CVE-2023-36328

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/libtom/libtommath/pull/546Issue Tracking, Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3H2PFUTBKQUDSOJXQQS7LUSZQWT3JTW2/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46GORAXZ34MHQNUGJBKS7PJ5NSMIAJGC/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ZUPWZGPFJ4JOI2NIP7YLRKZD5YXQTBK/Mailing List, Third Party Advisory
https://github.com/libtom/libtommath/pull/546Issue Tracking, Patch
https://lists.debian.org/debian-lts-announce/2024/09/msg00011.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3H2PFUTBKQUDSOJXQQS7LUSZQWT3JTW2/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46GORAXZ34MHQNUGJBKS7PJ5NSMIAJGC/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ZUPWZGPFJ4JOI2NIP7YLRKZD5YXQTBK/Mailing List, Third Party Advisory

Timeline

Published: Sep 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-36337.5An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash. This issue affects Bitdefender Engines ve CVE-2023-363318.2Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via ma CVE-2023-363376.1A reflected cross-site scripting (XSS) vulnerability in the component /index.php/cuzh4 of PHP Inventory Management System 1 allows attackers CVE-2023-363385.3Inventory Management System 1 was discovered to contain a SQL injection vulnerability.CVE-2023-363397.5An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request.CVE-2023-36348.8In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mod CVE-2023-363409.8TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.CVE-2023-363447.8An issue in Diebold Nixdorf Vynamic View Console v.5.3.1 and before allows a local attacker to execute arbitrary code via not restricting th CVE-2023-363458.8A Cross-Site Request Forgery (CSRF) in POS Codekop v2.0 allows attackers to escalate privileges.CVE-2023-363466.1POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.CVE-2023-363477.5A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.CVE-2023-363488.8POS Codekop v2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the filename parameter.