CVE-2023-49287

Summary

TinyDir is a lightweight C directory and file reader. Buffer overflows in the tinydir_file_open() function. This vulnerability has been patched in version 1.2.6.

Affected Software

Weaknesses

• CWE-120: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
• CWE-121: CWE-121: Stack-based Buffer Overflow

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/cxong/tinydir/security/advisories/GHSA-jf5r-wgf4-qhxf
• https://github.com/cxong/tinydir/releases/tag/1.2.6
• http://www.openwall.com/lists/oss-security/2023/12/04/1
• http://packetstormsecurity.com/files/176060/TinyDir-1.2.5-Buffer-Overflow.html
• http://seclists.org/fulldisclosure/2023/Dec/14

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/cxong/tinydir/security/advisories/GHSA-jf5r-wgf4-qhxf
• https://github.com/cxong/tinydir/releases/tag/1.2.6
• http://www.openwall.com/lists/oss-security/2023/12/04/1
• http://packetstormsecurity.com/files/176060/TinyDir-1.2.5-Buffer-Overflow.html
• http://seclists.org/fulldisclosure/2023/Dec/14

• ←Previous
• Next→