CVE-2023-4508

2023-08-2400:00:00

ubuntu.com

gerbv

denial of service

user-controlled input

cwe-824

capec-263

unix

cve-2023-4508

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

10.5%

JSON

A user able to control file input to Gerbv, between versions 2.4.0 and
2.10.0, can cause a crash and cause denial-of-service with a specially
crafted Gerber RS-274X file.

Bugs

<https://github.com/gerbv/gerbv/issues/191>

Notes

Author	Note
	Priority reason: Impact is only a denial of service.
iosifache	CWE-824 and CAPEC-263

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchgerbv< 2.6.1-3ubuntu0.1~esm2UNKNOWN
ubuntu20.04noarchgerbv< 2.7.0-1ubuntu0.2UNKNOWN
ubuntu22.04noarchgerbv< 2.8.2-1ubuntu0.1~esm2UNKNOWN
ubuntu23.10noarchgerbv< 2.9.8-1ubuntu0.1UNKNOWN
ubuntu16.04noarchgerbv< 2.6.0-1ubuntu0.16.04.1~esm2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	gerbv	< 2.6.1-3ubuntu0.1~esm2	UNKNOWN
ubuntu	20.04	noarch	gerbv	< 2.7.0-1ubuntu0.2	UNKNOWN
ubuntu	22.04	noarch	gerbv	< 2.8.2-1ubuntu0.1~esm2	UNKNOWN
ubuntu	23.10	noarch	gerbv	< 2.9.8-1ubuntu0.1	UNKNOWN
ubuntu	16.04	noarch	gerbv	< 2.6.0-1ubuntu0.16.04.1~esm2	UNKNOWN