CVE-2023-24056

2023-01-2204:15:11

Google

osv.dev

pkgconf

software

vulnerability

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.0005 Low

EPSS

Percentile

18.4%

JSON

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.

CPENameOperatorVersion
pkgconfeq1.7.4-r1
pkgconfeq0.1.1-r2
pkgconfeq1.5.0-r0
pkgconfeqpkgconf-1.3.90
pkgconfeq1.7.2-r1
pkgconfeqpkgconf-0.5.1
pkgconfeqpkgconf-0.8.11
pkgconfeq1.3.10-r0
pkgconfeqpkgconf-1.7.0
pkgconfeq1.3.1-r0

Name	Operator	Version
pkgconf	eq	1.7.4-r1
pkgconf	eq	0.1.1-r2
pkgconf	eq	1.5.0-r0
pkgconf	eq	pkgconf-1.3.90
pkgconf	eq	1.7.2-r1
pkgconf	eq	pkgconf-0.5.1
pkgconf	eq	pkgconf-0.8.11
pkgconf	eq	1.3.10-r0
pkgconf	eq	pkgconf-1.7.0
pkgconf	eq	1.3.1-r0