Every CVE Search/ Get API key

CVE-2023-24056

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to...

5.5 MediumFix available

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.58%Down 0.3 points since Jan 22, 2023
90%50%10%1%

What each source reports

NVD Score used 5.5

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.

Record
CVE-2023-24056
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
CVE List 5.5

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.

Record
CVE-2023-24056
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2023-28120 5.5

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.

Record
EUVD-2023-28120
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-6rfm-3v66-6wr2 9.8

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to...

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.

Record
GHSA-6rfm-3v66-6wr2
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2023-24056 5.5

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.

Record
ALPINE-CVE-2023-24056
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-13124 5.5

CVE-2023-24056 affecting package pkgconf for versions less than 1.8.0-3

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.

Record
AZL-13124
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVBELL-CVE-2023-24056 5.5

CVE-2023-24056 does not affect BellSoft software

Record
BELL-CVE-2023-24056
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 5.5

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.

Record
CVE-2023-24056
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-24056 5.5

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.

Record
DEBIAN-CVE-2023-24056
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2023-1046 9.8

pkgconf security update

pkgconf is a program which helps to configure compiler and linker flags for development frameworks. It is similar to pkg-config from freedesktop.org, providing additional functionality while also maintaining compatibility.

Security Fix(es):

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.(CVE-2023-24056)

Record
OESA-2023-1046
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-24056 5.5

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.

Record
UBUNTU-CVE-2023-24056
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2023-0077 No score

Updated pkgconf packages fix security vulnerability

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes. (CVE-2023-24056)

Record
MGASA-2023-0077
Updated
2026-11-02
OSVopenSUSE-SU-2023:0043-1 No score

Security update for pkgconf

This update for pkgconf fixes the following issues:

  • CVE-2023-24056: FIxed variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c (boo#1207394).
Record
openSUSE-SU-2023:0043-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12653-1 No score

libpkgconf-devel-1.8.0-2.1 on GA media

These are all security issues fixed in the libpkgconf-devel-1.8.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12653-1
Updated
2026-11-02
OSVSUSE-SU-2023:0611-1 No score

Security update for pkgconf

This update for pkgconf fixes the following issues:

  • CVE-2023-24056: Fixed unbounded string expansion due to incorrect checks in libpkgconf/tuple.c (bsc#1207394).
Record
SUSE-SU-2023:0611-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pkgconf
Alpine:v3.14
 before 1.7.4-r1
1.7.4-r1
pkgconf
Alpine:v3.15
 before 1.8.1-r0
1.8.1-r0
pkgconf
Alpine:v3.16
 before 1.8.1-r0
1.8.1-r0
pkgconf
Alpine:v3.17
 before 1.9.4-r0
1.9.4-r0
pkgconf
Alpine:v3.18
 before 1.9.4-r0
1.9.4-r0
pkgconf
Alpine:v3.19
 before 1.9.4-r0
1.9.4-r0
pkgconf
Alpine:v3.20
 before 1.9.4-r0
1.9.4-r0
pkgconf
Alpine:v3.21
 before 1.9.4-r0
1.9.4-r0
pkgconf
Alpine:v3.22
 before 1.9.4-r0
1.9.4-r0
pkgconf
Alpine:v3.23
 before 1.9.4-r0
1.9.4-r0
Show 17 moreShow less
Affected packages
PackageAffectedFixed
pkgconf
Alpine:v3.24
 before 1.9.4-r0
1.9.4-r0
pkgconf
Azure Linux:2
 before 1.8.0-3
1.8.0-3
pkgconf
Debian:12
 before 1.8.1-1
1.8.1-1
pkgconf
Debian:13
 before 1.8.1-1
1.8.1-1
pkgconf
Debian:14
 before 1.8.1-1
1.8.1-1
pkgconf
Mageia:8
 before 1.7.3-2.1.mga8
1.7.3-2.1.mga8
pkgconf
openEuler:20.03-LTS-SP1
 before 1.7.3-2.oe1
1.7.3-2.oe1
pkgconf
openEuler:20.03-LTS-SP3
 before 1.7.3-2.oe1
1.7.3-2.oe1
pkgconf
openEuler:22.03-LTS
 before 1.8.0-3.oe2203sp1
1.8.0-3.oe2203sp1
pkgconf
openEuler:22.03-LTS-SP1
 before 1.8.0-3.oe2203sp1
1.8.0-3.oe2203sp1
pkgconf
openSUSE:Leap 15.4
 before 1.8.0-150400.3.3.1
1.8.0-150400.3.3.1
pkgconf
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.9.12-1
 None known
pkgconf
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.9.12-6
 None known
pkgconf
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.6.3-41.6.3-5
 None known
pkgconf
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.7.4~git20210206+dcf529b-31.8.0-1
 None known
pkgconf
SUSE:Package Hub 15 SP3
 before 1.5.3-bp153.2.3.1
1.5.3-bp153.2.3.1
pkgconf
openSUSE:Leap 15.3
 before 1.5.3-bp153.2.3.1
1.5.3-bp153.2.3.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-24056 is a medium vulnerability (CVSS 5.5) in Pkgconf, published January 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 48th percentile. Fixed in pkgconf 1.7.4-r1.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open