CVE-2023-30576

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, this may allow an attacker to execute arbitrary code with the privileges of the guacd process.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Guacamole	>= 0.9.10, <= 1.5.1
apache	guacamole	>= 0.9.10, <= 1.5.1

References

https://lists.apache.org/thread/vgtvxb3w7mm84hx6v8dfc0onsoz05gb6Mailing List, Vendor Advisory
https://lists.apache.org/thread/vgtvxb3w7mm84hx6v8dfc0onsoz05gb6Mailing List, Vendor Advisory

Timeline

Published: Jun 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-305777.8AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different CVE-2023-30585.4A vulnerability was found in 07FLY CRM up to 1.2.0. It has been declared as problematic. This vulnerability affects unknown code of the comp CVE-2023-305817.5The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.jso CVE-2023-305825.3A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read fla CVE-2023-305837.5fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in CVE-2023-305847.7A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to impro CVE-2023-305857.5A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Nod CVE-2023-305867.5A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission mo CVE-2023-305877.5A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspect CVE-2023-305885.3When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs maki CVE-2023-305897.5The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP CVE-2023-30599.8A vulnerability, which was classified as critical, was found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown part