PT-2023-2375 · Liblouis+7 · Liblouis+7

Marsman1996 · Published 2023-02-04 · Updated 2025-01-20 · CVE-2023-26768

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Liblouis version 3.24.0

Description The issue is related to a buffer overflow that can be triggered by a remote attacker, potentially causing a denial of service. This is associated with the compileTranslationTable.c and the lou setDataPath functions. The vulnerability involves uncontrolled copying of data, which can lead to service disruption.

Recommendations For Liblouis version 3.24.0, consider disabling the lou setDataPath function and restricting access to the compileTranslationTable.c component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Buffer Overflow

Weakness Enumeration

CWE-400

CWE-120

Related Identifiers

ALSA-2023:6385

AZL-25653

BDU:2023-02150

BDU:2023-02151

CVE-2023-26768

INFSA-2023_6385

OPENSUSE-SU-2024:13498-1

RHSA-2023:6385

RHSA-2023_6385

SUSE-SU-2023:1824-1

SUSE-SU-2023:1828-1

SUSE-SU-2023:1829-1

SUSE-SU-2023:1854-1

SUSE-SU-2023_1828-1

SUSE-SU-2023_1829-1

SUSE-SU-2023_1854-1

USN-5996-1

USN-5996-2

Affected Products

Almalinux

Debian

Liblouis

Linuxmint

Red Hat

Red Os

Suse

Ubuntu

References · 59

• 🔥 https://github.com/liblouis/liblouis/issues/1301 · Exploit
• https://github.com/liblouis/liblouis/pull/1302 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:13498-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26768 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-6385.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:1824-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5996-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26768 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:1828-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02151 · Security Note
• https://ubuntu.com/security/CVE-2023-26767 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26768 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5996-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02150 · Security Note