Another heap overflow in push_back_helper
CVE-2023-39947

8.2HIGH

Key Information:

Vendor

Eprosima

Status
Fast-dds
Vendor
CVE Published:
11 August 2023

What is CVE-2023-39947?

The Fast DDS by eprosima, a C++ implementation of the Data Distribution Service standard, contains a vulnerability that can lead to a heap overflow caused by malformed PID_PROPERTY_LIST parameters. This flaw, which persists despite prior fixes, allows for the potential crashing of any Fast DDS process remotely. Patch versions including 2.11.1, 2.10.2, 2.9.2, and 2.6.6 have been released to address this critical issue.

Affected Version(s)

Fast-DDS < 2.6.6 < 2.6.6

Fast-DDS >= 2.7.0, < 2.9.2 < 2.7.0, 2.9.2

Fast-DDS >= 2.10.0, < 2.10.2 < 2.10.0, 2.10.2

References

https://github.com/eProsima/Fast-DDS/security/advisories/...
x_refsource_CONFIRM
https://github.com/eProsima/Fast-DDS/commit/349227005827e...
x_refsource_MISC
https://www.debian.org/security/2023/dsa-5481

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.