Buffer overflow

2018-08-2020:29:00

PRIOn knowledge base

www.prio-n.com

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.0%

JSON

pkgconf version 1.5.0 to 1.5.2 contains a Buffer Overflow vulnerability in dequote() that can result in dequote() function returns 1-byte allocation if initial length is 0, leading to buffer overflow. This attack appear to be exploitable via specially crafted .pc file. This vulnerability appears to have been fixed in 1.5.3.

CPENameOperatorVersion
pkgconfge1.5.0
pkgconfle1.5.2

CPE	Name	Operator	Version
	pkgconf	ge	1.5.0
	pkgconf	le	1.5.2

References

git.dereferenced.org/pkgconf/pkgconf/pulls/3