Lucene search

K
ubuntucveUbuntu.comUB:CVE-2023-6779
HistoryJan 31, 2024 - 12:00 a.m.

CVE-2023-6779

2024-01-3100:00:00
ubuntu.com
ubuntu.com
16
cve-2023-6779
heap-based overflow
buffer size calculation
application crash
syslog function
glibc 2.37+

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.2%

An off-by-one heap-based buffer overflow was found in the
__vsyslog_internal function of the glibc library. This function is called
by the syslog and vsyslog functions. This issue occurs when these functions
are called with a message bigger than INT_MAX bytes, leading to an
incorrect calculation of the buffer size to store the message, resulting in
an application crash. This issue affects glibc 2.37 and newer.

OSVersionArchitecturePackageVersionFilename
ubuntu23.10noarchglibc<Β 2.38-1ubuntu6.1UNKNOWN
ubuntu24.04noarchglibc<Β 2.39-0ubuntu1UNKNOWN

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.2%