CVE-2023-39976: Buffer Overflow

Q: What is CVE-2023-39976?

CVE-2023-39976 is a vulnerability in libqb before 2.0.8 that allows a buffer overflow via long log messages.

Q: What is the severity of CVE-2023-39976?

CVE-2023-39976 has a severity score of 9.8 (Critical).

Q: How does CVE-2023-39976 affect Clusterlabs Libqb?

CVE-2023-39976 affects Clusterlabs Libqb versions up to and excluding 2.0.8.

Q: How does CVE-2023-39976 affect Ubuntu libqb?

CVE-2023-39976 affects Ubuntu libqb versions 2.0.4-1ubuntu0.2 and 2.0.6-2ubuntu0.1.

Q: How can I fix CVE-2023-39976?

To fix CVE-2023-39976, update libqb to version 2.0.8 or later.

Published Aug 8, 2023

Updated

logblackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.

Affected Software

5 affected componentsFixes available

ubuntu/libqb<2.0.4-1ubuntu0.2

2.0.4-1ubuntu0.2

ubuntu/libqb<2.0.6-2ubuntu0.1

2.0.6-2ubuntu0.1

debian/libqb<=2.0.3-1, <=2.0.6-2

1.0.5-12.0.8-1

redhat/libqb<2.0.8

2.0.8

ClusterLabs libqb<2.0.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libqb to a version that resolves this vulnerability.
Fixed in 2.0.4-1ubuntu0.2
Upgrade
Upgrade ubuntu/libqb to a version that resolves this vulnerability.
Fixed in 2.0.6-2ubuntu0.1
Upgrade
Upgrade debian/libqb to a version that resolves this vulnerability.
Fixed in 1.0.5-1Fixed in 2.0.8-1
Upgrade
Upgrade redhat/libqb to a version that resolves this vulnerability.
Fixed in 2.0.8

Event History

Aug 8, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Aug 9, 2023

Data Sourced

via Red Hat·08:36 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

USN-6308-1

Frequently Asked Questions

What is CVE-2023-39976?

CVE-2023-39976 is a vulnerability in libqb before 2.0.8 that allows a buffer overflow via long log messages.

What is the severity of CVE-2023-39976?