CVE-2023-6780

2024-01-3114:15:48

Debian Security Bug Tracker

security-tracker.debian.org

cve-2023-6780

glibc library

syslog

vsyslog

buffer size

undefined behavior

unix

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.0%

JSON

An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer.

OSVersionArchitecturePackageVersionFilename
Debian12allglibc< 2.36-9+deb12u4glibc_2.36-9+deb12u4_all.deb
Debian11allglibc< 2.31-13+deb11u8glibc_2.31-13+deb11u8_all.deb
Debian10allglibc< 2.28-10+deb10u1glibc_2.28-10+deb10u1_all.deb
Debian999allglibc< 2.37-15glibc_2.37-15_all.deb
Debian13allglibc< 2.37-15glibc_2.37-15_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	glibc	< 2.36-9+deb12u4	glibc_2.36-9+deb12u4_all.deb
Debian	11	all	glibc	< 2.31-13+deb11u8	glibc_2.31-13+deb11u8_all.deb
Debian	10	all	glibc	< 2.28-10+deb10u1	glibc_2.28-10+deb10u1_all.deb
Debian	999	all	glibc	< 2.37-15	glibc_2.37-15_all.deb
Debian	13	all	glibc	< 2.37-15	glibc_2.37-15_all.deb