PT-2023-9304 · Espeak-Ng+6 · Espeak-Ng+6

Jaroslav ��Karvada · Published 2023-12-12 · Updated 2025-05-31 · CVE-2023-49993

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Espeak-ng version 1.52-dev

Description The issue is related to a buffer overflow in the ReadClause() function of the Espeak speech synthesizer, which occurs due to the lack of size checking for input data. This can potentially allow an attacker to cause a denial of service or execute arbitrary code. The vulnerability is associated with the readclause.c file.

Recommendations For Espeak-ng version 1.52-dev, consider disabling the ReadClause() function as a temporary workaround until a patch is available. Restrict access to the readclause.c file to minimize the risk of exploitation. Avoid using the ReadClause() function in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

AZL-34678

BDU:2024-06184

CVE-2023-49993

DLA-4198-1

MGASA-2024-0249

OESA-2024-1021

OESA-2024-1057

SUSE-SU-2024:2632-1

USN-6858-1

Affected Products

Astra Linux

Debian

Espeak-Ng

Linuxmint

Red Os

Suse

Ubuntu

References · 55

• 🔥 https://github.com/espeak-ng/espeak-ng/issues/1826 · Exploit
• https://osv.dev/vulnerability/OESA-2024-1057 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49993 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2632-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-49991 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0249.html · Security Note
• https://osv.dev/vulnerability/DLA-4198-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1021 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ · Vendor Advisory
• https://osv.dev/vulnerability/AZL-34678 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-49993 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6858-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06184 · Security Note