cbcvebase.
CVE-2023-39947
published 2023-08-11

CVE-2023-39947: eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2…

high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, even after the fix at commit 3492270, malformed `PID_PROPERTY_LIST` parameters cause heap overflow at a different program counter. This can remotely crash any Fast-DDS process. Versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6 contain a patch for this issue.

Affected

11 ranges
VendorProductVersion rangeFixed in
debiandebian_linux——
debiandebian_linux——
debianfastdds< fastdds 2.9.1+ds-1+deb12u1 (bookworm)fastdds 2.9.1+ds-1+deb12u1 (bookworm)
eprosimafast-dds< 2.6.62.6.6
eprosimafast-dds——
eprosimafast-dds——
eprosimafast-dds——
eprosimafast_dds——
eprosimafast_dds>= 2.10.0 < 2.10.22.10.2
eprosimafast_dds>= 2.6.0 < 2.6.62.6.6
eprosimafast_dds>= 2.9.0 < 2.9.22.9.2

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv9.1CRITICAL