Log in Start free

Vulnerability · Published Jan 27, 2024 · Assigned by mitre

CVE-2023-52389

Critical 9.8

In plain English

A critical-severity integer overflow in the poco package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.9%top 41.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12poco1.11.0-3+deb12u1DEBIAN-CVE-2023-52389
Debian:13poco1.13.0-6DEBIAN-CVE-2023-52389
Debian:14poco1.13.0-6DEBIAN-CVE-2023-52389
Ubuntu:22.04:LTSpocono fix listedUBUNTU-CVE-2023-52389
Ubuntu:24.04:LTSpocono fix listedUBUNTU-CVE-2023-52389
Ubuntu:25.10pocono fix listedUBUNTU-CVE-2023-52389
Ubuntu:26.04:LTSpocono fix listedUBUNTU-CVE-2023-52389
Ubuntu:26.10pocono fix listedUBUNTU-CVE-2023-52389

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References