CVE-2023-52159

Name	CVE-2023-52159
Description	A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon crash) or potentially execute arbitrary code in grossd via crafted SMTP transaction parameters that cause an incorrect strncat for a log entry.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3774-1
Debian Bugs	1067115

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gross (PTS)	bookworm	1.0.2-4.1~deb12u1	fixed
	trixie	1.0.2-4.1	fixed
	forky, sid	1.0.4-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
gross	source	buster	1.0.2-4.1~deb10u1	DLA-3774-1
gross	source	bullseye	1.0.2-4.1~deb11u1
gross	source	bookworm	1.0.2-4.1~deb12u1
gross	source	(unstable)	1.0.2-4.1		1067115

Notes

https://codeberg.org/bizdelnick/gross/commit/6403985fc1060e7aacea96e60535e1e7b0f6f193 (master)
https://codeberg.org/bizdelnick/gross/commit/3f5508cce2c49d216b163eb7b38ea72d5162c76e (1.0.4)
https://codeberg.org/bizdelnick/gross/wiki/Known-vulnerabilities#cve-2023-52159