libc stdio buffer overflow
Priority MEDIUM 44CWE-131Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-131 and the CVSS impact.
Summary
In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the __sflush() stdio function in libc does not correctly update FILE objects' write space members for write-buffered streams when the write(2) system call returns an error. Depending on the nature of an application that calls libc's stdio functions and the presence of errors returned from the write(2) system call (or an overridden stdio write routine) a heap buffer overflow may occur. Such overflows may lead to data corruption or the execution of arbitrary code at the privilege level of the calling program.
Why it matters now
EPSS 0.01073 65th percentileScored 2026-11-07
Fix Fixed FreeBSD (FreeBSD): p7, p5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FreeBSD | FreeBSD | 12.4-RELEASE to before p7; 13.2-RELEASE to before p5 | p7, p5 | Patch available | CNA |
- FreeBSD VendorFreeBSD Affected 12.4-RELEASE to before p7; 13.2-RELEASE to before p5 Fixed in p7, p5 Patch available CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* | before 12.4; 13.0 to before 13.2 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.4:-:*:*:*:*:*:* | 12.4 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.4:p1:*:*:*:*:*:* | 12.4 p1 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.4:p2:*:*:*:*:*:* | 12.4 p2 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.4:p3:*:*:*:*:*:* | 12.4 p3 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.4:p4:*:*:*:*:*:* | 12.4 p4 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.4:p5:*:*:*:*:*:* | 12.4 p5 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.4:p6:*:*:*:*:*:* | 12.4 p6 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.4:rc2-p1:*:*:*:*:*:* | 12.4 rc2-p1 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.4:rc2-p2:*:*:*:*:*:* | 12.4 rc2-p2 | Vulnerable | FreeBSD |
- cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* Versions before 12.4; 13.0 to before 13.2 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.4:-:*:*:*:*:*:* Versions 12.4 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.4:p1:*:*:*:*:*:* Versions 12.4 p1 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.4:p2:*:*:*:*:*:* Versions 12.4 p2 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.4:p3:*:*:*:*:*:* Versions 12.4 p3 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.4:p4:*:*:*:*:*:* Versions 12.4 p4 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.4:p5:*:*:*:*:*:* Versions 12.4 p5 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.4:p6:*:*:*:*:*:* Versions 12.4 p6 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.4:rc2-p1:*:*:*:*:*:* Versions 12.4 rc2-p1 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.4:rc2-p2:*:*:*:*:*:* Versions 12.4 rc2-p2 Vulnerable ·FreeBSD
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:* | 13.2 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:* | 13.2 p1 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:* | 13.2 p2 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.2:p3:*:*:*:*:*:* | 13.2 p3 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:13.2:p4:*:*:*:*:*:* | 13.2 p4 | Vulnerable | FreeBSD |
- cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:* Versions 13.2 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:* Versions 13.2 p1 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:* Versions 13.2 p2 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.2:p3:*:*:*:*:*:* Versions 13.2 p3 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:13.2:p4:*:*:*:*:*:* Versions 13.2 p4 Vulnerable ·FreeBSD
Remediation
- Fix · CNA FreeBSD (FreeBSD) Fixed in p7, p5
Timeline
- 2026-10-02 Threatist record created from CVE-2023-5941
- 2026-10-03 Alias added: GHSA-wxrq-hw6f-m4w8
References
More Freebsd vulnerabilities
- TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
- TI-2007-03684 Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows… CVSS 3.1CRITICAL 9.8
- TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
- TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
- TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
- TI-2003-00642 The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 10.0
Sources
- CVE-2023-5941 · CVE Program
- CVE-2023-5941 · NVD
- FIRST EPSS
- GHSA-wxrq-hw6f-m4w8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences