{"answers":{"affected":"It affects 2 products.","exploited":"There is no known exploitation of CVE-2023-42464 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2023-42464 is a critical memory corruption vulnerability in Debian Debian Linux, published on 20 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-42464 and fix it if it is affected.\n\nWhat it is: CVE-2023-42464 is a critical memory corruption vulnerability in Debian Debian Linux, published on 20 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-42464 in the wild and no public exploit code.\n\nAffected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-42464/ (Markdown: https://insights.sbomify.com/CVE-2023-42464/index.md)","id":"CVE-2023-42464","markdown":"https://insights.sbomify.com/CVE-2023-42464/index.md","name":"CVE-2023-42464","record":{"aliases":["DEBIAN-CVE-2023-42464","DLA-3584-1","GHSA-qv4g-5q5g-2vc3","SUSE-SU-2023:3779-1","UBUNTU-CVE-2023-42464","USN-6552-1"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Netatalk AFP server","requires_auth":"none","summary":"A type confusion flaw in Netatalk's Spotlight RPC parsing allows remote attackers to achieve code execution via malicious packets.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[{"product":"debian_linux","vendor":"debian"},{"product":"netatalk","vendor":"netatalk"}],"cvss":{"score":9.8,"severity":"critical","source":"nvd","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-843","name":"Access of Resource Using Incompatible Type"}],"description":"A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When parsing Spotlight RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the underlying protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a malicious actor may be able to fully control the value of the pointer and theoretically achieve Remote Code Execution on the host. This issue is similar to CVE-2023-34967.","ecosystems":["SUSE:Linux Enterprise Software Development Kit 12 SP5","SUSE:Linux Enterprise Workstation Extension 12 SP5"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Memory corruption in n/a","id":"CVE-2023-42464","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"debian:debian_linux","products":["debian:debian_linux"],"type":"memory_corruption","year":"2023"},"n_packages":2,"n_references":7,"next":{"headline":"Privilege escalation in n/a","id":"CVE-2023-42465"},"packages":[{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","fixed":["3.1.0-3.19.1"],"introduced":["0"],"last_affected":[],"package":"netatalk","purl":"pkg:rpm/suse/netatalk\u0026distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5","source":"SUSE-SU-2023:3779-1"},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","fixed":["3.1.0-3.19.1"],"introduced":["0"],"last_affected":[],"package":"netatalk","purl":"pkg:rpm/suse/netatalk\u0026distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP5","source":"SUSE-SU-2023:3779-1"}],"prev":{"headline":"wazuh-logcollector integer underflow local privilege escalation","id":"CVE-2023-42463"},"products":["n/a"],"published":"2023-09-20","related":[{"cvss_score":10,"headline":"ProFTPD Improper Access Control","id":"CVE-2015-3306","kev_date_added":"2026-10-08","published":"2015-05-18"},{"cvss_score":9.9,"headline":"RoundCube Webmail Deserialization of Untrusted Data","id":"CVE-2025-49113","kev_date_added":"2026-02-20","published":"2025-06-02"},{"cvss_score":9.8,"headline":"GNU InetUtils Argument Injection","id":"CVE-2026-24061","kev_date_added":"2026-01-26","published":"2026-01-21"},{"cvss_score":9.8,"headline":"Linux Kernel Improper Check for Unusual or Exceptional Conditions","id":"CVE-2025-39682","kev_date_added":"2026-09-18","published":"2025-09-05"},{"cvss_score":9.8,"headline":"Mozilla Firefox Use-After-Free","id":"CVE-2024-9680","kev_date_added":"2024-10-15","published":"2024-10-09"},{"cvss_score":9.8,"headline":"RARLAB UnRAR Directory Traversal","id":"CVE-2022-30333","kev_date_added":"2022-08-09","published":"2022-05-09"},{"cvss_score":9.8,"headline":"Roundcube Webmail SQL Injection","id":"CVE-2021-44026","kev_date_added":"2023-06-22","published":"2021-11-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"SUSE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-02","vendors":["n/a"]},"summary":"A type confusion flaw in Netatalk's Spotlight RPC parsing allows remote attackers to achieve code execution via malicious packets.","url":"https://insights.sbomify.com/CVE-2023-42464/"}