Log in Start free

Vulnerability · Published Jan 12, 2024 · Assigned by mitre

CVE-2023-52339

Medium 6.5

In plain English

A medium-severity integer overflow in the libebml package (Alpine). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.1%top 34.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing. It may result in buffer overflows.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20libebml1.4.5-r0ALPINE-CVE-2023-52339
Alpine:v3.21libebml1.4.5-r0ALPINE-CVE-2023-52339
Alpine:v3.22libebml1.4.5-r0ALPINE-CVE-2023-52339
Alpine:v3.23libebml1.4.5-r0ALPINE-CVE-2023-52339
Alpine:v3.24libebml1.4.5-r0ALPINE-CVE-2023-52339
Debian:12libebml1.4.4-1+deb12u1DEBIAN-CVE-2023-52339
Debian:13libebml1.4.5-1DEBIAN-CVE-2023-52339
Debian:14libebml1.4.5-1DEBIAN-CVE-2023-52339

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References