{"id":"CVE-2023-30078","aliases":["EUVD-2023-34511","GHSA-j9r5-cg9x-96c5","SUSE-SU-2023:3639-1","SUSE-SU-2023:3954-1","SUSE-SU-2023:3954-2","SUSE-SU-2024:2426-1","UBUNTU-CVE-2023-30078","openSUSE-SU-2024:13221-1"],"status":"rejected","title":"A stack overflow vulnerability exists in function econf_writeFile in file atlibeconf/lib/libeconf...","description":"DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-32181. Reason: This record is a duplicate of CVE-2023-32181. Notes: All CVE users should reference CVE-2023-32181 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2023-08-22T19:16:00Z","modified":"2026-02-04T04:28:43Z","affected":[{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150300.3.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150300.3.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150300.3.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150300.3.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-2.1"}]}],"bundled":2}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30078"},{"url":"https://github.com/openSUSE/libeconf/issues/178","tags":["report"]},{"url":"https://github.com/yangjiageng/PoC/blob/master/libeconf-PoC/econf_writeFile_546","tags":["report"]},{"url":"https://raw.githubusercontent.com/yangjiageng/PoC/master/libeconf-PoC/tst-write-string-data.c","tags":["report"]},{"url":"https://github.com/advisories/GHSA-j9r5-cg9x-96c5"},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233639-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198165","tags":["report"]},{"url":"https://bugzilla.suse.com/1211078","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-30078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-30079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32181","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233954-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233954-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242426-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-30078","tags":["report"]},{"url":"https://github.com/openSUSE/libeconf/commit/8d086dfc69d4299e55e4844e3573b3a4cf420f19","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-30078","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-30078","description":"DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-32181. Reason: This record is a duplicate of CVE-2023-32181. Notes: All CVE users should reference CVE-2023-32181 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.","status":"rejected","modified":"2023-11-06T15:17:05.884Z","updated_at":"2026-11-02T14:35:22.309324Z"}],"euvd":[{"id":"EUVD-2023-34511","description":"A stack overflow vulnerability exists in function econf_writeFile in file atlibeconf/lib/libeconf.c in libeconf 0.5.1 allows attackers to cause a Denial of service or execute arbitrary code.","status":"published","published":"2023-08-22T21:30:27Z","modified":"2023-08-26T03:30:32Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:56.082226Z"}],"ghsa":[{"id":"GHSA-j9r5-cg9x-96c5","title":"A stack overflow vulnerability exists in function econf_writeFile in file atlibeconf/lib/libeconf...","description":"A stack overflow vulnerability exists in function econf_writeFile in file atlibeconf/lib/libeconf.c in libeconf 0.5.1 allows attackers to cause a Denial of service or execute arbitrary code.","status":"published","published":"2023-08-22T21:30:27Z","modified":"2023-11-06T18:30:17Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:54:52.133061Z"}],"nvd":[{"id":"CVE-2023-30078","description":"Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-32181. Reason: This record is a duplicate of CVE-2023-32181. Notes: All CVE users should reference CVE-2023-32181 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.","status":"rejected","published":"2023-08-22T19:16:36.097Z","modified":"2023-11-07T04:13:39.507Z","updated_at":"2026-11-02T14:08:25.025396Z"}],"osv":[{"id":"UBUNTU-CVE-2023-30078","description":"** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-32181. Reason: This record is a duplicate of CVE-2023-32181. Notes: All CVE users should reference CVE-2023-32181 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.","status":"withdrawn","published":"2023-08-22T19:16:00Z","modified":"2025-07-08T14:59:42.378416Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"openSUSE-SU-2024:13221-1","title":"libeconf-devel-0.5.2-2.1 on GA media","description":"These are all security issues fixed in the libeconf-devel-0.5.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:28:43.220035Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:3639-1","title":"Security update for libeconf","description":"This update for libeconf fixes the following issues:\n\nUpdate to version 0.5.2.\n\n- CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in 'econf_writeFile' function (bsc#1211078).\n- CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in 'read_file' function. (bsc#1211078)\n\nThe following non-security bug was fixed:\n\n- Fixed parsing files correctly which have space characters AND none space characters as delimiters (bsc#1198165).\n","status":"published","published":"2023-09-18T11:33:33Z","modified":"2026-02-04T03:44:19.245379Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3954-1","title":"Security update for libeconf","description":"This update for libeconf fixes the following issues:\n\nUpdate to version 0.5.2.\n\n- CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in 'econf_writeFile' function (bsc#1211078).\n- CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in 'read_file' function. (bsc#1211078)\n","status":"published","published":"2023-10-03T18:10:09Z","modified":"2026-02-04T03:24:06.180702Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3954-2","title":"Security update for libeconf","description":"This update for libeconf fixes the following issues:\n\nUpdate to version 0.5.2.\n\n- CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in 'econf_writeFile' function (bsc#1211078).\n- CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in 'read_file' function. (bsc#1211078)\n","status":"published","published":"2023-10-18T19:05:55Z","modified":"2026-02-04T02:48:04.284511Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2024:2426-1","title":"Security update for libeconf","description":"This update for libeconf fixes the following issues:\n\nUpdate to version 0.5.2.\n\n- CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in 'econf_writeFile' function (bsc#1211078).\n- CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in 'read_file' function. (bsc#1211078)\n","status":"published","published":"2024-07-12T13:00:51Z","modified":"2026-02-04T02:34:52.442653Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}