Summary
Mark Esler and David Fernandez Gonzalez discovered that
EditorConfig Core C incorrectly handled memory when handling
certain inputs. An attacker could possibly use this issue to cause
applications using EditorConfig Core C to crash, resulting in a
denial of service, or possibly execute arbitrary code.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | editorconfig-core | 0.12.0-2ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | editorconfig-core | 0.12.1-1.1ubuntu0.18.04.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | editorconfig-core | 0.12.1-1.1ubuntu0.20.04.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | editorconfig-core | 0.12.5-2ubuntu0.1~esm1 |
Vulnerabilities 1
-
High 7.8
Stack Buffer Overflow in editorconfig-core-c
A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by boun…
References
-
report
https://ubuntu.com/security/CVE-2023-0341