PT-2024-13319 · Minizinc+1 · Minizinc+1

Gjduck · Published 2024-01-26 · Updated 2024-11-05 · CVE-2023-46046

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MiniZinc versions prior to 2.8.0

Description The issue allows a NULL pointer dereference via ti expr in a crafted .mzn file. This is disputed because there is no common libminizinc use case in which an unattended process is supposed to run forever to process a series of attacker-controlled .mzn files.

Recommendations For versions prior to 2.8.0, update to version 2.8.0 or later to resolve the issue. As a temporary workaround, consider restricting the processing of crafted .mzn files to minimize the risk of exploitation. Avoid using the ti expr function with untrusted input until the issue is resolved.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2023-46046

Affected Products

Debian

Minizinc

References · 15

• https://cve.org/CVERecord?id=CVE-2023-46046 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-46046 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46046 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46046 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46046 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-46046 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46046 · Vendor Advisory
• https://github.com/MiniZinc/libminizinc/issues/730 · Note
• https://github.com/MiniZinc/libminizinc/commit/afe67acc20898e4308044b54c4acf7a08df544f0 · Note
• https://t.me/cvenotify/74778 · Telegram Post
• https://twitter.com/CVEnew/status/1772855086735077697 · Twitter Post
• http://packetstormsecurity.com/files/176817/MiniZinc-2.7.6-Null-Pointer.html · Note
• https://minizinc.org/doc-2.8.3/en/changelog.html · Note
• http://seclists.org/fulldisclosure/2024/Jan/63 · Note
• https://twitter.com/VulmonFeeds/status/1751006413675995574 · Twitter Post