Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2023-24056

pkgconf: unbounded string expansion due to incorrect checks may result in buffer overflow

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pkgconf
Products
Pkgconf
CVE-2018-1000221

pkgconf: 1 byte out of bounds read for 0 length keys

pkgconf version 1.5.0 to 1.5.2 contains a Buffer Overflow vulnerability in dequote() that can result in dequote() function returns 1-byte allocation if initial length is 0, leading to buffer overflow. This attack appear to be exploitable via specially crafted .pc file. This vulnerability appears to have been fixed in 1.5.3.

CVSS 3.0 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Pkgconf
Products
Pkgconf