CVE-2023-7224: Code Injection
Published Jan 8, 2024
·Updated
OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLDINSERTLIBRARIES environment variable
Affected Software
1 affected component
OpenVPN Connect Macos>=3.0.0<=3.4.6
Event History
Jan 8, 2024
CVE Published
via MITRE·01:55 PM
Data Sourced
via MITRE·01:55 PM
DescriptionWeakness
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-7224?
CVE-2023-7224 is classified as a high-severity vulnerability due to its potential for local code execution.
2
How do I fix CVE-2023-7224?
To fix CVE-2023-7224, update OpenVPN Connect to version 3.4.7 or later on your macOS.
3
What impact does CVE-2023-7224 have on macOS users?
CVE-2023-7224 allows local users to execute arbitrary code through improperly handled DYLD_INSERT_LIBRARIES environment variable.
4
Is my version of OpenVPN Connect affected by CVE-2023-7224?
If you are using OpenVPN Connect version 3.0 through 3.4.6 on macOS, you are affected by CVE-2023-7224.
5
Can remote attackers exploit CVE-2023-7224?
CVE-2023-7224 is not remotely exploitable; it requires local user access to execute the vulnerability.