PT-2023-5587 · Libtom+6 · Libtommath+6

Gal1Ium · Publicado 2023-05-09 · Atualizado 2025-07-16 · CVE-2023-36328

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libtom libtommath versions before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9

Description The issue is related to an integer overflow vulnerability in the mp grow function of the libtom libtommath library. This vulnerability can be exploited by a remote attacker to execute arbitrary code and cause a denial of service (DoS). The vulnerability is caused by improper bounds checking, allowing a specially crafted request to overflow a buffer.

Recommendations For libtom libtommath versions before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, update to a version that includes the fix for the integer overflow vulnerability in the mp grow function. As a temporary workaround, consider restricting access to the mp grow function to minimize the risk of exploitation.

Correção

DoS

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

ALT-PU-2024-5954

AZL-28627

AZL-28639

AZL-35296

AZL-36959

AZL-48187

BDU:2023-06241

BDU:2025-14506

CVE-2023-36328

DLA-3857-1

MGASA-2023-0265

OESA-2023-1625

OPENSUSE-SU-2024:13425-1

ROSA-SA-2024-2529

USN-6402-1

USN-6402-2

Produtos afetados

Alt Linux

Astra Linux

Ibm Aix

Linuxmint

Red Os

Ubuntu

Libtommath

Referências · 51

• https://github.com/libtom/libtommath/pull/546 · Correção
• https://github.com/libtom/libtommath/commit/beba892bc0d4e4ded4d667ab1d2a94f4d75109a9 · Nota
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.11 · Nota
• https://osv.dev/vulnerability/AZL-28639 · Aviso do Fabricante
• https://t.me/cvenotify/73279 · Publicação no Telegram
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-36328 · Aviso do Fabricante
• https://t.me/latest_high_impact_cve/2610 · Publicação no Telegram
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ZUPWZGPFJ4JOI2NIP7YLRKZD5YXQTBK · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-36328 · Aviso do Fabricante
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1625 · Nota
• https://abf.rosa.ru/advisories/ROSA-SA-2026-3194 · Nota
• https://osv.dev/vulnerability/MGASA-2023-0265 · Aviso do Fabricante
• https://t.me/cvenotify/129238 · Publicação no Telegram
• https://t.me/cvetracker/26024 · Publicação no Telegram
• https://osv.dev/vulnerability/AZL-36959 · Aviso do Fabricante