CVE-2023-46850: Use After Free
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.4.7-1+deb10u1Fixed in 2.5.1-3Fixed in 2.6.3-1+deb12u2Fixed in 2.6.7-1 - Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.4.7-1+deb10u1 - Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.5.1-3 - Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.6.3-1+deb12u2 - Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.6.7-1
Event History
Frequently Asked Questions
What is CVE-2023-46850?
CVE-2023-46850 is a Use after free vulnerability in OpenVPN version 2.6.0 to 2.6.6 that may lead to undefined behavior, memory buffer leaks, or remote execution.
How can CVE-2023-46850 affect my system?
CVE-2023-46850 can potentially lead to undefined behavior, memory buffer leaks, or remote execution if network buffers are sent to a remote peer.
What software versions are affected by CVE-2023-46850?
OpenVPN versions 2.6.0 to 2.6.6 are affected by CVE-2023-46850.
What is the severity level of CVE-2023-46850?
The severity level of CVE-2023-46850 is not specified.
How can I fix CVE-2023-46850?
To fix CVE-2023-46850, update OpenVPN to version 2.6.7 or apply the applicable remedies provided by Debian.