CVE-2023-49287 - Vulnerability Details - OpenCVE

TinyDir is a lightweight C directory and file reader. Buffer overflows in the `tinydir_file_open()` function. This vulnerability has been patched in version 1.2.6.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Cxong	Tinydir

Configuration 1 [-]

cpe:2.3:a:cxong:tinydir:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://packetstormsecurity.com/files/176060/TinyDir-1.2.5-Buffer-Overflow.html
http://seclists.org/fulldisclosure/2023/Dec/14
http://www.openwall.com/lists/oss-security/2023/12/04/1
https://github.com/cxong/tinydir/releases/tag/1.2.6
https://github.com/cxong/tinydir/security/advisories/GHSA-jf5r-wgf4-qhxf

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-12-04T05:29:10.673Z

Updated: 2025-02-13T17:18:39.151Z

Reserved: 2023-11-24T16:45:24.312Z

Link: CVE-2023-49287

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-12-04T06:15:07.173

Modified: 2024-11-21T08:33:11.477

Link: CVE-2023-49287

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-49287", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-11-24T16:45:24.312Z", "datePublished": "2023-12-04T05:29:10.673Z", "dateUpdated": "2025-02-13T17:18:39.151Z"}, "containers": {"cna": {"title": "Buffer overflow vulnerabilities in tinydir", "problemTypes": [{"descriptions": [{"cweId": "CWE-120", "lang": "en", "description": "CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-121", "lang": "en", "description": "CWE-121: Stack-based Buffer Overflow", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/cxong/tinydir/security/advisories/GHSA-jf5r-wgf4-qhxf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cxong/tinydir/security/advisories/GHSA-jf5r-wgf4-qhxf"}, {"name": "https://github.com/cxong/tinydir/releases/tag/1.2.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/cxong/tinydir/releases/tag/1.2.6"}, {"url": "http://www.openwall.com/lists/oss-security/2023/12/04/1"}, {"url": "http://packetstormsecurity.com/files/176060/TinyDir-1.2.5-Buffer-Overflow.html"}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/14"}], "affected": [{"vendor": "cxong", "product": "tinydir", "versions": [{"version": "< 1.2.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-12-13T02:06:45.850Z"}, "descriptions": [{"lang": "en", "value": "TinyDir is a lightweight C directory and file reader. Buffer overflows in the `tinydir_file_open()` function. This vulnerability has been patched in version 1.2.6."}], "source": {"advisory": "GHSA-jf5r-wgf4-qhxf", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:53:44.975Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/cxong/tinydir/security/advisories/GHSA-jf5r-wgf4-qhxf", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/cxong/tinydir/security/advisories/GHSA-jf5r-wgf4-qhxf"}, {"name": "https://github.com/cxong/tinydir/releases/tag/1.2.6", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/cxong/tinydir/releases/tag/1.2.6"}, {"url": "http://www.openwall.com/lists/oss-security/2023/12/04/1", "tags": ["x_transferred"]}, {"url": "http://packetstormsecurity.com/files/176060/TinyDir-1.2.5-Buffer-Overflow.html", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/14", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cxong:tinydir:*:*:*:*:*:*:*:*", "matchCriteriaId": "8619FE2D-1B54-455B-9799-462C2D73DF7F", "versionEndExcluding": "1.2.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "TinyDir is a lightweight C directory and file reader. Buffer overflows in the `tinydir_file_open()` function. This vulnerability has been patched in version 1.2.6."}, {"lang": "es", "value": "TinyDir es un lector de archivos y directorios C liviano. El b\u00fafer se desborda en la funci\u00f3n `tinydir_file_open()`. Esta vulnerabilidad ha sido parcheada en la versi\u00f3n 1.2.6."}], "id": "CVE-2023-49287", "lastModified": "2024-11-21T08:33:11.477", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-12-04T06:15:07.173", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/176060/TinyDir-1.2.5-Buffer-Overflow.html"}, {"source": "security-advisories@github.com", "url": "http://seclists.org/fulldisclosure/2023/Dec/14"}, {"source": "security-advisories@github.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2023/12/04/1"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/cxong/tinydir/releases/tag/1.2.6"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/cxong/tinydir/security/advisories/GHSA-jf5r-wgf4-qhxf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/176060/TinyDir-1.2.5-Buffer-Overflow.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2023/Dec/14"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2023/12/04/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/cxong/tinydir/releases/tag/1.2.6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/cxong/tinydir/security/advisories/GHSA-jf5r-wgf4-qhxf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}, {"lang": "en", "value": "CWE-121"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-120"}], "source": "nvd@nist.gov", "type": "Primary"}]}