CVE-2023-36328

NameCVE-2023-36328
DescriptionInteger Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3857-1
Debian Bugs1051100

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libtommath (PTS)bookworm1.2.0-6+deb12u1fixed
forky, sid, trixie1.3.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libtommathsourcebullseye1.2.0-6+deb11u1DLA-3857-1
libtommathsourcebookworm1.2.0-6+deb12u1
libtommathsource(unstable)1.2.1-11051100

Notes

[buster] - libtommath <no-dsa> (Minor issue)
https://github.com/libtom/libtommath/pull/546
https://github.com/libtom/libtommath/commit/beba892bc0d4e4ded4d667ab1d2a94f4d75109a9 (v1.2.1)
Search for package or bug name: Reporting problems