{"id":"CVE-2023-49287","aliases":["DEBIAN-CVE-2023-49287","EUVD-2023-53280","GHSA-jf5r-wgf4-qhxf","UBUNTU-CVE-2023-49287"],"status":"published","title":"Buffer overflow vulnerabilities in tinydir","description":"TinyDir is a lightweight C directory and file reader. Buffer overflows in the `tinydir_file_open()` function. This vulnerability has been patched in version 1.2.6.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01869,"percentile":0.79514,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-121"],"published":"2023-12-04T05:29:10Z","modified":"2026-10-28T10:36:07Z","fixes":[{"ecosystem":"Debian:13","package":"falcosecurity-libs","fixed_in":["0.14.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"falcosecurity-libs","fixed_in":["0.14.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gemmi","fixed_in":["0.6.4+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gemmi","fixed_in":["0.6.4+ds-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"falcosecurity-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.1dev+git20220316.e5c53d64-5.1","0.11.3+repack-1","0.11.3+repack-2","0.11.3+repack-3","0.11.3+repack-4","0.11.3+repack-5","0.11.3+repack-6","0.14.1-1","0.14.1-2","0.14.1-3","0.14.1-3.1~exp1","0.14.1-4","0.14.1-5","0.14.1-5.1","0.15.1-1","0.15.1-2","0.15.1-3","0.15.1-4","0.18.1-1","0.18.1-2","0.20.0-1","0.20.0-2","0.20.0-3","0.20.0-4","0.20.0-4.1","0.23.2-1","0.23.2-2","0.23.2-3","0.23.2-4","0.23.2-5","0.23.2-6","0.23.2-6~exp1"]},{"source":"osv","ecosystem":"Debian:13","package":"falcosecurity-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"falcosecurity-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gemmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.7+ds-2","0.5.8+ds-1","0.6.0+ds-1","0.6.1+ds-1","0.6.2+ds-1","0.6.2+ds-2","0.6.2+ds-3","0.6.2+ds-4","0.6.2+ds-5","0.6.3+ds-1","0.6.4+ds-1","0.6.5+ds-1","0.6.5+ds-2","0.6.5+ds-3","0.7.1+ds-1","0.7.1+ds-1~exp1","0.7.1+ds-2","0.7.4+ds-1","0.7.4+ds-1~exp1","0.7.5+ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"gemmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gemmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4+ds-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gemmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.9+ds-1","0.5.0+ds-1","0.5.1+ds-1","0.5.2+ds-1","0.5.2+ds-1ubuntu1","0.5.2+ds-2ubuntu1","0.5.2+ds-2ubuntu3","0.5.3+ds-1ubuntu1","0.5.3+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"falcosecurity-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.3+repack-6ubuntu1","0.11.3+repack-6ubuntu2","0.14.1-1ubuntu2","0.14.1-2ubuntu2","0.14.1-2ubuntu3","0.14.1-3ubuntu1","0.14.1-5ubuntu1","0.14.1-5.1ubuntu3","0.14.1-5.1ubuntu4","0.15.1-1ubuntu3","0.15.1-2ubuntu1","0.15.1-2ubuntu1.1","0.15.1-2ubuntu1.2","0.15.1-2ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gemmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.2+ds-5","0.6.3+ds-1","0.6.4+ds-1","0.6.4+ds-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"falcosecurity-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20.0-1ubuntu2","0.20.0-3","0.20.0-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gemmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.5+ds-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"falcosecurity-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20.0-4build1","0.20.0-4.1ubuntu1","0.23.2-2ubuntu1","0.23.2-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gemmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.4+ds-1build1","0.7.5+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"falcosecurity-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20.0-3","0.20.0-4","0.20.0-4build1","0.20.0-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gemmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.5+ds-3","0.7.1+ds-2","0.7.4+ds-1","0.7.4+ds-1build1"]}],"products":[{"vendor":"cxong","product":"tinydir"}],"references":[{"url":"https://github.com/cxong/tinydir/security/advisories/GHSA-jf5r-wgf4-qhxf","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/cxong/tinydir/releases/tag/1.2.6","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/04/1","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://packetstormsecurity.com/files/176060/TinyDir-1.2.5-Buffer-Overflow.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","web"]},{"url":"http://seclists.org/fulldisclosure/2023/Dec/14","tags":["x_transferred","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49287.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49287","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-49287","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-49287","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49287","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-49287","title":"Buffer overflow vulnerabilities in tinydir","description":"TinyDir is a lightweight C directory and file reader. Buffer overflows in the `tinydir_file_open()` function. This vulnerability has been patched in version 1.2.6.","status":"published","published":"2023-12-04T05:29:10.673Z","modified":"2025-05-29T13:54:57.52Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-120","CWE-121"],"updated_at":"2026-11-02T14:35:12.998024Z"}],"euvd":[{"id":"EUVD-2023-53280","description":"TinyDir is a lightweight C directory and file reader. Buffer overflows in the `tinydir_file_open()` function. This vulnerability has been patched in version 1.2.6.","status":"published","published":"2023-12-04T05:29:10Z","modified":"2025-05-29T13:54:57Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:35.823426Z"}],"nvd":[{"id":"CVE-2023-49287","description":"TinyDir is a lightweight C directory and file reader. Buffer overflows in the `tinydir_file_open()` function. This vulnerability has been patched in version 1.2.6.","status":"published","published":"2023-12-04T06:15:07.173Z","modified":"2026-06-17T06:35:46.363Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-120","CWE-121"],"updated_at":"2026-11-02T14:08:52.544469Z"}],"osv":[{"id":"CVE-2023-49287","title":"Buffer overflow vulnerabilities in tinydir","description":"TinyDir is a lightweight C directory and file reader. Buffer overflows in the `tinydir_file_open()` function. This vulnerability has been patched in version 1.2.6.","status":"published","published":"2023-12-04T05:29:10.673Z","modified":"2026-10-28T10:36:07.134204218Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-120","CWE-121"],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"DEBIAN-CVE-2023-49287","description":"TinyDir is a lightweight C directory and file reader. Buffer overflows in the `tinydir_file_open()` function. This vulnerability has been patched in version 1.2.6.","status":"published","published":"2023-12-04T06:15:07.173Z","modified":"2026-10-26T18:02:35.696938579Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"UBUNTU-CVE-2023-49287","description":"TinyDir is a lightweight C directory and file reader. Buffer overflows in the `tinydir_file_open()` function. This vulnerability has been patched in version 1.2.6.","status":"published","published":"2023-12-04T06:15:00Z","modified":"2026-10-17T12:56:26.222680936Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:23.935133Z"}]}}