Sign-up

ID

VAR-202312-0504


CVE

CVE-2023-43826


DESCRIPTION

Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process. Users are recommended to upgrade to version 1.5.4, which fixes this issue.

Trust: 1.0

sources: NVD: CVE-2023-43826

AFFECTED PRODUCTS

vendor:apachemodel:guacamolescope:lteversion:1.5.3

Trust: 1.0

sources: NVD: CVE-2023-43826

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-43826
value: HIGH

Trust: 1.0

security@apache.org: CVE-2023-43826
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2023-43826
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

security@apache.org: CVE-2023-43826
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.6
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: NVD: CVE-2023-43826 // NVD: CVE-2023-43826

PROBLEMTYPE DATA

problemtype:CWE-190

Trust: 1.0

sources: NVD: CVE-2023-43826

EXTERNAL IDS

db:OPENWALLid:OSS-SECURITY/2023/12/19/4

Trust: 1.0

db:NVDid:CVE-2023-43826

Trust: 1.0

sources: NVD: CVE-2023-43826

REFERENCES

url:http://www.openwall.com/lists/oss-security/2023/12/19/4

Trust: 1.0

url:https://lists.apache.org/thread/23gzwftpfgtq97tj6ttmbclry53kmwv6

Trust: 1.0

sources: NVD: CVE-2023-43826

SOURCES

db:NVDid:CVE-2023-43826

LAST UPDATE DATE

2024-08-14T14:42:55.133000+00:00


SOURCES UPDATE DATE

db:NVDid:CVE-2023-43826date:2023-12-22T20:45:28.967

SOURCES RELEASE DATE

db:NVDid:CVE-2023-43826date:2023-12-19T20:15:08.300