CVE-2023-25399 Withdrawn: scipy memory leak vulnerability
A refcounting bug in SciPy's Py_FindObjects function can cause memory leaks, potentially leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-25399?
CVE-2023-25399 is a medium-severity memory corruption vulnerability in n/a, published on 5 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. Note: This is disputed as a bug and not a vulnerability. SciPy is not designed to be exposed to untrusted users or data directly.
Weakness: CWE-401
Which versions are affected by CVE-2023-25399?
3 open source packages ship an affected version, including scipy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
scipy PyPI | All versions | 1.10.0 |
scipy PyPI | All versions | 1.10.0 |
scipy PyPI | All versions | 1.10.0 |
Products include Scipy Scipy.
How do I fix CVE-2023-25399?
Upgrade scipy to 1.10.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-25399 being exploited?
There is no known exploitation of CVE-2023-25399 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2023-25399, GHSA-9jx5-6pgf-crrp, MGASA-2024-0078, OESA-2023-1491, PYSEC-2023-102, UBUNTU-CVE-2023-25399.