{"id":"CVE-2023-36660","aliases":["BELL-CVE-2023-36660","EUVD-2023-40604","GHSA-whjr-4v2f-wjp4","openSUSE-SU-2024:13024-1"],"status":"published","title":"The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.","description":"The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01032,"percentile":0.63981,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2023-06-25T00:00:00Z","modified":"2026-10-28T02:30:42Z","products":[{"vendor":"nettle_project","product":"nettle"},{"vendor":"siemens","product":"simatic s7-1500 tm mfp - gnu/linux subsystem"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1212112","tags":["x_transferred","Issue Tracking","Patch","report"]},{"url":"https://git.lysator.liu.se/nettle/nettle/-/commit/867a4548b95705291a3afdd66d76e7f17ba2618f","tags":["x_transferred","Patch","web"]},{"url":"https://git.lysator.liu.se/nettle/nettle/-/compare/nettle_3.9_release_20230514...nettle_3.9.1_release_20230601","tags":["x_transferred","Patch","web"]},{"url":"https://security.gentoo.org/glsa/202401-24","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-794697.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36660","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-whjr-4v2f-wjp4"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-36660","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36660.json","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-36660","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-36660","description":"The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.","status":"published","published":"2023-06-25T00:00:00Z","modified":"2026-10-14T23:34:57.353Z","updated_at":"2026-11-02T14:35:28.218693Z"}],"euvd":[{"id":"EUVD-2023-40604","description":"The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.","status":"published","published":"2023-06-25T00:00:00Z","modified":"2026-10-14T23:34:57Z","updated_at":"2026-11-02T17:27:11.209168Z"}],"ghsa":[{"id":"GHSA-whjr-4v2f-wjp4","title":"The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.","description":"The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.","status":"published","published":"2023-06-26T00:30:21Z","modified":"2026-10-15T00:30:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:13:29.914076Z"}],"nvd":[{"id":"CVE-2023-36660","description":"The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.","status":"published","published":"2023-06-25T22:15:21.337Z","modified":"2026-10-15T00:16:34.27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:08:12.414559Z"}],"osv":[{"id":"BELL-CVE-2023-36660","title":"CVE-2023-36660 does not affect BellSoft software","status":"withdrawn","published":"2023-10-18T13:45:30.685441Z","modified":"2026-01-26T09:46:06.990843Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-36660","description":"The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.","status":"published","published":"2023-06-25T00:00:00Z","modified":"2026-10-28T02:30:42.798157118Z","updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"openSUSE-SU-2024:13024-1","title":"libhogweed6-3.9.1-2.1 on GA media","description":"These are all security issues fixed in the libhogweed6-3.9.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:29:49.445746Z","updated_at":"2026-11-02T16:58:36.025801Z"}]}}