PT-2023-6485 · Iniparser+5 · Iniparser+5

Notmebutwin · Publicado 2023-05-31 · Atualizado 2025-01-09 · CVE-2023-33461

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions iniparser version 4.1

Description The issue is related to a NULL Pointer Dereference in the iniparser getlongint function, which fails to check for NULL returns from the iniparser getstring function. This can lead to a denial of service.

Recommendations For iniparser version 4.1, consider adding a NULL check for the return value of the iniparser getstring function before passing it to the iniparser getlongint function as a temporary workaround until a patch is available.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2024-9280

AZL-27073

AZL-34806

BDU:2023-07227

CVE-2023-33461

ECHO-4478-1BAF-05DF

OESA-2023-1388

OPENSUSE-SU-2023:0183-1

OPENSUSE-SU-2024:13002-1

SUSE-SU-2023:2692-1

SUSE-SU-2023:2749-1

SUSE-SU-2023_2692-1

SUSE-SU-2023_2749-1

USN-6486-1

Produtos afetados

Alt Linux

Debian

Linuxmint

Suse

Ubuntu

Iniparser

Referências · 37

• 🔥 https://github.com/ndevilla/iniparser/issues/144 · Exploit
• https://github.com/ndevilla/iniparser/pull/146/commits/ace9871f65d11b5d73f0b9ee8cf5d2807439442d · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-33461 · Nota de Segurança
• https://osv.dev/vulnerability/AZL-27073 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2023:2749-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-33461 · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2023:2692-1 · Aviso do Fabricante
• https://lists.opensuse.org/archives/list/[e-mail]/thread/YVBMOCXTOKPS3UKJURQKXE4AANIFZBBL · Nota
• https://t.me/cvenotify/106949 · Publicação no Telegram
• https://osv.dev/vulnerability/ALPINE-CVE-2023-33461 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-33461 · Aviso do Fabricante
• https://t.me/cvenotify/82282 · Publicação no Telegram
• https://security.alpinelinux.org/vuln/CVE-2023-33461 · Nota
• https://bdu.fstec.ru/vul/2023-07227 · Nota de Segurança
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ASV7SEDHGCP63GYAFEW3CTTVQDZM5RIK · Aviso do Fabricante