CVE-2023-32181 - Vulnerability Details - OpenCVE

A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files This issue affects libeconf: before 0.5.2.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Opensuse	Libeconf

Configuration 1 [-]

cpe:2.3:a:opensuse:libeconf:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/openSUSE/libeconf/issues/178
https://https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32181
https://https://github.com/openSUSE/libeconf/issues/178
https://nvd.nist.gov/vuln/detail/CVE-2023-32181
https://www.cve.org/CVERecord?id=CVE-2023-32181

History

Fri, 10 Jan 2025 19:15:00 +0000

Type	Values Removed	Values Added
References		https://github.com/openSUSE/libeconf/issues/178
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: suse

Published: 2023-06-01T11:46:03.028Z

Updated: 2025-01-10T18:39:46.673Z

Reserved: 2023-05-04T08:30:59.320Z

Link: CVE-2023-32181

Vulnrichment

Updated: 2024-08-02T15:10:24.595Z

NVD

Status : Modified

Published: 2023-06-01T12:15:09.727

Modified: 2025-01-10T19:15:36.570

Link: CVE-2023-32181

Redhat

Severity : Moderate

Publid Date: 2023-03-16T00:00:00Z

Links: CVE-2023-32181 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32181", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2023-05-04T08:30:59.320Z", "datePublished": "2023-06-01T11:46:03.028Z", "dateUpdated": "2025-01-10T18:39:46.673Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://github.com/openSUSE/libeconf", "defaultStatus": "unaffected", "product": "libeconf", "vendor": "openSUSE", "versions": [{"lessThan": "0.5.2", "status": "affected", "version": "?", "versionType": "0.5.2"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "https://github.com/yangjiageng"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files<br><p>This issue affects libeconf: before 0.5.2.</p>"}], "value": "A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files\nThis issue affects libeconf: before 0.5.2.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-120", "description": "CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2023-06-01T11:46:03.028Z"}, "references": [{"url": "https://https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32181"}, {"url": "https://https://github.com/openSUSE/libeconf/issues/178"}], "source": {"discovery": "UNKNOWN"}, "title": "Stack buffer overflow in \"econf_writeFile\" function", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:10:24.595Z"}, "title": "CVE Program Container", "references": [{"url": "https://https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32181", "tags": ["x_transferred"]}, {"url": "https://https://github.com/openSUSE/libeconf/issues/178", "tags": ["x_transferred"]}]}, {"references": [{"url": "https://github.com/openSUSE/libeconf/issues/178", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-10T18:39:42.824723Z", "id": "CVE-2023-32181", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T18:39:46.673Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32181", "tags": ["x_transferred"]}, {"url": "https://https://github.com/openSUSE/libeconf/issues/178", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:10:24.595Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32181", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-10T18:39:42.824723Z"}}}], "references": [{"url": "https://github.com/openSUSE/libeconf/issues/178", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T18:39:37.665Z"}}], "cna": {"title": "Stack buffer overflow in \"econf_writeFile\" function", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "https://github.com/yangjiageng"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "openSUSE", "product": "libeconf", "versions": [{"status": "affected", "version": "?", "lessThan": "0.5.2", "versionType": "0.5.2"}], "collectionURL": "https://github.com/openSUSE/libeconf", "defaultStatus": "unaffected"}], "references": [{"url": "https://https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32181"}, {"url": "https://https://github.com/openSUSE/libeconf/issues/178"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files\nThis issue affects libeconf: before 0.5.2.\n\n", "supportingMedia": [{"type": "text/html", "value": "A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files<br><p>This issue affects libeconf: before 0.5.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2023-06-01T11:46:03.028Z"}}}, "cveMetadata": {"cveId": "CVE-2023-32181", "state": "PUBLISHED", "dateUpdated": "2025-01-10T18:39:46.673Z", "dateReserved": "2023-05-04T08:30:59.320Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2023-06-01T11:46:03.028Z", "assignerShortName": "suse"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opensuse:libeconf:*:*:*:*:*:*:*:*", "matchCriteriaId": "346C0440-B422-4C32-B61E-09467A38DF0B", "versionEndExcluding": "0.5.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files\nThis issue affects libeconf: before 0.5.2.\n\n"}], "id": "CVE-2023-32181", "lastModified": "2025-01-10T19:15:36.570", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "meissner@suse.de", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-06-01T12:15:09.727", "references": [{"source": "meissner@suse.de", "tags": ["Broken Link", "Issue Tracking", "Vendor Advisory"], "url": "https://https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32181"}, {"source": "meissner@suse.de", "tags": ["Broken Link", "Issue Tracking", "Vendor Advisory"], "url": "https://https://github.com/openSUSE/libeconf/issues/178"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Issue Tracking", "Vendor Advisory"], "url": "https://https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32181"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Issue Tracking", "Vendor Advisory"], "url": "https://https://github.com/openSUSE/libeconf/issues/178"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/openSUSE/libeconf/issues/178"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "meissner@suse.de", "type": "Secondary"}]}