Every CVE Search/ Get API key

CVE-2023-2602

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a...

3.3 LowFix available

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.35%Up 0.3 points since Jun 7, 2023
90%50%10%1%

What each source reports

NVD Score used 3.3

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

Record
CVE-2023-2602
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-401
Updated
2026-11-02
CVE List No score

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

Record
CVE-2023-2602
Weakness
CWE-401
Updated
2026-11-02
EUVDEUVD-2023-34076 No score

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

Record
EUVD-2023-34076
Updated
2026-11-03
GitHub AdvisoriesGHSA-7wq6-hwpj-wcq2 3.3

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a...

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

Record
GHSA-7wq6-hwpj-wcq2
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-401
Updated
2026-11-02
OSVALPINE-CVE-2023-2602 3.3

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

Record
ALPINE-CVE-2023-2602
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-27064 3.3

CVE-2023-2602 affecting package libcap for versions less than 2.60-2

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

Record
AZL-27064
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 16 moreShow less
OSVBELL-CVE-2023-2602 3.3

CVE-2023-2602 does not affect BellSoft software

Record
BELL-CVE-2023-2602
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSV 3.3

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

Record
CVE-2023-2602
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2023-2602 3.3

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

Record
DEBIAN-CVE-2023-2602
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2023-1342 4.4

libcap security update

This is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.(CVE-2023-2602)

A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB.(CVE-2023-2603)

Record
OESA-2023-1342
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2023-1345 4.4

libcap security update

This is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.(CVE-2023-2602)

A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB.(CVE-2023-2603)

Record
OESA-2023-1345
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVRHSA-2023:4524 7.8

Red Hat Security Advisory: libcap security update

Record
RHSA-2023:4524
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:5071 7.8

Red Hat Security Advisory: libcap security update

Record
RHSA-2023:5071
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:7400 7.8

Red Hat Security Advisory: libcap security update

Record
RHSA-2023:7400
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-2602 3.3

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

Record
UBUNTU-CVE-2023-2602
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVALSA-2023:4524 No score

Moderate: libcap security update

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

  • libcap: Integer Overflow in _libcap_strdup() (CVE-2023-2603)
  • libcap: Memory Leak on pthread_create() Error (CVE-2023-2602)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:4524
Updated
2026-11-02
OSVALSA-2023:5071 No score

Moderate: libcap security update

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

  • libcap: Integer Overflow in _libcap_strdup() (CVE-2023-2603)
  • libcap: Memory Leak on pthread_create() Error (CVE-2023-2602)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:5071
Updated
2026-11-02
OSVMGASA-2023-0205 No score

Updated libcap packages fix security vulnerability

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory. (CVE-2023-2602)

A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB. (CVE-2023-2603)

Record
MGASA-2023-0205
Updated
2026-11-02
OSVopenSUSE-SU-2024:12945-1 No score

libcap-devel-2.69-1.1 on GA media

These are all security issues fixed in the libcap-devel-2.69-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12945-1
Updated
2026-11-02
OSVRLSA-2023:4524 No score

Moderate: libcap security update

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

  • libcap: Integer Overflow in _libcap_strdup() (CVE-2023-2603)

  • libcap: Memory Leak on pthread_create() Error (CVE-2023-2602)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:4524
Updated
2026-11-02
OSVSUSE-SU-2023:2765-1 No score

Security update for libcap

This update for libcap fixes the following issues:

  • CVE-2023-2602: Fixed improper memory release in libcap/psx/psx.c:__wrap_pthread_create() (bsc#1211418).
  • CVE-2023-2603: Fixed an integer overflow or wraparound in libcap/cap_alloc.c:_libcap_strdup() (bsc#1211419).
Record
SUSE-SU-2023:2765-1
Updated
2026-11-02
OSVUSN-6166-1 No score

libcap2 vulnerabilities

David Gstir discovered that libcap2 incorrectly handled certain return codes. An attacker could possibly use this issue to cause libcap2 to consume memory, leading to a denial of service. (CVE-2023-2602)

Richard Weinberger discovered that libcap2 incorrectly handled certain long input strings. An attacker could use this issue to cause libcap2 to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-2603)

Record
USN-6166-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libcap
Alpine:v3.15
 before 2.61-r1
2.61-r1
libcap
Alpine:v3.16
 before 2.64-r1
2.64-r1
libcap
Alpine:v3.17
 before 2.66-r1
2.66-r1
libcap
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.48-5.el8_8
2.48-5.el8_8
libcap-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.48-5.el8_8
2.48-5.el8_8
libcap
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.48-9.el9_2
2.48-9.el9_2
libcap-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.48-9.el9_2
2.48-9.el9_2
libcap
Azure Linux:2
 before 2.60-2
2.60-2
libcap2
Debian:12
 before 1:2.66-4
1:2.66-4
libcap2
Debian:13
 before 1:2.66-4
1:2.66-4
Show 35 moreShow less
Affected packages
PackageAffectedFixed
libcap2
Debian:14
 before 1:2.66-4
1:2.66-4
libcap2
Debian:11
From an advisory covering 3 CVEs
 before 1:2.44-1+deb11u1, plus listed versions
1:2.44-1
1:2.44-1+deb11u1
libcap
Mageia:8
From an advisory covering 2 CVEs
 before 2.46-1.1.mga8
2.46-1.1.mga8
libcap
openEuler:22.03-LTS-SP1
From an advisory covering 2 CVEs
 before 2.61-5.oe2203sp1
2.61-5.oe2203sp1
libcap
openEuler:22.03-LTS
From an advisory covering 2 CVEs
 before 2.61-5.oe2203
2.61-5.oe2203
libcap
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:2.48-5.el8_8
0:2.48-5.el8_8
libcap-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:2.48-5.el8_8
0:2.48-5.el8_8
libcap-debugsource
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:2.48-5.el8_8
0:2.48-5.el8_8
libcap-devel
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:2.48-5.el8_8
0:2.48-5.el8_8
libcap-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.48-9.el9_2
0:2.48-9.el9_2
libcap-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.48-9.el9_2
0:2.48-9.el9_2
libcap-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.48-9.el9_2
0:2.48-9.el9_2
libcap
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:2.48-9.el9_2
0:2.48-9.el9_2
libcap-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:2.48-9.el9_2
0:2.48-9.el9_2
libcap-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:2.48-9.el9_2
0:2.48-9.el9_2
libcap
Red Hat:rhel_eus:8.6::baseos
From an advisory covering 2 CVEs
 before 0:2.48-4.el8_6
0:2.48-4.el8_6
libcap-debuginfo
Red Hat:rhel_eus:8.6::baseos
From an advisory covering 2 CVEs
 before 0:2.48-4.el8_6
0:2.48-4.el8_6
libcap-debugsource
Red Hat:rhel_eus:8.6::baseos
From an advisory covering 2 CVEs
 before 0:2.48-4.el8_6
0:2.48-4.el8_6
libcap-devel
Red Hat:rhel_eus:8.6::baseos
From an advisory covering 2 CVEs
 before 0:2.48-4.el8_6
0:2.48-4.el8_6
libcap
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2.48-5.el8_8
0:2.48-5.el8_8
libcap
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 2 CVEs
 before 2.63-150400.3.3.1
2.63-150400.3.3.1
libcap
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 2 CVEs
 before 2.63-150400.3.3.1
2.63-150400.3.3.1
libcap
SUSE:Linux Enterprise Module for Basesystem 15 SP4
From an advisory covering 2 CVEs
 before 2.63-150400.3.3.1
2.63-150400.3.3.1
libcap
SUSE:Linux Enterprise Module for Basesystem 15 SP5
From an advisory covering 2 CVEs
 before 2.63-150400.3.3.1
2.63-150400.3.3.1
libcap
openSUSE:Leap Micro 5.3
From an advisory covering 2 CVEs
 before 2.63-150400.3.3.1
2.63-150400.3.3.1
libcap
openSUSE:Leap 15.4
From an advisory covering 2 CVEs
 before 2.63-150400.3.3.1
2.63-150400.3.3.1
libcap
openSUSE:Leap 15.5
From an advisory covering 2 CVEs
 before 2.63-150400.3.3.1
2.63-150400.3.3.1
libcap2
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1:2.22-1.2ubuntu21:2.24-0ubuntu11:2.24-0ubuntu21:2.24-0ubuntu2+esm11:2.24-0ubuntu2+esm2
 None known
libcap2
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1:2.24-91:2.24-121:2.24-12ubuntu0.1~esm11:2.24-12ubuntu0.1~esm2
 None known
libcap2
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:2.25-1.11:2.25-1.21:2.25-1.2ubuntu0.1~esm11:2.25-1.2ubuntu0.1~esm2
 None known
libcap2
Ubuntu:20.04:LTS
 before 1:2.32-1ubuntu0.1, plus listed versions
1:2.25-21:2.27-11:2.32-1
1:2.32-1ubuntu0.1
libcap2
Ubuntu:22.04:LTS
 before 1:2.44-1ubuntu0.22.04.1, plus listed versions
1:2.44-1build11:2.44-1build21:2.44-1build3
1:2.44-1ubuntu0.22.04.1
libcap2
Ubuntu:24.04:LTS
 before 1:2.66-4ubuntu1
1:2.66-4ubuntu1
libcap2
Ubuntu:20.04:LTS
From an advisory covering 2 CVEs
 before 1:2.32-1ubuntu0.1, plus listed versions
1:2.25-21:2.27-11:2.32-1
1:2.32-1ubuntu0.1
libcap2
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 1:2.44-1ubuntu0.22.04.1, plus listed versions
1:2.44-1build11:2.44-1build21:2.44-1build3
1:2.44-1ubuntu0.22.04.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-2602 is a low vulnerability (CVSS 3.3) in Libcap Project Libcap, published May 15, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in libcap 2.61-r1.

References

Show 36 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open