CVE-2023-49990

2023-12-1214:15:07

Debian Security Bug Tracker

security-tracker.debian.org

espeak-ng

buffer-overflow

setupphonemetable

synthdata.c

cve-2023-49990

unix

5.3 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

7.5 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.2%

JSON

Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.

OSVersionArchitecturePackageVersionFilename
Debian12allespeak-ng< 1.51+dfsg-10+deb12u1espeak-ng_1.51+dfsg-10+deb12u1_all.deb
Debian11allespeak-ng<= 1.50+dfsg-7+deb11u1espeak-ng_1.50+dfsg-7+deb11u1_all.deb
Debian10allespeak-ng<= 1.49.2+dfsg-8+deb10u1espeak-ng_1.49.2+dfsg-8+deb10u1_all.deb
Debian999allespeak-ng< 1.51+dfsg-12espeak-ng_1.51+dfsg-12_all.deb
Debian13allespeak-ng< 1.51+dfsg-12espeak-ng_1.51+dfsg-12_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	espeak-ng	< 1.51+dfsg-10+deb12u1	espeak-ng_1.51+dfsg-10+deb12u1_all.deb
Debian	11	all	espeak-ng	<= 1.50+dfsg-7+deb11u1	espeak-ng_1.50+dfsg-7+deb11u1_all.deb
Debian	10	all	espeak-ng	<= 1.49.2+dfsg-8+deb10u1	espeak-ng_1.49.2+dfsg-8+deb10u1_all.deb
Debian	999	all	espeak-ng	< 1.51+dfsg-12	espeak-ng_1.51+dfsg-12_all.deb
Debian	13	all	espeak-ng	< 1.51+dfsg-12	espeak-ng_1.51+dfsg-12_all.deb