Lucene search
Gentoo FoundationMGASA-2023-0077HistoryMar 02, 2023 - 12:14 a.m.
Updated pkgconf packages fix security vulnerability
2023-03-0200:14:31
Gentoo Foundation
advisories.mageia.org
11
pkgconf
packages
security
vulnerability
libpkgconf
tuple.c
fix
unbounded string expansion
cve-2023-24056
unix
CVSS3
5.5
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
36.6%
In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes. (CVE-2023-24056)
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Mageia | 8 | noarch | pkgconf | < 1.7.3-2.1 | pkgconf-1.7.3-2.1.mga8 |
Related
veracode
veracode
Denial Of Service (DoS)
2023-01-26 04:16:50
openvas
openvas
Mageia: Security Advisory (MGASA-2023-0077)
2023-03-28 00:00:00
Huawei EulerOS: Security Advisory for pkgconf (EulerOS-SA-2023-2110)
2023-06-07 00:00:00
Huawei EulerOS: Security Advisory for pkgconf (EulerOS-SA-2023-1787)
2023-05-08 00:00:00
nessus
nessus
RHEL 8 : pkgconf (Unpatched Vulnerability)
2024-05-11 00:00:00
EulerOS 2.0 SP10 : pkgconf (EulerOS-SA-2023-1559)
2023-03-19 00:00:00
EulerOS 2.0 SP9 : pkgconf (EulerOS-SA-2023-1876)
2023-05-13 00:00:00
osv
osv
CVE-2023-24056
2023-01-22 04:15:11
CGA-w6qr-2mhr-mh8x
2024-06-06 12:29:42
ubuntucve
ubuntucve
CVE-2023-24056
2023-01-22 00:00:00
alpinelinux
alpinelinux
CVE-2023-24056
2023-01-22 04:15:11
prion
prion
Design/Logic Flaw
2023-01-22 04:15:00
cbl_mariner
cbl_mariner
CVE-2023-24056 affecting package pkgconf for versions less than 1.8.0-3
2023-02-14 20:36:04
cgr
cgr
CVE-2023-24056 vulnerabilities
2024-05-19 03:07:16
redos
redos
ROS-20240911-09
2024-09-11 00:00:00
debiancve
debiancve
CVE-2023-24056
2023-01-22 04:15:11
redhatcve
redhatcve
CVE-2023-24056
2023-01-27 13:35:26
cvelist
cvelist
CVE-2023-24056
2023-01-22 00:00:00
cve
cve
CVE-2023-24056
2023-01-22 04:15:11
nvd
nvd
CVE-2023-24056
2023-01-22 04:15:11
wolfi
wolfi
CVE-2023-24056 vulnerabilities
2024-09-27 09:13:12
CVSS3
5.5
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
36.6%
Related for MGASA-2023-0077