Safety vulnerability ID: 71263
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Affected versions of Pkgconf are vulnerable to buffer overflow. Variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.
Latest version: 2.2.0.post0
`pkgconf` is a program which helps with discovering library dependencies and configuring compiler and linker flags.
----------------------------
* Fix a buffer overflow vulnerability involving very large variable expansions.
CVE-2023-24056
* Fix a bunch of minor regressions with the solver.
* Create separate solutions for `--cflags` and `--libs` when `--static` is not
used.
* Remove final trailing whitespace in pkgconf_fragment_render_buf().
* Revert broken pkg.m4 change involving querying module versions in
PKG_CHECK_MODULES.
* Fix handling of tildes in version strings.
* Various C99 formatting string fixes involving SIZE_FMT_SPECIFIER.
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application