{"id":"CVE-2023-0341","aliases":["DEBIAN-CVE-2023-0341","DLA-3978-1","EUVD-2023-12402","GHSA-f352-cwm8-5w9w","MGASA-2023-0048","UBUNTU-CVE-2023-0341","USN-5842-1","USN-7168-1","openSUSE-SU-2023:0102-1","openSUSE-SU-2024:12906-1"],"status":"published","title":"Stack Buffer Overflow in editorconfig-core-c","description":"A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00999,"percentile":0.63189,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-787"],"published":"2023-01-30T00:00:00Z","modified":"2026-10-28T10:36:07Z","fixes":[{"ecosystem":"Debian:12","package":"editorconfig-core","fixed_in":["0.12.6-0.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"editorconfig-core","fixed_in":["0.12.6-0.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"editorconfig-core","fixed_in":["0.12.6-0.1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"editorconfig-core-c","fixed_in":["0.12.6-1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"editorconfig-core","fixed_in":["0.12.0-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"editorconfig-core","fixed_in":["0.12.1-1.1ubuntu0.18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"editorconfig-core","fixed_in":["0.12.1-1.1+deb11u1build0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"editorconfig-core","fixed_in":["0.12.1-1.1ubuntu0.20.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"editorconfig-core","fixed_in":["0.12.5-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"editorconfig-core-c","fixed_in":["0.12.6-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"editorconfig-core-c","fixed_in":["0.12.6-bp154.2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.6-0.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.6-0.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.6-0.1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1.1+deb11u1"}]}],"versions":["0.12.1-1.1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"editorconfig-core-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.6-1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-2ubuntu0.1~esm1"}]}],"versions":["0.12.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1.1ubuntu0.18.04.1~esm1"}]}],"versions":["0.12.1-1","0.12.1-1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1.1+deb11u1build0.20.04.1"}]}],"versions":["0.12.1-1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1.1ubuntu0.20.04.1~esm1"}]}],"versions":["0.12.1-1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-2ubuntu0.1~esm1"}]}],"versions":["0.12.1-1.1","0.12.1-2","0.12.5-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-2ubuntu0.1~esm1"}]}],"versions":["0.12.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1.1ubuntu0.18.04.1~esm1"}]}],"versions":["0.12.1-1","0.12.1-1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1.1ubuntu0.20.04.1~esm1"}]}],"versions":["0.12.1-1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-2ubuntu0.1~esm1"}]}],"versions":["0.12.1-1.1","0.12.1-2","0.12.5-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-2ubuntu0.1~esm2"}]}],"versions":["0.12.0-2","0.12.0-2ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1.1ubuntu0.18.04.1~esm2"}]}],"versions":["0.12.1-1","0.12.1-1.1","0.12.1-1.1ubuntu0.18.04.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1.1+deb11u1build0.20.04.1"}]}],"versions":["0.12.1-1.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-2ubuntu0.1~esm2"}]}],"versions":["0.12.1-1.1","0.12.1-2","0.12.5-2","0.12.5-2ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"editorconfig-core-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.6-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"editorconfig-core-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.6-bp154.2.3.1"}]}]}],"products":[{"vendor":"editorconfig","product":"editorconfig"},{"vendor":"editorconfig","product":"editorconfig c core"}],"references":[{"url":"https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529e","tags":["patch","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://litios.github.io/2023/01/14/CVE-2023-0341.html","tags":["technical-description","x_transferred","Exploit","Patch","Third Party Advisory","article"]},{"url":"https://ubuntu.com/security/notices/USN-5842-1","tags":["third-party-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZCFE7DXWAAKDJPRKMXHCACKGKNV37IYZ/","tags":["x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00036.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0341","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZCFE7DXWAAKDJPRKMXHCACKGKNV37IYZ"},{"url":"https://github.com/advisories/GHSA-f352-cwm8-5w9w"},{"url":"https://github.com/editorconfig/editorconfig-core-c/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0341.json","tags":["advisory"]},{"url":"https://github.com/editorconfig/editorconfig-core-c/releases","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-0341","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0048.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31516","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0341","tags":["report"]},{"url":"https://github.com/editorconfig/editorconfig-core-c/pull/87","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0341","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7168-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-53849","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PFRY22273IZL5F7JS7P3P2H4OJHOP3ZA/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1211032","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-0341","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-0341","title":"Stack Buffer Overflow in editorconfig-core-c","description":"A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.","status":"published","published":"2023-01-31T23:22:53.634Z","modified":"2025-11-03T21:46:50.07Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:35:35.580545Z"}],"euvd":[{"id":"EUVD-2023-12402","description":"A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.","status":"published","published":"2023-01-31T23:22:53Z","modified":"2025-11-03T21:46:50Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:31.25882Z"}],"ghsa":[{"id":"GHSA-f352-cwm8-5w9w","title":"A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6...","description":"A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.","status":"published","published":"2023-02-01T00:30:28Z","modified":"2025-11-04T00:31:37Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T15:04:28.99549Z"}],"nvd":[{"id":"CVE-2023-0341","description":"A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.","status":"published","published":"2023-02-01T00:15:10.343Z","modified":"2026-06-17T05:25:19.53Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:07:46.064662Z"}],"osv":[{"id":"CVE-2023-0341","title":"Stack Buffer Overflow in editorconfig-core-c","description":"A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.","status":"published","published":"2023-01-31T23:22:53.634Z","modified":"2026-10-28T10:36:07.040737304Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:44:29.487253Z"},{"id":"DEBIAN-CVE-2023-0341","description":"A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.","status":"published","published":"2023-02-01T00:15:10.343Z","modified":"2026-10-26T18:01:07.053207899Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.029012Z"},{"id":"UBUNTU-CVE-2023-0341","description":"A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.","status":"published","published":"2023-01-30T00:00:00Z","modified":"2026-04-22T13:59:34.779595Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:18.756095Z"},{"id":"DLA-3978-1","title":"editorconfig-core - security update","status":"published","published":"2024-11-30T00:00:00Z","modified":"2026-03-09T01:20:41.108921Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2023-0048","title":"Updated editorconfig-core-c packages fix security vulnerability","description":"Mark Esler and David Fernandez Gonzalez discovered that EditorConfig Core\nC incorrectly handled memory when handling certain inputs. An attacker\ncould possibly use this issue to cause applications using EditorConfig\nCore C to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2023-0341)\n","status":"published","published":"2023-02-14T22:43:23Z","modified":"2026-04-16T04:41:08.638009596Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2023:0102-1","title":"Security update for editorconfig-core-c","description":"This update for editorconfig-core-c fixes the following issues:\n\nUpdate to version 0.12.6:\n\n- CVE-2023-0341: Fixed a buffer overflow in ec_blob (boo#1211032)\n- Update property key, value length limits per spec change\n","status":"published","published":"2023-05-04T10:31:23Z","modified":"2026-02-04T02:57:38.586185Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12906-1","title":"editorconfig-0.12.6-1.1 on GA media","description":"These are all security issues fixed in the editorconfig-0.12.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:15:50.988813Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"USN-5842-1","title":"editorconfig-core vulnerability","description":"Mark Esler and David Fernandez Gonzalez discovered that\nEditorConfig Core C incorrectly handled memory when handling\ncertain inputs. An attacker could possibly use this issue to cause\napplications using EditorConfig Core C to crash, resulting in a\ndenial of service, or possibly execute arbitrary code.\n","status":"published","published":"2023-02-06T10:20:04Z","modified":"2026-06-25T13:31:45.407878218Z","updated_at":"2026-11-02T16:58:16.738762Z"},{"id":"USN-7168-1","title":"editorconfig-core vulnerabilities","description":"It was discovered that EditorConfig improperly managed memory when handling\ncertain inputs, leading to overflows. An attacker could possibly use these\nissues to cause a denial of service, or execute arbitrary code.\n","status":"published","published":"2024-12-18T09:48:05Z","modified":"2026-06-25T13:32:29.855153024Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}