CVE-2023-40305
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
- Record
CVE-2023-40305- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
- Record
CVE-2023-40305- Updated
- 2026-11-02
EUVDEUVD-2023-44897 No score
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
- Record
EUVD-2023-44897- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9rpm-p244-mjrf
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
- Record
GHSA-9rpm-p244-mjrf- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVAZL-43837
CVE-2023-40305 affecting package indent 2.2.12-6
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
- Record
AZL-43837- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-45015
CVE-2023-40305 affecting package indent for versions less than 2.2.13-1
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
- Record
AZL-45015- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
Show 12 moreShow less
OSV
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
- Record
CVE-2023-40305- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-40305
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
- Record
DEBIAN-CVE-2023-40305- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2023-1552
indent security update
The indent program can be used to make code easier to read. It can also convert from one style of writing C to another. indent understands a substantial amount about the syntax of C, but it also attempts to cope with incomplete and misformed syntax.
Security Fix(es):
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.(CVE-2023-40305)
- Record
OESA-2023-1552- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-40305
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
- Record
UBUNTU-CVE-2023-40305- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2023-0274 No score
Updated indent package fixes security vulnerabilities
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file. (CVE-2023-40305)
GNU indent 2.2.13 has a heap overread in lexi().
- Record
MGASA-2023-0274- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13149-1 No score
indent-2.2.13-2.1 on GA media
These are all security issues fixed in the indent-2.2.13-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13149-1- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-318-CVE-2023-40305 No score
CVE-2023-40305 in indent - Patched by Root
Root has patched CVE-2023-40305 in the indent package for Root:Alpine:3.18. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-318-CVE-2023-40305- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-319-CVE-2023-40305 No score
CVE-2023-40305 in indent - Patched by Root
Root has patched CVE-2023-40305 in the indent package for Root:Alpine:3.19. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-319-CVE-2023-40305- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-320-CVE-2023-40305 No score
CVE-2023-40305 in indent - Patched by Root
Root has patched CVE-2023-40305 in the indent package for Root:Alpine:3.20. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-320-CVE-2023-40305- Updated
- 2026-11-02
OSVSUSE-SU-2023:3432-1 No score
Security update for indent
This update for indent fixes the following issues:
- CVE-2023-40305: Fixed a memory safety issues bug. (bsc#1214243)
- Record
SUSE-SU-2023:3432-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3433-1 No score
Security update for indent
This update for indent fixes the following issues:
- CVE-2023-40305: Fixed a memory safety issues bug. (bsc#1214243)
- Record
SUSE-SU-2023:3433-1- Updated
- 2026-11-02
OSVUSN-6389-1 No score
indent vulnerability
It was discovered that Indent incorrectly handled parsing certain source files. If a user or automated system were tricked into processing a specially crafted source file, a remote attacker could use this issue to cause Indent to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-6389-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
indentAzure Linux:2 |
through 2.2.12-6 | None known |
indentAzure Linux:3 |
before 2.2.13-1 | 2.2.13-1 |
indentDebian:12 |
before 2.2.12-4+deb12u2, plus listed versions 2.2.12-42.2.12-4+deb12u1 |
2.2.12-4+deb12u2 |
indentDebian:13 |
before 2.2.13-3 | 2.2.13-3 |
indentDebian:14 |
before 2.2.13-3 | 2.2.13-3 |
indentMageia:8 |
before 2.2.13-1.1.mga8 | 2.2.13-1.1.mga8 |
indentMageia:9 |
before 2.2.13-1.1.mga9 | 2.2.13-1.1.mga9 |
indentopenEuler:20.03-LTS-SP1 |
before 2.2.11-29.oe1 | 2.2.11-29.oe1 |
indentopenEuler:20.03-LTS-SP3 |
before 2.2.11-29.oe1 | 2.2.11-29.oe1 |
indentopenEuler:22.03-LTS |
before 2.2.11-29.oe2203sp2 | 2.2.11-29.oe2203sp2 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
indentopenEuler:22.03-LTS-SP1 |
before 2.2.11-29.oe2203sp1 | 2.2.11-29.oe2203sp1 |
indentopenEuler:22.03-LTS-SP2 |
before 2.2.11-29.oe2203sp2 | 2.2.11-29.oe2203sp2 |
indentRoot:Alpine:3.18 |
before 2.2.13-r10071 | 2.2.13-r100712.2.13-r100722.2.13-r100752.2.13-r100732.2.13-r10074 |
rootio-indentRoot:Alpine:3.18 |
before 2.2.13-r10071 | 2.2.13-r100712.2.13-r100722.2.13-r100752.2.13-r100732.2.13-r10074 |
indentRoot:Alpine:3.19 |
before 2.2.13-r20071 | 2.2.13-r200712.2.13-r200742.2.13-r200732.2.13-r200722.2.13-r20075 |
rootio-indentRoot:Alpine:3.19 |
before 2.2.13-r20071 | 2.2.13-r200712.2.13-r200742.2.13-r200732.2.13-r200722.2.13-r20075 |
indentRoot:Alpine:3.20 |
before 2.2.13-r20071 | 2.2.13-r200712.2.13-r200722.2.13-r200742.2.13-r200732.2.13-r20075 |
rootio-indentRoot:Alpine:3.20 |
before 2.2.13-r20071 | 2.2.13-r200712.2.13-r200722.2.13-r200742.2.13-r200732.2.13-r20075 |
indentSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 2.2.10-38.6.1 | 2.2.10-38.6.1 |
indentSUSE:Linux Enterprise Module for Development Tools 15 SP4 |
before 2.2.11-150000.3.6.1 | 2.2.11-150000.3.6.1 |
indentSUSE:Linux Enterprise Module for Development Tools 15 SP5 |
before 2.2.11-150000.3.6.1 | 2.2.11-150000.3.6.1 |
indentopenSUSE:Leap 15.4 |
before 2.2.11-150000.3.6.1 | 2.2.11-150000.3.6.1 |
indentopenSUSE:Leap 15.5 |
before 2.2.11-150000.3.6.1 | 2.2.11-150000.3.6.1 |
indentUbuntu:16.04:LTS |
All versions, plus listed versions 2.2.11-4 |
None known |
indentUbuntu:18.04:LTS |
All versions, plus listed versions 2.2.11-5 |
None known |
indentUbuntu:20.04:LTS |
before 2.2.12-1ubuntu0.20.04.1, plus listed versions 2.2.12-1 |
2.2.12-1ubuntu0.20.04.1 |
indentUbuntu:22.04:LTS |
before 2.2.12-1ubuntu0.22.04.1, plus listed versions 2.2.12-1build12.2.12-1build2 |
2.2.12-1ubuntu0.22.04.1 |
indentopenSUSE:Tumbleweed |
before 2.2.13-2.1 | 2.2.13-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-40305 is a medium vulnerability (CVSS 5.5) in Gnu Indent, published August 14, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in indent 2.2.13-1.
References
savannah.gnu.org/bugs/index.php?64503
ftp.gnu.org/gnu/indent
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W6SL3NKMH5R4S5PD2O3MTC2UR4SBVHK
nvd.nist.gov/vuln/detail/CVE-2023-40305
Show 15 moreShow less
github.com/advisories/GHSA-9rpm-p244-mjrf
security-tracker.debian.org/tracker/CVE-2023-40305
advisories.mageia.org/MGASA-2023-0274.html
bugs.mageia.org/show_bug.cgi?id=32273
cve.org/CVERecord?id=CVE-2023-40305
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1552
suse.com/support/update/announcement/2023/suse-su-20233432-1
bugzilla.suse.com/1214243
ubuntu.com/security/CVE-2023-40305