« Volver al listado

CVE-2023-52389

Estado: ModificadaCrítica (9.8)—

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pocoproject — Poco

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-52389",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-52389",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-09T23:34:09.802093Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-01-27T03:15:07.883",
  "references": [
    {
      "url": "https://github.com/pocoproject/poco/compare/poco-1.12.5p2-release...poco-1.13.0-release",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/pocoproject/poco/issues/4320",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://pocoproject.org/blog/?p=1226",
      "tags": [
        "Release Notes"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/pocoproject/poco/compare/poco-1.12.5p2-release...poco-1.13.0-release",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/pocoproject/poco/issues/4320",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00017.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://pocoproject.org/blog/?p=1226",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0."
    },
    {
      "lang": "es",
      "value": "UTF32Encoding.cpp en POCO tiene Poco::UTF32Encoding un desbordamiento de enteros y un desbordamiento de búfer en la región stack de la memoria resultante porque Poco::UTF32Encoding::convert() y Poco::UTF32::queryConvert() pueden devolver un entero negativo si una secuencia de bytes UTF-32 se evalúa a un valor de 0x80000000 o superior. Esto se solucionó en 1.11.8p2, 1.12.5p2 y 1.13.0."
    }
  ],
  "lastModified": "2026-06-17T06:42:39.020",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pocoproject:poco:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62FA172D-0501-4F88-A7FC-39ECF76B75FA",
              "versionEndExcluding": "1.11.8"
            },
            {
              "criteria": "cpe:2.3:a:pocoproject:poco:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71360510-BDF2-4B65-93F7-8296374B559E",
              "versionEndExcluding": "1.12.5",
              "versionStartIncluding": "1.12.0"
            },
            {
              "criteria": "cpe:2.3:a:pocoproject:poco:1.11.8:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE83B800-24BC-4AEF-BAC9-3792724E29BD"
            },
            {
              "criteria": "cpe:2.3:a:pocoproject:poco:1.11.8:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8EB8268-CB82-40E3-9AC2-D0DD448ED5C8"
            },
            {
              "criteria": "cpe:2.3:a:pocoproject:poco:1.12.5:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50F93DF4-2202-4BA2-9E7B-AA6097C20D34"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}