{"id":"CVE-2023-24056","aliases":["ALPINE-CVE-2023-24056","AZL-13124","BELL-CVE-2023-24056","DEBIAN-CVE-2023-24056","EUVD-2023-28120","GHSA-6rfm-3v66-6wr2","MGASA-2023-0077","OESA-2023-1046","SUSE-SU-2023:0611-1","UBUNTU-CVE-2023-24056","openSUSE-SU-2023:0043-1","openSUSE-SU-2024:12653-1"],"status":"published","title":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to...","description":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00581,"percentile":0.48276,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2023-01-22T00:00:00Z","modified":"2026-10-28T02:31:02Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"pkgconf","fixed_in":["1.7.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"pkgconf","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"pkgconf","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"pkgconf","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"pkgconf","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"pkgconf","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"pkgconf","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"pkgconf","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"pkgconf","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"pkgconf","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"pkgconf","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"pkgconf","fixed_in":["1.8.0-3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"pkgconf","fixed_in":["1.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pkgconf","fixed_in":["1.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pkgconf","fixed_in":["1.8.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"pkgconf","fixed_in":["1.7.3-2.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"pkgconf","fixed_in":["1.7.3-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"pkgconf","fixed_in":["1.7.3-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"pkgconf","fixed_in":["1.8.0-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"pkgconf","fixed_in":["1.8.0-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"pkgconf","fixed_in":["1.8.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"pkgconf","fixed_in":["1.5.3-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"pkgconf","fixed_in":["1.5.3-bp153.2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-2.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.12-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.12-6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.3-4","1.6.3-5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.4~git20210206+dcf529b-3","1.8.0-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"pkgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-bp153.2.3.1"}]}]}],"products":[{"vendor":"pkgconf","product":"pkgconf"}],"references":[{"url":"https://nullprogram.com/blog/2023/01/18/","tags":["x_transferred","Exploit","Third Party Advisory","article","report"]},{"url":"https://gitea.treehouse.systems/ariadne/pkgconf/commit/628b2b2bafa5d3a2017193ddf375093e70666059","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://github.com/pkgconf/pkgconf/tags","tags":["x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24056","tags":["web","advisory"]},{"url":"https://nullprogram.com/blog/2023/01/18"},{"url":"https://github.com/advisories/GHSA-6rfm-3v66-6wr2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-24056","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-24056","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24056.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-24056","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0077.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31536","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZWDULBZHRPQHGUXNQ3HNNHRJ3YXPJ7QH/","tags":["web","advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1046","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230611-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1207394","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24056","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-24056","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24056","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-24056","description":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.","status":"published","published":"2023-01-22T00:00:00Z","modified":"2025-04-02T15:45:00.912Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:35:27.006218Z"}],"euvd":[{"id":"EUVD-2023-28120","description":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.","status":"published","published":"2023-01-22T00:00:00Z","modified":"2025-04-02T15:45:00Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:44.834568Z"}],"ghsa":[{"id":"GHSA-6rfm-3v66-6wr2","title":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to...","description":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.","status":"published","published":"2023-01-22T06:30:27Z","modified":"2025-04-02T18:31:45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:00:36.145205Z"}],"nvd":[{"id":"CVE-2023-24056","description":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.","status":"published","published":"2023-01-22T04:15:11.617Z","modified":"2026-06-17T05:38:34.31Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:46.064662Z"}],"osv":[{"id":"ALPINE-CVE-2023-24056","description":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.","status":"published","published":"2023-01-22T04:15:11.617Z","modified":"2026-10-26T17:17:58.611584258Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:49.202584Z"},{"id":"AZL-13124","title":"CVE-2023-24056 affecting package pkgconf for versions less than 1.8.0-3","description":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.","status":"published","published":"2023-01-22T04:15:11Z","modified":"2026-04-21T04:22:39.846341Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"BELL-CVE-2023-24056","title":"CVE-2023-24056 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:41.106387Z","modified":"2026-01-26T09:49:45.217786Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-24056","description":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.","status":"published","published":"2023-01-22T00:00:00Z","modified":"2026-10-28T02:31:02.003253343Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"DEBIAN-CVE-2023-24056","description":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.","status":"published","published":"2023-01-22T04:15:11.617Z","modified":"2026-10-26T18:01:36.485346077Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"OESA-2023-1046","title":"pkgconf security update","description":"pkgconf is a program which helps to configure compiler and linker flags for development frameworks. It is similar to pkg-config from freedesktop.org, providing additional functionality while also maintaining compatibility.\r\n\r\nSecurity Fix(es):\r\n\r\nIn pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.(CVE-2023-24056)","status":"published","published":"2023-02-03T11:05:31Z","modified":"2026-08-18T01:17:29.026264107Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2023-24056","description":"In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.","status":"published","published":"2023-01-22T04:15:00Z","modified":"2026-04-22T14:03:04.753685Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"MGASA-2023-0077","title":"Updated pkgconf packages fix security vulnerability","description":"In pkgconf through 1.9.3, variable duplication can cause unbounded string\nexpansion due to incorrect checks in\nlibpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing\na few hundred bytes can expand to one billion bytes. (CVE-2023-24056)\n","status":"published","published":"2023-03-01T21:14:31Z","modified":"2026-04-16T04:41:47.222925215Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2023:0043-1","title":"Security update for pkgconf","description":"This update for pkgconf fixes the following issues:\n\n- CVE-2023-24056: FIxed variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c (boo#1207394).\n","status":"published","published":"2023-02-09T19:01:15Z","modified":"2026-02-04T02:49:21.550079Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12653-1","title":"libpkgconf-devel-1.8.0-2.1 on GA media","description":"These are all security issues fixed in the libpkgconf-devel-1.8.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:04:51.900985Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2023:0611-1","title":"Security update for pkgconf","description":"This update for pkgconf fixes the following issues:\n\n- CVE-2023-24056: Fixed unbounded string expansion due to incorrect checks in libpkgconf/tuple.c (bsc#1207394).\n","status":"published","published":"2023-03-03T11:07:24Z","modified":"2026-02-04T04:37:28.143988Z","updated_at":"2026-11-02T15:53:51.853735Z"}]}}