Sign-up

ID

VAR-202312-2483


CVE

CVE-2023-42800


TITLE

plural  Moonlight Stream  Classic buffer overflow vulnerability in the product

Trust: 0.8

sources: JVNDB: JVNDB-2023-020245

DESCRIPTION

Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code execution (RCE) on the client (with insufficient exploit mitigations or if mitigations can be bypassed). The bug was addressed in commit 24750d4b748fefa03d09fcfd6d45056faca354e0. moonlight-common-c , Moonlight , moonlight embedded etc. multiple Moonlight Stream The product contains a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2023-42800 // JVNDB: JVNDB-2023-020245

AFFECTED PRODUCTS

vendor:moonlight streammodel:embeddedscope:eqversion:2.6.0

Trust: 1.0

vendor:moonlight streammodel:moonlight-common-cscope:ltversion:2023-10-06

Trust: 1.0

vendor:moonlight streammodel:xboxscope:lteversion:1.14.40

Trust: 1.0

vendor:moonlight streammodel:switchscope:lteversion:0.13.3

Trust: 1.0

vendor:moonlight streammodel:moonlightscope:gteversion:8.4.0

Trust: 1.0

vendor:moonlight streammodel:moonlightscope:lteversion:8.5.0

Trust: 1.0

vendor:moonlight streammodel:moonlightscope:eqversion:0.10.22

Trust: 1.0

vendor:moonlight streammodel:tvscope:lteversion:1.5.27

Trust: 1.0

vendor:moonlight streammodel:switchscope:gteversion:0.13

Trust: 1.0

vendor:moonlight streammodel:moonlightscope:lteversion:11.0

Trust: 1.0

vendor:moonlight streammodel:vitascope:gteversion:0.9.2

Trust: 1.0

vendor:moonlight streammodel:moonlight-common-cscope:gteversion:2022-11-04

Trust: 1.0

vendor:moonlight streammodel:vitascope:lteversion:0.9.3

Trust: 1.0

vendor:moonlight streammodel:tvscope:gteversion:1.5.4

Trust: 1.0

vendor:moonlight streammodel:xboxscope:gteversion:1.12.0

Trust: 1.0

vendor:moonlight streammodel:moonlightscope:gteversion:10.10

Trust: 1.0

vendor:moonlight streammodel:moonlightscope: - version: -

Trust: 0.8

vendor:moonlight streammodel:tvscope: - version: -

Trust: 0.8

vendor:moonlight streammodel:moonlight-common-cscope: - version: -

Trust: 0.8

vendor:moonlight streammodel:xboxscope: - version: -

Trust: 0.8

vendor:moonlight streammodel:vitascope: - version: -

Trust: 0.8

vendor:moonlight streammodel:switchscope: - version: -

Trust: 0.8

vendor:moonlight streammodel:embeddedscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2023-020245 // NVD: CVE-2023-42800

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-42800
value: HIGH

Trust: 1.0

security-advisories@github.com: CVE-2023-42800
value: HIGH

Trust: 1.0

NVD: CVE-2023-42800
value: HIGH

Trust: 0.8

nvd@nist.gov: CVE-2023-42800
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2023-42800
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2023-020245 // NVD: CVE-2023-42800 // NVD: CVE-2023-42800

PROBLEMTYPE DATA

problemtype:CWE-120

Trust: 1.0

problemtype:Classic buffer overflow (CWE-120) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-020245 // NVD: CVE-2023-42800

EXTERNAL IDS

db:NVDid:CVE-2023-42800

Trust: 2.6

db:JVNDBid:JVNDB-2023-020245

Trust: 0.8

sources: JVNDB: JVNDB-2023-020245 // NVD: CVE-2023-42800

REFERENCES

url:https://github.com/moonlight-stream/moonlight-common-c/blob/2bb026c763fc18807d7e4a93f918054c488f84e1/src/rtspconnection.c#l796

Trust: 1.8

url:https://github.com/moonlight-stream/moonlight-common-c/commit/24750d4b748fefa03d09fcfd6d45056faca354e0

Trust: 1.8

url:https://github.com/moonlight-stream/moonlight-common-c/commit/50c0a51b10ecc5b3415ea78c21d96d679e2288f9

Trust: 1.8

url:https://github.com/moonlight-stream/moonlight-common-c/security/advisories/ghsa-4927-23jw-rq62

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-42800

Trust: 0.8

sources: JVNDB: JVNDB-2023-020245 // NVD: CVE-2023-42800

SOURCES

db:JVNDBid:JVNDB-2023-020245
db:NVDid:CVE-2023-42800

LAST UPDATE DATE

2024-08-14T15:10:23.755000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2023-020245date:2024-01-16T02:56:00
db:NVDid:CVE-2023-42800date:2023-12-21T17:17:02.843

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2023-020245date:2024-01-16T00:00:00
db:NVDid:CVE-2023-42800date:2023-12-14T17:15:07.463