Описание
editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 0.12.10+~0.17.1-3ubuntu0.1 |
| esm-apps-legacy/xenial | released | 0.12.0-2ubuntu0.1~esm3 |
| esm-apps/bionic | released | 0.12.1-1.1ubuntu0.18.04.1~esm3 |
| esm-apps/focal | released | 0.12.1-1.1+deb11u1ubuntu0.1~esm1 |
| esm-apps/jammy | released | 0.12.5-2ubuntu0.1~esm3 |
| esm-apps/xenial | ignored | end of ESM support, was needs-triage |
| jammy | needed | |
| noble | released | 0.12.7-0.1ubuntu0.1 |
| questing | released | 0.12.9+~0.17.1-1ubuntu2.1 |
| resolute | released | 0.12.10+~0.17.1-3ubuntu0.1 |
Показывать по
EPSS
Связанные уязвимости
editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.
editorconfig-core-c is an EditorConfig core library for use by plugin ...
EPSS