CVE-2023-0687

2023-02-0600:00:00

ubuntu.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4 Medium

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:H/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

45.8%

JSON

DISPUTED A vulnerability was found in GNU C Library 2.38. It has been
declared as critical. This vulnerability affects the function __monstartup
of the file gmon.c of the component Call Graph Monitor. The manipulation
leads to buffer overflow. It is recommended to apply a patch to fix this
issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE:
The real existence of this vulnerability is still doubted at the moment.
The inputs that induce this vulnerability are basically addresses of the
running application that is built with gmon enabled. It’s basically trusted
input or input that needs an actual security flaw to be compromised or
controlled.

Notes

Author	Note
iconstantin	Upstream does not consider this to be a security issue and is disputing the CVE.
mdeslaur	marking as not-affected due to the issue being disputed