Lucene search

Ubuntu.comUB:CVE-2023-52389

HistoryJan 27, 2024 - 12:00 a.m.

CVE-2023-52389

2024-01-2700:00:00

ubuntu.com

poco

utf32encoding

integer overflow

stack buffer overflow

convert()

queryconvert()

fixed

version 1.11.8p2

version 1.12.5p2

version 1.13.0

unix

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

27.3%

JSON

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and
resultant stack buffer overflow because Poco::UTF32Encoding::convert() and
Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte
sequence evaluates to a value of 0x80000000 or higher. This is fixed in
1.11.8p2, 1.12.5p2, and 1.13.0.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchpoco< anyUNKNOWN
ubuntu20.04noarchpoco< anyUNKNOWN
ubuntu22.04noarchpoco< anyUNKNOWN
ubuntu24.04noarchpoco< anyUNKNOWN
ubuntu14.04noarchpoco< anyUNKNOWN
ubuntu16.04noarchpoco< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	poco	< any	UNKNOWN
ubuntu	20.04	noarch	poco	< any	UNKNOWN
ubuntu	22.04	noarch	poco	< any	UNKNOWN
ubuntu	24.04	noarch	poco	< any	UNKNOWN
ubuntu	14.04	noarch	poco	< any	UNKNOWN
ubuntu	16.04	noarch	poco	< any	UNKNOWN

References

github.com/pocoproject/poco/commit/62f875dfe1298041289f926a6a1a39cb765b13ee

github.com/pocoproject/poco/compare/poco-1.12.5p2-release...poco-1.13.0-release

github.com/pocoproject/poco/issues/4320

launchpad.net/bugs/cve/CVE-2023-52389

nvd.nist.gov/vuln/detail/CVE-2023-52389

pocoproject.org/blog/?p=1226

security-tracker.debian.org/tracker/CVE-2023-52389

www.cve.org/CVERecord?id=CVE-2023-52389

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

27.3%

JSON

Related for UB:CVE-2023-52389