{"id":"CVE-2023-32181","aliases":["BELL-CVE-2023-32181","DEBIAN-CVE-2023-32181","EUVD-2023-36449","GHSA-wjxc-pgfj-hwrc","SUSE-SU-2023:3639-1","SUSE-SU-2023:3954-1","SUSE-SU-2023:3954-2","SUSE-SU-2024:2426-1","UBUNTU-CVE-2023-32181"],"status":"published","title":"Stack buffer overflow in \"econf_writeFile\" function","description":"A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files\nThis issue affects libeconf: before 0.5.2.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00568,"percentile":0.47346,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2023-06-01T11:46:03Z","modified":"2026-10-28T02:31:02Z","fixes":[{"ecosystem":"Alpaquita:23","package":"libeconf","fixed_in":["0.4.7-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libeconf","fixed_in":["0.5.2-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libeconf","fixed_in":["0.5.1+dfsg1-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libeconf","fixed_in":["0.5.2+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libeconf","fixed_in":["0.5.2+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.7-r0"},{"fixed":"0.4.7-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.7-r0"},{"fixed":"0.5.2-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.1+dfsg1-1+deb12u1"}]}],"versions":["0.5.1+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2+dfsg1-1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150300.3.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150300.3.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150300.3.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150300.3.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.8-1","0.3.8-1+deb11u1build0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.2+dfsg1-1","0.6.0+dfsg1-1","0.6.1+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.7+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.7+dfsg1-1build1","0.8.3+dfsg1-1","0.8.4+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libeconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.7+dfsg1-1","0.7.7+dfsg1-1build1"]}],"products":[{"vendor":"opensuse","product":"libeconf"}],"references":[{"url":"https://https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32181","tags":["x_transferred","Broken Link","Issue Tracking","Vendor Advisory","report"]},{"url":"https://https://github.com/openSUSE/libeconf/issues/178","tags":["x_transferred","Broken Link","Issue Tracking","Vendor Advisory","web","report"]},{"url":"https://github.com/openSUSE/libeconf/issues/178","tags":["exploit","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32181","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wjxc-pgfj-hwrc"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-32181","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32181.json","tags":["advisory"]},{"url":"https://github.com/openSUSE/libeconf","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-32181","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233639-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198165","tags":["report"]},{"url":"https://bugzilla.suse.com/1211078","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-30078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-30079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32181","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233954-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233954-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242426-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-32181","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32181","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-32181","title":"Stack buffer overflow in \"econf_writeFile\" function","description":"A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files\nThis issue affects libeconf: before 0.5.2.\n\n","status":"published","published":"2023-06-01T11:46:03.028Z","modified":"2025-01-10T18:39:46.673Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:35:29.01154Z"}],"euvd":[{"id":"EUVD-2023-36449","description":"A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files\nThis issue affects libeconf: before 0.5.2.\n\n","status":"published","published":"2023-06-01T11:46:03Z","modified":"2025-01-10T18:39:46Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T00:04:21.239531Z"}],"ghsa":[{"id":"GHSA-wjxc-pgfj-hwrc","title":"A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in...","description":"A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files\nThis issue affects libeconf: before 0.5.2.\n\n","status":"published","published":"2023-06-01T12:30:14Z","modified":"2025-01-10T21:32:29Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:59:27.888313Z"}],"nvd":[{"id":"CVE-2023-32181","description":"A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files\nThis issue affects libeconf: before 0.5.2.\n\n","status":"published","published":"2023-06-01T12:15:09.727Z","modified":"2026-06-17T05:58:15.87Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:08:03.795015Z"}],"osv":[{"id":"BELL-CVE-2023-32181","status":"published","published":"2023-10-18T13:45:42.73478Z","modified":"2026-03-05T07:15:28.182488Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-32181","title":"Stack buffer overflow in \"econf_writeFile\" function","description":"A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files\nThis issue affects libeconf: before 0.5.2.\n\n","status":"published","published":"2023-06-01T11:46:03.028Z","modified":"2026-10-28T02:31:02.469605098Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"DEBIAN-CVE-2023-32181","description":"A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files This issue affects libeconf: before 0.5.2.","status":"published","published":"2023-06-01T12:15:09.727Z","modified":"2026-10-26T18:02:26.105008418Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"UBUNTU-CVE-2023-32181","description":"A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files This issue affects libeconf: before 0.5.2.","status":"published","published":"2023-06-01T12:15:00Z","modified":"2026-10-17T12:57:18.755660583Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"SUSE-SU-2023:3639-1","title":"Security update for libeconf","description":"This update for libeconf fixes the following issues:\n\nUpdate to version 0.5.2.\n\n- CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in 'econf_writeFile' function (bsc#1211078).\n- CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in 'read_file' function. (bsc#1211078)\n\nThe following non-security bug was fixed:\n\n- Fixed parsing files correctly which have space characters AND none space characters as delimiters (bsc#1198165).\n","status":"published","published":"2023-09-18T11:33:33Z","modified":"2026-02-04T03:44:19.245379Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3954-1","title":"Security update for libeconf","description":"This update for libeconf fixes the following issues:\n\nUpdate to version 0.5.2.\n\n- CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in 'econf_writeFile' function (bsc#1211078).\n- CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in 'read_file' function. (bsc#1211078)\n","status":"published","published":"2023-10-03T18:10:09Z","modified":"2026-02-04T03:24:06.180702Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3954-2","title":"Security update for libeconf","description":"This update for libeconf fixes the following issues:\n\nUpdate to version 0.5.2.\n\n- CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in 'econf_writeFile' function (bsc#1211078).\n- CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in 'read_file' function. (bsc#1211078)\n","status":"published","published":"2023-10-18T19:05:55Z","modified":"2026-02-04T02:48:04.284511Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2024:2426-1","title":"Security update for libeconf","description":"This update for libeconf fixes the following issues:\n\nUpdate to version 0.5.2.\n\n- CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in 'econf_writeFile' function (bsc#1211078).\n- CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in 'read_file' function. (bsc#1211078)\n","status":"published","published":"2024-07-12T13:00:51Z","modified":"2026-02-04T02:34:52.442653Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}