CVE-2023-32181

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files This issue affects libeconf: before 0.5.2.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
openSUSE	libeconf	>= ?, < 0.5.2

References

https://https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32181Broken Link, Issue Tracking, Vendor Advisory
https://https://github.com/openSUSE/libeconf/issues/178Broken Link, Issue Tracking, Vendor Advisory
https://https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32181Broken Link, Issue Tracking, Vendor Advisory
https://https://github.com/openSUSE/libeconf/issues/178Broken Link, Issue Tracking, Vendor Advisory
https://github.com/openSUSE/libeconf/issues/178

Timeline

Published: Jun 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-321827.8A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SU CVE-2023-321837.8Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate t CVE-2023-321847.8A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user th CVE-2023-321867.5A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/sup CVE-2023-321877.5An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/sup CVE-2023-321889.4A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Toke CVE-2023-321895.9Insecure handling of ssh keys used to bootstrap clients allows local attackers to potentially gain access to the keys CVE-2023-32195.3The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid E CVE-2023-321907.8mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file operations that run with CVE-2023-321919.9When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of CVE-2023-321928.3A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be exp CVE-2023-321938.3A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. T