CVE Vulnerability

CVE-2023-0341

A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.

7.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529e Patch Third Party Advisory
https://litios.github.io/2023/01/14/CVE-2023-0341.html Exploit Patch
https://ubuntu.com/security/notices/USN-5842-1
Configurations

Configuration 1

cpe:2.3:a:editorconfig:editorconfig:*:*:*:*:*:*:*:*
Information

Published : 2023-02-01 12:15

Updated : 2023-02-09 10:15

NVD link : CVE-2023-0341

Mitre link : CVE-2023-0341

Products Affected

Editorconfig

CWE
CWE-787