CVE-2023-0341

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
EditorConfig	EditorConfig C Core	< v0.12.6

References

https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529ePatch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZCFE7DXWAAKDJPRKMXHCACKGKNV37IYZ/
https://litios.github.io/2023/01/14/CVE-2023-0341.htmlExploit, Patch, Third Party Advisory
https://ubuntu.com/security/notices/USN-5842-1
https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529ePatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/11/msg00036.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZCFE7DXWAAKDJPRKMXHCACKGKNV37IYZ/
https://litios.github.io/2023/01/14/CVE-2023-0341.htmlExploit, Patch, Third Party Advisory
https://ubuntu.com/security/notices/USN-5842-1

Timeline

Published: Feb 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-03425.3MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files t CVE-2023-03437.5Akuvox E11 contains a function that encrypts messages which are then forwarded. The IV vector and the key are static, and this may allow an CVE-2023-03447.5Akuvox E11 appears to be using a custom version of dropbear SSH server. This server allows an insecure option that by default is not in the CVE-2023-03459.8The Akuvox E11 secure shell (SSH) server is enabled by default and can be accessed by the root user. This password cannot be changed by the CVE-2023-03467.5Akuvox E11 cloud login is performed through an unencrypted HTTP connection. An attacker could gain access to the Akuvox cloud and device if CVE-2023-03475.3The Akuvox E11 Media Access Control (MAC) address, a primary identifier, combined with the Akuvox E11 IP address, could allow an attacker to CVE-2023-03487.5Akuvox E11 allows direct SIP calls. No access control is enforced by the SIP servers, which could allow an attacker to contact any device wi CVE-2023-03499.1The Akuvox E11 libvoice library provides unauthenticated access to the camera capture for image and video. This could allow an attacker to v CVE-2023-03506.5Akuvox E11 does not ensure that a file extension is associated with the file provided. This could allow an attacker to upload a file to the CVE-2023-03518.8The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an atta CVE-2023-03529.1The Akuvox E11 password recovery webpage can be accessed without authentication, and an attacker could download the device key file. An atta CVE-2023-03539.8Akuvox E11 uses a weak encryption algorithm for stored passwords and uses a hard-coded password for decryption which could allow the encrypt