CVE-2023-22652: Stack buffer overflow in "read_file" function
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to DoS via malformed config files. This issue affects libeconf: before 0.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libeconfto a version that resolves this vulnerability.Fixed in 0.3.8-1+deb11u1Fixed in 0.5.1+dfsg1-1+deb12u1Fixed in 0.7.7+dfsg1-1Fixed in 0.8.3+dfsg1-1 - Upgrade
Upgrade
libeconfto a version that resolves this vulnerability.Fixed in 0.5.2
Event History
Frequently Asked Questions
What is CVE-2023-22652?
CVE-2023-22652 is a Buffer Copy without Checking Size of Input (Classic Buffer Overflow) vulnerability in openSUSE libeconf that leads to a DoS via malformed config files.
How does CVE-2023-22652 affect openSUSE libeconf?
CVE-2023-22652 affects openSUSE libeconf versions before 0.5.2.
What is the severity of CVE-2023-22652?
The severity of CVE-2023-22652 is medium, with a severity value of 6.5.
How can CVE-2023-22652 be exploited?
CVE-2023-22652 can be exploited by using malformed config files to trigger a buffer overflow.
Is there a fix available for CVE-2023-22652?
Yes, a fix is available for CVE-2023-22652 by updating to openSUSE libeconf version 0.5.2 or later.