CVE-2023-6780
published 2024-01-31CVE-2023-6780: An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
2.71%
84.3th percentile
An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glibc | < glibc 2.36-9+deb12u4 (bookworm) | glibc 2.36-9+deb12u4 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| gnu | glibc | >= 0 < 2.36-9+deb12u4 | 2.36-9+deb12u4 |
| gnu | glibc | >= 0 < 2.37-15 | 2.37-15 |
| gnu | glibc | >= 0 < 2.37-15 | 2.37-15 |
| gnu | glibc | >= 2.37 < 2.39 | 2.39 |
| msrc | azl3_glibc_2.38-10_on_azure_linux_3.0 | — | — |
| msrc | azl3_glibc_2.38-6_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_msrc5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SIMATIC S7-1500 CPU Family
cisa_ics·2025-06-12
Siemens SIMATIC S7-1500 CPU Family
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU Family
Release DateJune 12, 2025
Alert CodeICSA-25-162-05
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.7
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU family
- Vulnerabilities: Missing Encryption of Sensitive Data, Out-of-bounds Read, Use After Free, Stack-
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2024-02-01
CVE-2023-6779 GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: GNU C Library could be made to crash or run programs as an administrator
if it handled a specially crafted request.
It was discovered that the GNU C Library incorrectly handled the syslog()
function call. A local attacker could use this issue to execute arbitrary
code and possibly escalate privileges.
Instructions: After a standard system update you need to reboot your computer to make all
the necessary changes.
Red Hat
glibc: integer overflow in __vsyslog_internal()
vendor_redhat·2024-01-30·CVSS 5.3
CVE-2023-6780 [MEDIUM] CWE-190 glibc: integer overflow in __vsyslog_internal()
glibc: integer overflow in __vsyslog_internal()
An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer.
An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer.
Microsoft
Glibc: integer overflow in __vsyslog_internal()
vendor_msrc·2024-01-09·CVSS 5.3
CVE-2023-6780 [MEDIUM] CWE-131 Glibc: integer overflow in __vsyslog_internal()
Glibc: integer overflow in __vsyslog_internal()
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.micro
Debian
CVE-2023-6780: glibc - An integer overflow was found in the __vsyslog_internal function of the glibc li...
vendor_debian·2023·CVSS 5.3
CVE-2023-6780 [MEDIUM] CVE-2023-6780: glibc - An integer overflow was found in the __vsyslog_internal function of the glibc li...
An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer.
Scope: local
bookworm: resolved (fixed in 2.36-9+deb12u4)
bullseye: resolved
forky: resolved (fixed in 2.37-15)
sid: resolved (fixed in 2.37-15)
trixie: resolved (fixed in 2.37-15)
OSV
CVE-2023-6780: An integer overflow was found in the __vsyslog_internal function of the glibc library
osv·2024-01-31·CVSS 5.3
CVE-2023-6780 [MEDIUM] CVE-2023-6780: An integer overflow was found in the __vsyslog_internal function of the glibc library
An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer.
GHSA
GHSA-jjr8-97p7-vmmg: An integer overflow was found in the __vsyslog_internal function of the glibc library
ghsa_unreviewed·2024-01-31
CVE-2023-6780 [MEDIUM] CWE-131 GHSA-jjr8-97p7-vmmg: An integer overflow was found in the __vsyslog_internal function of the glibc library
An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer.
No detection rules found.
No public exploits indexed.
Qualys
Qualys TRU Discovers Important Vulnerabilities in GNU C Library’s syslog() | Qualys
blogs_qualys·2024-01-30·CVSS 8.4
CVE-2023-6246 [HIGH] Qualys TRU Discovers Important Vulnerabilities in GNU C Library’s syslog() | Qualys
#### Table of Contents
- Vulnerabilities in GNU C Library:
- Heap-Based Buffer Overflow in __vsyslog_internal() Function (CVE-2023-6246):
- Memory Corruption in qsort() Function:
- Qualys QID Coverage:
- Enhance Your Security Posture with Qualys Vulnerability Management, Detection, and Response (VMDR)
- Discover Vulnerable Assets Using Qualys CyberSecurity Asset Management (CSAM)
- Disclosure Timeline for CVE-2023-6246, CVE-2023-6779 and CVE-2023-6780
- Disclosure Timeline for Out-of-bounds read & write in glibcs qsort()
- Technical Details
The Qualys Threat Research Unit (TRU) has recently unearthed four significant vulnerabilities in the GNU C Library, a cornerstone for countless applications in the Linux environment.
Before diving into the specific details of the vulnerabilities disc
Bleepingcomputer
New Linux glibc flaw lets attackers get root on major distros
blogs_bleepingcomputer·2024-01-30·CVSS 8.4
[HIGH] New Linux glibc flaw lets attackers get root on major distros
## New Linux glibc flaw lets attackers get root on major distros
## Sergiu Gatlan
"The buffer overflow issue poses a significant threat as it could allow local privilege escalation, enabling an unprivileged user to gain full root access through crafted inputs to applications that employ these logging functions," Qualys security researchers said.
"Although the vulnerability requires specific conditions to be exploited (such as an unusually long argv[0] or openlog() ident argument), its impact is significant due to the widespread use of the affected library."
## Impacts Debian, Ubuntu, and Fedora systems
While testing their findings, Qualys confirmed that Debian 12 and 13, Ubuntu 23.04 and 23.10, and Fedora 37 to 39 were all vulnerable to CVE-2023-6246 exploits, allowing any unprivilege
Qualys
Qualys TRU Discovers Important Vulnerabilities in GNU C Library’s syslog()
blogs_qualys·2024-01-30·CVSS 8.4
CVE-2023-6246 [HIGH] Qualys TRU Discovers Important Vulnerabilities in GNU C Library’s syslog()
## Table of Contents
Vulnerabilities in GNU C Library:
Heap-Based Buffer Overflow in __vsyslog_internal() Function (CVE-2023-6246):
Memory Corruption in qsort() Function:
Qualys QID Coverage:
Enhance Your Security Posture with Qualys Vulnerability Management, Detection, and Response (VMDR)
Discover Vulnerable Assets Using Qualys CyberSecurity Asset Management (CSAM)
Disclosure Timeline for CVE-2023-6246, CVE-2023-6779 and CVE-2023-6780
Disclosure Timeline for Out-of-bounds read & write in glibcs qsort()
Technical Details
The Qualys Threat Research Unit (TRU) has recently unearthed four significant vulnerabilities in the GNU C Library, a cornerstone for countless applications in the Linux environment.
Before diving into the specific details of the vulnerabilities discovered by th
Bugzilla
CVE-2023-6780 glibc: integer overflow in __vsyslog_internal()
bugzilla·2023-12-13·CVSS 5.3
CVE-2023-6780 [MEDIUM] CVE-2023-6780 glibc: integer overflow in __vsyslog_internal()
CVE-2023-6780 glibc: integer overflow in __vsyslog_internal()
An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer.
Discussion:
Created glibc tracking bugs for this issue:
Affects: fedora-all [bug 2261989]
http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.htmlhttp://seclists.org/fulldisclosure/2024/Feb/3https://access.redhat.com/security/cve/CVE-2023-6780https://bugzilla.redhat.com/show_bug.cgi?id=2254396https://lists.fedoraproject.org/archives/list/[email protected]/message/D2FIH77VHY3KCRROCXOT6L27WMZXSJ2G/https://lists.fedoraproject.org/archives/list/[email protected]/message/MWQ6BZJ6CV5UAW4VZSKJ6TO4KIW2KWAQ/https://security.gentoo.org/glsa/202402-01https://www.openwall.com/lists/oss-security/2024/01/30/6https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txthttp://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.htmlhttp://seclists.org/fulldisclosure/2024/Feb/3https://access.redhat.com/security/cve/CVE-2023-6780https://bugzilla.redhat.com/show_bug.cgi?id=2254396https://lists.fedoraproject.org/archives/list/[email protected]/message/D2FIH77VHY3KCRROCXOT6L27WMZXSJ2G/https://lists.fedoraproject.org/archives/list/[email protected]/message/MWQ6BZJ6CV5UAW4VZSKJ6TO4KIW2KWAQ/https://security.gentoo.org/glsa/202402-01https://security.netapp.com/advisory/ntap-20250207-0010/https://www.openwall.com/lists/oss-security/2024/01/30/6https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txthttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
2024-01-31
Published