CVE-2023-39741 - Vulnerability Details - OpenCVE

ReportizFlow

lrzip v0.651 was discovered to contain a heap overflow via the libzpaq::PostProcessor::write(int) function at /libzpaq/libzpaq.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Long Range Zip Project	Long Range Zip

Configuration 1 [-]

cpe:2.3:a:long_range_zip_project:long_range_zip:0.651:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://gist.github.com/huanglei3/ec9090096aa92445cf0a8baa8e929084
https://github.com/ckolivas/lrzip/issues/246
https://github.com/huanglei3/lrzip_poc/tree/main/lrzip_heap_overflow

History

Tue, 08 Oct 2024 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-08-17T00:00:00

Updated: 2024-10-08T18:17:07.657Z

Reserved: 2023-08-07T00:00:00

Link: CVE-2023-39741

Vulnrichment

Updated: 2024-08-02T18:18:09.664Z

NVD

Status : Modified

Published: 2023-08-17T19:15:12.977

Modified: 2024-11-21T08:15:54.253

Link: CVE-2023-39741

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:long_range_zip_project:long_range_zip:0.651:*:*:*:*:*:*:*", "matchCriteriaId": "052FD35D-AAF5-4D09-8F2A-E56F6C3B63D7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "lrzip v0.651 was discovered to contain a heap overflow via the libzpaq::PostProcessor::write(int) function at /libzpaq/libzpaq.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file."}, {"lang": "es", "value": "Se descubri\u00f3 que lrzip v0.651 contiene un desbordamiento de mont\u00edculo a trav\u00e9s de la funci\u00f3n libzpaq::PostProcessor::write(int) en /libzpaq/libzpaq.cpp. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de un archivo manipulado."}], "id": "CVE-2023-39741", "lastModified": "2024-11-21T08:15:54.253", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-08-17T19:15:12.977", "references": [{"source": "[email protected]", "url": "https://gist.github.com/huanglei3/ec9090096aa92445cf0a8baa8e929084"}, {"source": "[email protected]", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/ckolivas/lrzip/issues/246"}, {"source": "[email protected]", "tags": ["Exploit"], "url": "https://github.com/huanglei3/lrzip_poc/tree/main/lrzip_heap_overflow"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://gist.github.com/huanglei3/ec9090096aa92445cf0a8baa8e929084"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/ckolivas/lrzip/issues/246"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://github.com/huanglei3/lrzip_poc/tree/main/lrzip_heap_overflow"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "[email protected]", "type": "Primary"}]}