CVE-2023-0341 - Vulnerability Details - OpenCVE

A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Vendors	Products
Editorconfig	Editorconfig

Configuration 1 [-]

cpe:2.3:a:editorconfig:editorconfig:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529e
https://lists.fedoraproject.org/archives/list/[email protected]/message/ZCFE7DXWAAKDJPRKMXHCACKGKNV37IYZ/
https://litios.github.io/2023/01/14/CVE-2023-0341.html
https://ubuntu.com/security/notices/USN-5842-1

History

Thu, 27 Mar 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: canonical

Published: 2023-01-31T23:22:53.634Z

Updated: 2025-03-27T14:30:42.646Z

Reserved: 2023-01-17T16:04:01.890Z

Link: CVE-2023-0341

Vulnrichment

Updated: 2024-08-02T05:10:55.122Z

NVD

Status : Modified

Published: 2023-02-01T00:15:10.343

Modified: 2024-11-21T07:37:00.380

Link: CVE-2023-0341

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-0341", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2023-01-17T16:04:01.890Z", "datePublished": "2023-01-31T23:22:53.634Z", "dateUpdated": "2025-03-27T14:30:42.646Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://github.com/editorconfig/editorconfig-core-c/releases", "modules": ["configuration file parsing"], "packageName": "editorconfig-core-c", "platforms": ["Linux", "MacOS", "Windows"], "product": "EditorConfig C Core", "repo": "https://github.com/editorconfig/editorconfig-core-c/", "vendor": "EditorConfig", "versions": [{"lessThan": "v0.12.6", "status": "affected", "version": "0", "versionType": "commit"}]}], "credits": [{"lang": "en", "type": "analyst", "value": "David Fernandez Gonzalez"}, {"lang": "en", "type": "finder", "value": "Mark Esler"}], "datePublic": "2023-01-19T08:21:49.000Z", "descriptions": [{"lang": "en", "value": "A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer."}], "impacts": [{"capecId": "CAPEC-8", "descriptions": [{"lang": "en", "value": "CAPEC-8"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2023-06-03T04:06:30.411Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529e"}, {"tags": ["technical-description"], "url": "https://litios.github.io/2023/01/14/CVE-2023-0341.html"}, {"tags": ["third-party-advisory"], "url": "https://ubuntu.com/security/notices/USN-5842-1"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/ZCFE7DXWAAKDJPRKMXHCACKGKNV37IYZ/"}], "title": "Stack Buffer Overflow in editorconfig-core-c"}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:10:55.122Z"}, "title": "CVE Program Container", "references": [{"tags": ["patch", "x_transferred"], "url": "https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529e"}, {"tags": ["technical-description", "x_transferred"], "url": "https://litios.github.io/2023/01/14/CVE-2023-0341.html"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://ubuntu.com/security/notices/USN-5842-1"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/ZCFE7DXWAAKDJPRKMXHCACKGKNV37IYZ/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-27T14:28:20.466703Z", "id": "CVE-2023-0341", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-27T14:30:42.646Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-0341", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2023-01-17T16:04:01.890Z", "datePublished": "2023-01-31T23:22:53.634Z", "dateUpdated": "2025-03-27T14:30:42.646Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://github.com/editorconfig/editorconfig-core-c/releases", "modules": ["configuration file parsing"], "packageName": "editorconfig-core-c", "platforms": ["Linux", "MacOS", "Windows"], "product": "EditorConfig C Core", "repo": "https://github.com/editorconfig/editorconfig-core-c/", "vendor": "EditorConfig", "versions": [{"lessThan": "v0.12.6", "status": "affected", "version": "0", "versionType": "commit"}]}], "credits": [{"lang": "en", "type": "analyst", "value": "David Fernandez Gonzalez"}, {"lang": "en", "type": "finder", "value": "Mark Esler"}], "datePublic": "2023-01-19T08:21:49.000Z", "descriptions": [{"lang": "en", "value": "A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer."}], "impacts": [{"capecId": "CAPEC-8", "descriptions": [{"lang": "en", "value": "CAPEC-8"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2023-06-03T04:06:30.411Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529e"}, {"tags": ["technical-description"], "url": "https://litios.github.io/2023/01/14/CVE-2023-0341.html"}, {"tags": ["third-party-advisory"], "url": "https://ubuntu.com/security/notices/USN-5842-1"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/ZCFE7DXWAAKDJPRKMXHCACKGKNV37IYZ/"}], "title": "Stack Buffer Overflow in editorconfig-core-c"}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:10:55.122Z"}, "title": "CVE Program Container", "references": [{"tags": ["patch", "x_transferred"], "url": "https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529e"}, {"tags": ["technical-description", "x_transferred"], "url": "https://litios.github.io/2023/01/14/CVE-2023-0341.html"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://ubuntu.com/security/notices/USN-5842-1"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/ZCFE7DXWAAKDJPRKMXHCACKGKNV37IYZ/", "tags": ["x_transferred"]}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-0341", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-27T14:28:20.466703Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-27T14:24:03.750Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:editorconfig:editorconfig:*:*:*:*:*:*:*:*", "matchCriteriaId": "063ADAC0-7C09-4775-87F0-A2FE98E99FC7", "versionEndExcluding": "0.12.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer."}], "id": "CVE-2023-0341", "lastModified": "2024-11-21T07:37:00.380", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-02-01T00:15:10.343", "references": [{"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529e"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/ZCFE7DXWAAKDJPRKMXHCACKGKNV37IYZ/"}, {"source": "[email protected]", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://litios.github.io/2023/01/14/CVE-2023-0341.html"}, {"source": "[email protected]", "url": "https://ubuntu.com/security/notices/USN-5842-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/ZCFE7DXWAAKDJPRKMXHCACKGKNV37IYZ/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://litios.github.io/2023/01/14/CVE-2023-0341.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://ubuntu.com/security/notices/USN-5842-1"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "[email protected]", "type": "Primary"}]}