CVE-2023-39947: Another heap overflow in push_back_helper
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, even after the fix at commit 3492270, malformed PIDPROPERTYLIST parameters cause heap overflow at a different program counter. This can remotely crash any Fast-DDS process. Versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6 contain a patch for this issue.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-39947?
CVE-2023-39947 is a vulnerability in eprosima Fast DDS that allows heap overflow due to malformed `PID_PROPERTY_LIST` parameters.
Which versions of eprosima Fast DDS are affected by CVE-2023-39947?
Versions 2.6.0 to 2.6.6, 2.9.0 to 2.9.2, 2.10.0 to 2.10.2, and 2.11.0 are affected by CVE-2023-39947.
What is the severity of CVE-2023-39947?
CVE-2023-39947 has a severity rating of 7.5 (high).
How can I fix CVE-2023-39947?
To fix CVE-2023-39947, update eprosima Fast DDS to version 2.11.1, 2.10.2, 2.9.2, or 2.6.6.
Where can I find more information about CVE-2023-39947?
You can find more information about CVE-2023-39947 on the GitHub security advisory page and the Debian security advisory page.