YASM 1.3.0 /nasm/nasm-token.re handle_dot_label heap-based overflow

Summaryinfo

A vulnerability classified as critical was found in YASM 1.3.0. Affected is the function handle_dot_label of the file /nasm/nasm-token.re. Such manipulation leads to heap-based overflow. This vulnerability is uniquely identified as CVE-2023-30402. No exploit exists.

Detailsinfo

A vulnerability was found in YASM 1.3.0. It has been rated as critical. Affected by this issue is the function handle_dot_label of the file /nasm/nasm-token.re. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

YASM v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re.

The weakness was disclosed 04/25/2023 as 206. The advisory is available at github.com. This vulnerability is handled as CVE-2023-30402 since 04/07/2023. Technical details are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-34822). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• YASM

Version

• 1.3.0

License

• open-source

Website

• Product: https://github.com/yasm/yasm/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion