CVE-2023-23082

NameCVE-2023-23082
DescriptionA heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3712-1
Debian Bugs1031048

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
kodi (PTS)buster2:17.6+dfsg1-4vulnerable
buster (security)2:17.6+dfsg1-4+deb10u1fixed
bullseye2:19.1+dfsg2-2+deb11u1vulnerable
bookworm2:20.1+dfsg-1fixed
trixie2:20.4+dfsg-1fixed
sid2:20.5+dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
kodisourcebuster2:17.6+dfsg1-4+deb10u1DLA-3712-1
kodisource(unstable)2:20.0+dfsg-21031048

Notes

[bullseye] - kodi <no-dsa> (Minor issue)
https://github.com/xbmc/xbmc/issues/22377
https://github.com/xbmc/xbmc/commit/00fec1dbdd1df827872c7b55ad93059636dfc076
https://github.com/xbmc/xbmc/commit/7e5f9fbf9aaa3540aab35e7504036855b23dcf60
https://github.com/xbmc/xbmc/pull/22380

Search for package or bug name: Reporting problems