CVE-2023-0687

2023-02-0600:00:00

CWE-120

VulDB

www.cve.org

vulnerability

gnu c library 2.38

buffer overflow

patch

vdb-220246

4.6 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.7%

JSON

A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It’s basically trusted input or input that needs an actual security flaw to be compromised or controlled.

CNA Affected

[
  {
    "vendor": "GNU",
    "product": "C Library",
    "versions": [
      {
        "version": "2.38",
        "status": "affected"
      }
    ]
  }
]