CVE-2023-50434

{"id": "CVE-2023-50434", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-04-29T22:15:06.883", "references": [{"url": "https://papers.mathyvanhoef.com/esorics2024.pdf", "source": "cve@mitre.org"}, {"url": "https://papers.mathyvanhoef.com/esorics2024.pdf", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "emdns_resolve_raw in emdns.c in emdns through fbd1eef calls strlen with an input that may not be '\\0' terminated, leading to a stack-based buffer over-read. This can be triggered by a remote adversary that can send DNS requests to the emdns server. The impact could vary depending on the system libraries, compiler, and processor architecture. Code before be565c3 is unaffected."}, {"lang": "es", "value": "emdns_resolve_raw en emdns.c en emdns a trav\u00e9s de fbd1eef llama a strlen con una entrada que puede no estar terminada en '\\0', lo que provoca una sobrelectura del b\u00fafer basado en pila. Esto puede ser provocado por un adversario remoto que puede enviar solicitudes DNS al servidor emdns. El impacto podr\u00eda variar seg\u00fan las librer\u00edas del sistema, el compilador y la arquitectura del procesador. El c\u00f3digo anterior a be565c3 no se ve afectado."}], "lastModified": "2024-11-21T08:36:59.020", "sourceIdentifier": "cve@mitre.org"}