PT-2023-5587 · Libtom+6 · Libtommath+6

Gal1Ium · Published 2023-05-09 · Updated 2025-07-16 · CVE-2023-36328

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libtom libtommath versions before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9

Description The issue is related to an integer overflow vulnerability in the mp grow function of the libtom libtommath library. This vulnerability can be exploited by a remote attacker to execute arbitrary code and cause a denial of service (DoS). The vulnerability is caused by improper bounds checking, allowing a specially crafted request to overflow a buffer.

Recommendations For libtom libtommath versions before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, update to a version that includes the fix for the integer overflow vulnerability in the mp grow function. As a temporary workaround, consider restricting access to the mp grow function to minimize the risk of exploitation.

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2024-5954

AZL-28627

AZL-28639

AZL-35296

AZL-36959

AZL-48187

BDU:2023-06241

BDU:2025-14506

CVE-2023-36328

DLA-3857-1

MGASA-2023-0265

OESA-2023-1625

OPENSUSE-SU-2024:13425-1

ROSA-SA-2024-2529

USN-6402-1

USN-6402-2

Affected Products

Alt Linux

Astra Linux

Ibm Aix

Linuxmint

Red Os

Ubuntu

Libtommath

References · 51

• https://github.com/libtom/libtommath/pull/546 · Patch
• https://osv.dev/vulnerability/AZL-28639 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-36328 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ZUPWZGPFJ4JOI2NIP7YLRKZD5YXQTBK · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-36328 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0265 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-36959 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36328 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/46GORAXZ34MHQNUGJBKS7PJ5NSMIAJGC · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0212SE17 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3857-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1625 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-36328 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14506 · Security Note
• https://osv.dev/vulnerability/AZL-48187 · Vendor Advisory