CVE-2023-5156

Published: Sep 25, 2023Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.

Affected (3)

Products: Gnu: Glibc · Redhat: Enterprise Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Glibc	From 2.34 to 2.39

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0

Related CWEs

CWE-401

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (13)

https://access.redhat.com/security/cve/CVE-2023-5156

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2240541

Source: secalert@redhat.com

Issue TrackingPatch

https://sourceware.org/bugzilla/show_bug.cgi?id=30884

Source: secalert@redhat.com

Issue TrackingPatch

https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=ec6b95c3303c700eb89eebeda2d7264cc184a796

Source: secalert@redhat.com

Mailing ListPatch

http://www.openwall.com/lists/oss-security/2023/10/03/4