CVE-2023-29581
published 2023-04-12CVE-2023-29581: yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at modules/preprocs/nasm/nasm-pp.c. NOTE: although a libyasm application could…
PriorityP420medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.34%
26.0th percentile
yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at modules/preprocs/nasm/nasm-pp.c. NOTE: although a libyasm application could become unavailable if this were exploited, the vendor's position is that there is no security relevance because there is either supposed to be input validation before data reaches libyasm, or a sandbox in which the application runs.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | yasm | — | — |
| yasm_project | yasm | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fcm2-5r3h-4j86: yasm 1
ghsa_unreviewed·2023-04-12
CVE-2023-29581 [MEDIUM] GHSA-fcm2-5r3h-4j86: yasm 1
yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function delete_Token at /nasm/nasm-pp.c.
OSV
CVE-2023-29581: ** DISPUTED ** yasm 1
osv·2023-04-12·CVSS 5.5
CVE-2023-29581 [MEDIUM] CVE-2023-29581: ** DISPUTED ** yasm 1
** DISPUTED ** yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at modules/preprocs/nasm/nasm-pp.c. NOTE: although a libyasm application could become unavailable if this were exploited, the vendor's position is that there is no security relevance because there is either supposed to be input validation before data reaches libyasm, or a sandbox in which the application runs.
OSV
CVE-2023-29581: yasm 1
osv·2023-04-12·CVSS 5.5
CVE-2023-29581 [MEDIUM] CVE-2023-29581: yasm 1
yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at modules/preprocs/nasm/nasm-pp.c. NOTE: although a libyasm application could become unavailable if this were exploited, the vendor's position is that there is no security relevance because there is either supposed to be input validation before data reaches libyasm, or a sandbox in which the application runs.
Debian
CVE-2023-29581: yasm - yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token a...
vendor_debian·2023·CVSS 5.5
CVE-2023-29581 [MEDIUM] CVE-2023-29581: yasm - yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token a...
yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at modules/preprocs/nasm/nasm-pp.c. NOTE: although a libyasm application could become unavailable if this were exploited, the vendor's position is that there is no security relevance because there is either supposed to be input validation before data reaches libyasm, or a sandbox in which the application runs.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=2186333https://github.com/yasm/yasm/blob/master/SECURITY.mdhttps://github.com/yasm/yasm/issues/216https://github.com/z1r00/fuzz_vuln/blob/main/yasm/segv/delete_Token/readme.mdhttps://bugzilla.redhat.com/show_bug.cgi?id=2186333https://github.com/yasm/yasm/blob/master/SECURITY.mdhttps://github.com/yasm/yasm/issues/216https://github.com/z1r00/fuzz_vuln/blob/main/yasm/segv/delete_Token/readme.md
2023-04-12
Published