Skip to main content

Nettle CVE-2023-36660

CRITICAL
Out-of-bounds Write (CWE-787)
2023-06-25 cve@mitre.org
Memory Corruption Buffer Overflow Nettle
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jun 25, 2023 - 22:15 nvd
CRITICAL 9.8

DescriptionNVD

The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.

AnalysisAI

The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.

Technical ContextAI

This vulnerability is classified as Out-of-bounds Write (CWE-787), which allows attackers to write data beyond allocated buffer boundaries leading to code execution or crashes. The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption. Affected products include: Nettle Project Nettle. Version information: before 3.9.1.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate write boundaries, use memory-safe languages, enable compiler protections (ASLR, stack canaries).

More in Nettle

View all
CVE-2015-8803 CRITICAL
9.8 Feb 23

The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces inco
CVE-2015-8804 CRITICAL
9.8 Feb 23

x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in
CVE-2015-8805 CRITICAL
9.8 Feb 23

The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces inco
CVE-2016-6489 HIGH
7.5 Apr 14

The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channe
CVE-2021-20305 HIGH
8.1 Apr 05

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, ED
CVE-2021-3580 HIGH
7.5 Aug 05

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. Rated high severity

CVE-2018-16869 MEDIUM
5.7 Dec 03

A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Memory Corruption

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8

Share

CVE-2023-36660 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy