Log in Start free

Vulnerability · Published Jan 31, 2024 · Assigned by redhat

CVE-2023-6780Glibc: integer overflow in __vsyslog_internal()

Medium 5.3

In plain English

A medium-severity security flaw in Fedora from Fedora. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)2.7%top 14.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12glibc2.36-9+deb12u4DEBIAN-CVE-2023-6780
Debian:12glibc2.36-9+deb12u4DSA-5611-1
Debian:13glibc2.37-15DEBIAN-CVE-2023-6780
Debian:14glibc2.37-15DEBIAN-CVE-2023-6780
Ubuntu:24.04:LTSglibc2.39-0ubuntu1UBUNTU-CVE-2023-6780

Affected products (as reported)

VendorProductVersions
n/a glibc see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Fedora Fedora see references

Weakness: CWE-131 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References