CVE-2023-52159 Memory corruption in n/a
Remote attackers can trigger a stack-based buffer overflow in the grossd SMTP daemon, leading to denial of service or arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52159?
CVE-2023-52159 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 18 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon crash) or potentially execute arbitrary code in grossd via crafted SMTP transaction parameters that cause an incorrect strncat for a log entry.
Weakness: CWE-787
Which versions are affected by CVE-2023-52159?
It affects 2 products.
Products include Bizdelnick Gross, Debian Debian Linux.
How do I fix CVE-2023-52159?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-52159 being exploited?
There is no known exploitation of CVE-2023-52159 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2023-52159, DLA-3774-1, UBUNTU-CVE-2023-52159, USN-6942-1.