CVE-2023-52159
published 2024-03-18CVE-2023-52159: A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.05%
61.1th percentile
A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon crash) or potentially execute arbitrary code in grossd via crafted SMTP transaction parameters that cause an incorrect strncat for a log entry.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bizdelnick | gross | >= 0 < 1.0.2-4.1~deb11u1 | 1.0.2-4.1~deb11u1 |
| bizdelnick | gross | >= 0 < 1.0.2-4.1~deb12u1 | 1.0.2-4.1~deb12u1 |
| bizdelnick | gross | >= 0 < 1.0.2-4.1 | 1.0.2-4.1 |
| bizdelnick | gross | >= 0 < 1.0.2-4.1 | 1.0.2-4.1 |
| bizdelnick | gross | >= 0.9.3 < 1.0.4 | 1.0.4 |
| debian | debian_linux | — | — |
| debian | gross | < gross 1.0.2-4.1~deb12u1 (bookworm) | gross 1.0.2-4.1~deb12u1 (bookworm) |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-52159: A stack-based buffer overflow vulnerability in gross 0
osv·2024-03-18·CVSS 7.5
CVE-2023-52159 [HIGH] CVE-2023-52159: A stack-based buffer overflow vulnerability in gross 0
A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon crash) or potentially execute arbitrary code in grossd via crafted SMTP transaction parameters that cause an incorrect strncat for a log entry.
Ubuntu
Gross vulnerability
vendor_ubuntu·2024-08-01
CVE-2023-52159 Gross vulnerability
Title: Gross vulnerability
Summary: Gross could be made to crash or to allow arbitary code execution.
It was discovered that Gross incorrectly handled memory when composing log
entries. An attacker could possibly use this issue to cause Gross to crash,
resulting in a denial of service, or possibly execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2023-52159: gross - A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1....
vendor_debian·2023·CVSS 7.5
CVE-2023-52159 [HIGH] CVE-2023-52159: gross - A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1....
A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon crash) or potentially execute arbitrary code in grossd via crafted SMTP transaction parameters that cause an incorrect strncat for a log entry.
Scope: local
bookworm: resolved (fixed in 1.0.2-4.1~deb12u1)
bullseye: resolved (fixed in 1.0.2-4.1~deb11u1)
forky: resolved (fixed in 1.0.2-4.1)
sid: resolved (fixed in 1.0.2-4.1)
trixie: resolved (fixed in 1.0.2-4.1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-03-18
Published