CVE-2023-52159

gross - security update

7.5 HighFix available

A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon crash) or potentially execute arbitrary code in grossd via crafted SMTP transaction parameters that cause an incorrect strncat for a log entry.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.05%Up 1.0 points since Mar 18, 2024

What each source reports

NVD Score used 7.5

Record: CVE-2023-52159
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-787
Updated: 2026-11-02

CVE List 7.5

Record: CVE-2023-52159
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-787
Updated: 2026-11-02

EUVDEUVD-2023-56832 7.5

Record: EUVD-2023-56832
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.5

Record: CVE-2023-52159
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-52159 7.5

Record: DEBIAN-CVE-2023-52159
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-52159 7.5

Record: UBUNTU-CVE-2023-52159
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUSN-6942-1 No score

gross vulnerability

It was discovered that Gross incorrectly handled memory when composing log entries. An attacker could possibly use this issue to cause Gross to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record: USN-6942-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`gross` Debian:12	before 1.0.2-4.1~deb12u1, plus listed versions 1.0.2-41.0.2-4.1~deb10u11.0.2-4.1~deb11u1	1.0.2-4.1~deb12u1
`gross` Debian:13	before 1.0.2-4.1	1.0.2-4.1
`gross` Debian:14	before 1.0.2-4.1	1.0.2-4.1
`gross` Debian:10	before 1.0.2-4.1~deb10u1, plus listed versions 1.0.2-4	1.0.2-4.1~deb10u1
`gross` Ubuntu:Pro:16.04:LTS	before 1.0.2-4ubuntu0.16.04.1~esm1, plus listed versions 1.0.2-4	1.0.2-4ubuntu0.16.04.1~esm1
`gross` Ubuntu:Pro:18.04:LTS	before 1.0.2-4ubuntu0.18.04.1~esm1, plus listed versions 1.0.2-41.0.2-4build1	1.0.2-4ubuntu0.18.04.1~esm1
`gross` Ubuntu:20.04:LTS	before 1.0.2-4ubuntu0.20.04.1, plus listed versions 1.0.2-4build1	1.0.2-4ubuntu0.20.04.1
`gross` Ubuntu:22.04:LTS	before 1.0.2-4ubuntu0.22.04.1, plus listed versions 1.0.2-4build1	1.0.2-4ubuntu0.22.04.1
`gross` Ubuntu:24.04:LTS	before 1.0.2-4ubuntu0.24.04.1, plus listed versions 1.0.2-4build11.0.2-4build2	1.0.2-4ubuntu0.24.04.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-52159 is a high vulnerability (CVSS 7.5) in Bizdelnick Gross, published March 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in gross 1.0.2-4.1~deb12u1.