« List of all CVEs

CVE-2023-6246

Glibc: heap-based buffer overflow in __vsyslog_internal()

Published: 1/31/2024 Last updated: 7/14/2026 Reserved: 11/21/2023

A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.

CNA assigner: redhat (53f830b8-0a3f-465b-8143-3b8a9948e749) Requested by: n/a

Metrics

Version Score Severity Vector String
3.1 8.4 High CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Opam packages affected (1)

gettext-stub

Products affected (15)

Product Vendor Version
Red Hat Enterprise Linux 7 Red Hat n/a
Red Hat Enterprise Linux 7 Red Hat < publication
Red Hat Enterprise Linux 6 Red Hat < publication
Red Hat Enterprise Linux 6 Red Hat < 4.0.12.0
Red Hat Enterprise Linux 9 Red Hat 8.5.4
Fedora Fedora n/a
Red Hat Enterprise Linux 6 Red Hat < publication
Fedora Fedora >=0.99.0, < 1.25.0
Red Hat Enterprise Linux 6 Red Hat < 4.0.12.0
Red Hat Enterprise Linux 7 Red Hat n/a
Red Hat Enterprise Linux 8 Red Hat from 1.0.0 to 1.2.0
Red Hat Enterprise Linux 7 Red Hat 10.2.300 and earlier
Red Hat Enterprise Linux 9 Red Hat All versions < V13.1.1.0
glibc n/a < SMR Dec-2021 Release 1
glibc n/a Fixed in 2.2.10.Final, 2.0.40.Final

References (50)

Credits (2)