CVE-2023-43641

lipnitsk libcue, fedoraproject fedora, debian linux

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2023-43641

Katalog CVE

CVSS 8.8 · High EPSS 18,1%

Kerentanan Out-of-bounds Write pada lipnitsk libcue, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution. This issue is patched in version 2.3.0.

Rincian

Terbit di NVD
9 Oktober 2023
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-787: Out-of-bounds Write
EPSS (30 hari)
18,1% peluang dieksploitasi; lebih tinggi dari 97,1% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
lipnitsk libcue Semua versi sebelum 2.3.0
fedoraproject fedora Versi 37
fedoraproject fedora Versi 38
fedoraproject fedora Versi 39
debian debian linux Versi 10.0
debian debian linux Versi 11.0
debian debian linux Versi 12.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.