CVE-2023-29579 — Out-of-bounds Write in Yasm

CWE-787 — Out-of-bounds Write5 documents4 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 89.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Yasm Project YasmDebian Yasm
Timeline
PublishedApr 24

Description

yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the component yasm/yasm+0x43b466 in vsprintf. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/yasm< yasm 1.3.0-7 (forky)
▶Debianyasm_project/yasm< 1.3.0-7+1
▶NVDyasm_project/yasm1.3.0.55.g101bc

🔴Vulnerability Details

3
OSV
CVE-2023-29579: yasm 1↗2023-04-24
▶
GHSA
GHSA-9rj4-9hjf-7pcg: yasm 1↗2023-04-24
▶
OSV
CVE-2023-29579: ** DISPUTED ** yasm 1↗2023-04-24
▶

📋Vendor Advisories

1
Debian
CVE-2023-29579: yasm - yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the componen...↗2023
▶
CVE-2023-29579 — Out-of-bounds Write in Debian Yasm | cvebase