CVE-2023-31975

LOW

yasm <1.3.0 - Memory Corruption

Title source: llm

Description

yasm v1.3.0 was discovered to contain a memory leak via the function yasm_intnum_copy at /libyasm/intnum.c. Note: Multiple third parties dispute this as a bug and not a vulnerability according to the YASM security policy.

References (18)

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/20/6

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/21/10

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/21/13

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/21/2

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/21/5

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/21/7

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/21/8

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/21/9

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/22/1

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/22/3

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/22/6

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/23/1

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/23/2

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/23/4

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/23/8

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/23/9

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/06/24/1

[Exploit, Issue Tracking] https://github.com/yasm/yasm/issues/210

Scores

CVSS v3 3.3

EPSS 0.0002

EPSS Percentile 5.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Classification

CWE

CWE-401

Status published

Affected Products (1)

yasm_project/yasm

Timeline

Published May 09, 2023

Tracked Since Feb 18, 2026