PT-2023-23653 · Libeconf+2 · Libeconf+2

Publicado 2023-06-01 · Atualizado 2025-03-16 · CVE-2023-32181

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libeconf versions prior to 0.5.2

Description A Buffer Copy without Checking Size of Input, also known as a 'Classic Buffer Overflow', vulnerability in libeconf allows for Denial of Service (DoS) via malformed configuration files.

Recommendations For versions prior to 0.5.2, update to version 0.5.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of malformed configuration files to minimize the risk of exploitation.

Exploit

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-120

Identificadores relacionados

CVE-2023-32181

OPENSUSE-SU-2023_3954-1

SUSE-SU-2023:3639-1

SUSE-SU-2023:3954-1

SUSE-SU-2023:3954-2

SUSE-SU-2024:2426-1

Produtos afetados

Debian

Suse

Libeconf

Referências · 45

• 🔥 https://github.com/openSUSE/libeconf/issues/178 · Exploit
• 🔥 https://github.com/yangjiageng/PoC/blob/master/libeconf-PoC/read_file_503 · Exploit
• https://github.com/openSUSE/libeconf/issues/177 · Nota
• https://bdu.fstec.ru/vul/2023-05908 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-32181 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2023/suse-su-20233639-1 · Nota
• https://ubuntu.com/security/CVE-2023-32181 · Aviso do Fabricante
• https://https//github.com/openSUSE/libeconf/issues/178 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-30079 · Nota
• https://bdu.fstec.ru/vul/2023-05907 · Nota de Segurança
• https://osv.dev/vulnerability/BELL-CVE-2023-32181 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-32181 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-22652 · Nota
• https://t.me/cvenotify/52009 · Publicação no Telegram
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-32181 · Aviso do Fabricante