CVE-2023-24056: Medium severity pkgconf pkgconf vulnerability
Published Jan 22, 2023
·Updated
In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconftupleparse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.
Affected Software
1 affected component
pkgconf pkgconf<=1.9.3
Remediation
Event History
Jan 22, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Jan 30, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-24056?
CVE-2023-24056 has been evaluated as having a high severity due to the potential for unbounded string expansion.
2
How do I fix CVE-2023-24056?
To mitigate CVE-2023-24056, upgrade to pkgconf version 1.9.4 or later.
3
What type of vulnerability is CVE-2023-24056?
CVE-2023-24056 is a vulnerability related to variable duplication causing unbounded string expansion.
4
Which versions of pkgconf are affected by CVE-2023-24056?
Pkgconf versions up to and including 1.9.3 are affected by CVE-2023-24056.
5
What is the consequence of exploiting CVE-2023-24056?
Exploitation of CVE-2023-24056 can lead to significant resource consumption, potentially crashing the application due to excessive memory usage.