PT-2024-14579 · Poco+1 · Poco+1

Obiltschnig · Published 2019-09-20 · Updated 2025-07-08 · CVE-2023-52389

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions POCO versions prior to 1.11.8p2 POCO versions prior to 1.12.5p2 POCO versions prior to 1.13.0

Description The issue is caused by an integer overflow and resultant stack buffer overflow in UTF32Encoding.cpp, specifically in the Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() functions. This occurs when a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher, potentially returning a negative integer.

Recommendations For versions prior to 1.11.8p2, update to version 1.11.8p2 or later. For versions prior to 1.12.5p2, update to version 1.12.5p2 or later. For versions prior to 1.13.0, update to version 1.13.0 or later.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2019-2751

ALT-PU-2022-7647

ALT-PU-2023-8418

ALT-PU-2023-8419

ALT-PU-2024-13338

ALT-PU-2024-13957

ALT-PU-2024-15577

BDU:2025-04748

CVE-2023-52389

DLA-4024-1

OPENSUSE-SU-2025:15322-1

Affected Products

Alt Linux

Poco

References · 23

• 🔥 https://github.com/pocoproject/poco/issues/4320 · Exploit
• 🔥 https://github.com/pocoproject/poco/compare/poco-1.12.5p2-release...poco-1.13.0-release · Exploit
• 🔥 https://github.com/pocoproject/poco/commit/62f875dfe1298041289f926a6a1a39cb765b13ee · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2025:15322-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-52389 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4024-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-52389 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52389 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-52389 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-52389 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-52389 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04748 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52389 · Security Note
• https://lists.debian.org/debian-lts-announce/2025/01/msg00017.html · Note
• https://pocoproject.org/blog/?p=1226 · Note