PT-2023-18604 · Opensuse+6 · Libeconf+6

Yangjiageng · Published 2023-06-01 · Updated 2026-06-02 · CVE-2023-22652

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libeconf versions prior to 0.5.2

Description A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to Denial of Service (DoS) via malformed config files.

Recommendations For versions prior to 0.5.2, update to version 0.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to malformed config files to minimize the risk of exploitation.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

ALSA-2023:4347

CVE-2023-22652

DLA-4164-1

OPENSUSE-SU-2023_3954-1

RHSA-2023:4347

RHSA-2023_4347

RLSA-2023:4347

SUSE-SU-2023:3639-1

SUSE-SU-2023:3954-1

SUSE-SU-2023:3954-2

SUSE-SU-2023_3954-1

SUSE-SU-2024:2426-1

USN-8368-1

Affected Products

Almalinux

Debian

Red Hat

Red Os

Rocky Linux

Suse

Libeconf

References · 50

• 🔥 https://github.com/openSUSE/libeconf/issues/177 · Exploit
• 🔥 https://github.com/yangjiageng/PoC/blob/master/libeconf-PoC/read_file_503 · Exploit
• https://osv.dev/vulnerability/RLSA-2023:4347 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/SDD5GL5T3V5XZ3VFA4HPE6YGJ2K4HHPC · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/YAYW7X753Z6GOJKVLQPXBDHISN6ZT233 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:4347 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/SMG5256D5I3GFA3RBAJQ2WYPJDYAIL74 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22652 · Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22652 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22652 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-4347.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-22652 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8368-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22652 · Security Note
• https://osv.dev/vulnerability/DLA-4164-1 · Vendor Advisory