{"id":"CVE-2023-30079","aliases":["EUVD-2023-34512","GHSA-hx8x-9x2v-x26h","RHSA-2023:4347","RHSA-2023:5458","RLSA-2023:4347","SUSE-SU-2023:3639-1","SUSE-SU-2023:3954-1","SUSE-SU-2023:3954-2","SUSE-SU-2024:2426-1","UBUNTU-CVE-2023-30079","openSUSE-SU-2024:13221-1"],"status":"rejected","title":"A stack overflow vulnerability exists in function read_file in atlibeconf/lib/getfilecontents.c...","description":"DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-22652. Reason: This record is a duplicate of CVE-2023-22652. Notes: All CVE users should reference CVE-2023-22652 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2023-08-22T19:16:00Z","modified":"2026-02-05T12:00:00Z","fixes":[{"ecosystem":"Red Hat:rhel_eus:9.0::baseos","package":"libeconf","fixed_in":["0:0.4.1-3.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::baseos","package":"libeconf-debuginfo","fixed_in":["0:0.4.1-3.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::baseos","package":"libeconf-debugsource","fixed_in":["0:0.4.1-3.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::baseos","package":"libeconf-utils-debuginfo","fixed_in":["0:0.4.1-3.el9_0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-3.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libeconf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-3.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libeconf-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-3.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libeconf-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-3.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::baseos","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-3.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::baseos","package":"libeconf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-3.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::baseos","package":"libeconf-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-3.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::baseos","package":"libeconf-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-3.el9_0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-3.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150300.3.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150300.3.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150300.3.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150300.3.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-2.1"}]}],"bundled":2}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30079","tags":["advisory"]},{"url":"https://github.com/openSUSE/libeconf/issues/177","tags":["report"]},{"url":"https://github.com/yangjiageng/PoC/blob/master/libeconf-PoC/read_file_503","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SDD5GL5T3V5XZ3VFA4HPE6YGJ2K4HHPC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMG5256D5I3GFA3RBAJQ2WYPJDYAIL74"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAYW7X753Z6GOJKVLQPXBDHISN6ZT233"},{"url":"https://raw.githubusercontent.com/yangjiageng/PoC/master/libeconf-PoC/tst-logindefs1.c","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMG5256D5I3GFA3RBAJQ2WYPJDYAIL74/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SDD5GL5T3V5XZ3VFA4HPE6YGJ2K4HHPC/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAYW7X753Z6GOJKVLQPXBDHISN6ZT233/"},{"url":"https://github.com/advisories/GHSA-hx8x-9x2v-x26h"},{"url":"https://access.redhat.com/errata/RHSA-2023:4347","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212463","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4347.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-22652","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-22652","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22652","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-30079","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2234595","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-30079","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5458","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5458.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:4347","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233639-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198165","tags":["report"]},{"url":"https://bugzilla.suse.com/1211078","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-30078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-30079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32181","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233954-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233954-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242426-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-30079","tags":["report"]},{"url":"https://github.com/openSUSE/libeconf/commit/8d086dfc69d4299e55e4844e3573b3a4cf420f19","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-30079","description":"DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-22652. Reason: This record is a duplicate of CVE-2023-22652. Notes: All CVE users should reference CVE-2023-22652 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.","status":"rejected","modified":"2023-11-06T15:13:47.482Z","updated_at":"2026-11-02T14:35:22.309324Z"}],"euvd":[{"id":"EUVD-2023-34512","description":"A stack overflow vulnerability exists in function read_file in atlibeconf/lib/getfilecontents.c in libeconf 0.5.1 allows attackers to cause a Denial of service or execute arbitrary code.","status":"published","published":"2023-08-22T21:30:27Z","modified":"2023-08-26T03:30:32Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:56.082226Z"}],"ghsa":[{"id":"GHSA-hx8x-9x2v-x26h","title":"A stack overflow vulnerability exists in function read_file in atlibeconf/lib/getfilecontents.c...","description":"A stack overflow vulnerability exists in function read_file in atlibeconf/lib/getfilecontents.c in libeconf 0.5.1 allows attackers to cause a Denial of service or execute arbitrary code.","status":"published","published":"2023-08-22T21:30:27Z","modified":"2023-11-06T18:30:17Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:54:52.133061Z"}],"nvd":[{"id":"CVE-2023-30079","description":"Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-22652. Reason: This record is a duplicate of CVE-2023-22652. Notes: All CVE users should reference CVE-2023-22652 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.","status":"rejected","published":"2023-08-22T19:16:36.19Z","modified":"2023-11-07T04:13:39.547Z","updated_at":"2026-11-02T14:08:25.025396Z"}],"osv":[{"id":"RHSA-2023:4347","title":"Red Hat Security Advisory: libeconf security update","status":"published","published":"2024-09-16T12:12:51Z","modified":"2025-11-22T12:53:44Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:5458","title":"Red Hat Security Advisory: libeconf security update","status":"published","published":"2024-09-16T12:13:00Z","modified":"2025-11-22T12:56:26Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RLSA-2023:4347","title":"Moderate: libeconf security update","description":"Libeconf is a highly flexible and configurable library to parse and manage key=value configuration files. It reads configuration file snippets from different directories and builds the final configuration file from it.\n\nSecurity Fix(es):\n\n* libeconf: stack-based buffer overflow in read_file() in lib/getfilecontents.c (CVE-2023-22652)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-10-06T23:10:28.251866Z","modified":"2026-02-05T12:00:00.778031Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2023-30079","description":"** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-22652. Reason: This record is a duplicate of CVE-2023-22652. Notes: All CVE users should reference CVE-2023-22652 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.","status":"withdrawn","published":"2023-08-22T19:16:00Z","modified":"2025-07-08T14:59:42.443979Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"openSUSE-SU-2024:13221-1","title":"libeconf-devel-0.5.2-2.1 on GA media","description":"These are all security issues fixed in the libeconf-devel-0.5.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:28:43.220035Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:3639-1","title":"Security update for libeconf","description":"This update for libeconf fixes the following issues:\n\nUpdate to version 0.5.2.\n\n- CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in 'econf_writeFile' function (bsc#1211078).\n- CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in 'read_file' function. (bsc#1211078)\n\nThe following non-security bug was fixed:\n\n- Fixed parsing files correctly which have space characters AND none space characters as delimiters (bsc#1198165).\n","status":"published","published":"2023-09-18T11:33:33Z","modified":"2026-02-04T03:44:19.245379Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3954-1","title":"Security update for libeconf","description":"This update for libeconf fixes the following issues:\n\nUpdate to version 0.5.2.\n\n- CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in 'econf_writeFile' function (bsc#1211078).\n- CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in 'read_file' function. (bsc#1211078)\n","status":"published","published":"2023-10-03T18:10:09Z","modified":"2026-02-04T03:24:06.180702Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3954-2","title":"Security update for libeconf","description":"This update for libeconf fixes the following issues:\n\nUpdate to version 0.5.2.\n\n- CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in 'econf_writeFile' function (bsc#1211078).\n- CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in 'read_file' function. (bsc#1211078)\n","status":"published","published":"2023-10-18T19:05:55Z","modified":"2026-02-04T02:48:04.284511Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2024:2426-1","title":"Security update for libeconf","description":"This update for libeconf fixes the following issues:\n\nUpdate to version 0.5.2.\n\n- CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in 'econf_writeFile' function (bsc#1211078).\n- CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in 'read_file' function. (bsc#1211078)\n","status":"published","published":"2024-07-12T13:00:51Z","modified":"2026-02-04T02:34:52.442653Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}