deb
Debian	11	all	libqb	<= 2.0.3-1	libqb_2.0.3-1_all.deb
Debian	10	all	libqb	< 1.0.5-1	libqb_1.0.5-1_all.deb
Debian	999	all	libqb	< 2.0.8-1	libqb_2.0.8-1_all.deb
Debian	13	all	libqb	< 2.0.8-1	libqb_2.0.8-1_all.deb