Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3857 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3857-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     September 03, 2024                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libtommath     Version        : 1.2.0-6+deb11u1     CVE ID         : CVE-2023-36328

    It was discovered that there was a series of integer overflow     vulnerabilities in LibTomMath, a multiple-precision mathematics     library.

    This could have led attackers to execute arbitrary code and/or cause     a denial of service (DoS).

    For Debian 11 bullseye, this problem has been fixed in version     1.2.0-6+deb11u1.

    We recommend that you upgrade your libtommath packages.

    For the detailed security status of libtommath please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libtommath

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libtommath package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Integer Overflow vulnerability in mp_grow in libtom libtommath before commit     beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of     service (DoS). (CVE-2023-36328)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtommath package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer Overflow vulnerability in mp_grow in libtom libtommath before commit     beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of     service (DoS). (CVE-2023-36328)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6402-2 advisory.

    USN-6402-1 fixed vulnerabilities in LibTomMath. This update provides the corresponding updates for Ubuntu     23.10.

    Original advisory details:

    It was discovered that LibTomMath incorrectly handled certain inputs.

    An attacker could possibly use this issue to execute arbitrary code

    and cause a denial of service (DoS).

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-f357a25877 advisory.

  - Integer Overflow vulnerability in mp_grow in libtom libtommath before commit     beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of     service (DoS). (CVE-2023-36328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-370 advisory.

  - Integer Overflow vulnerability in mp_grow in libtom libtommath before commit     beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of     service (DoS). (CVE-2023-36328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6402-1 advisory.

    It was discovered that LibTomMath incorrectly handled certain inputs. An attacker could possibly use this     issue to execute arbitrary code and cause a denial of service (DoS).

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libtommath / tcl installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-36328 advisory.

  - Integer Overflow vulnerability in mp_grow in libtom libtommath before commit     beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of     service (DoS). (CVE-2023-36328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tcl installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-36328 advisory.

  - Integer Overflow vulnerability in mp_grow in libtom libtommath before commit     beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of     service (DoS). (CVE-2023-36328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libtommath installed on the remote host is prior to 1.0.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2ANSIBLE2-2023-010 advisory.

  - Integer Overflow vulnerability in mp_grow in libtom libtommath before commit     beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of     service (DoS). (CVE-2023-36328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-f5680e3b4b advisory.

  - Integer Overflow vulnerability in mp_grow in libtom libtommath before commit     beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of     service (DoS). (CVE-2023-36328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-69b85312f0 advisory.

  - Integer Overflow vulnerability in mp_grow in libtom libtommath before commit     beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of     service (DoS). (CVE-2023-36328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206482	Debian dla-3857 : libtommath-dev - security update	Nessus	Debian Local Security Checks	critical
197264	EulerOS Virtualization 3.0.6.0 : libtommath (EulerOS-SA-2024-1688)	Nessus	Huawei Local Security Checks	critical
191871	EulerOS 2.0 SP8 : libtommath (EulerOS-SA-2024-1278)	Nessus	Huawei Local Security Checks	critical
188647	EulerOS Virtualization 2.10.0 : libtommath (EulerOS-SA-2023-3476)	Nessus	Huawei Local Security Checks	critical
188622	EulerOS 2.0 SP11 : libtommath (EulerOS-SA-2023-3037)	Nessus	Huawei Local Security Checks	critical
188616	EulerOS 2.0 SP10 : libtommath (EulerOS-SA-2023-3185)	Nessus	Huawei Local Security Checks	critical
188566	EulerOS Virtualization 2.11.0 : libtommath (EulerOS-SA-2023-3381)	Nessus	Huawei Local Security Checks	critical
188508	EulerOS 2.0 SP9 : libtommath (EulerOS-SA-2023-3340)	Nessus	Huawei Local Security Checks	critical
188434	EulerOS Virtualization 2.9.1 : libtommath (EulerOS-SA-2024-1039)	Nessus	Huawei Local Security Checks	critical
188330	EulerOS Virtualization 2.10.1 : libtommath (EulerOS-SA-2023-3504)	Nessus	Huawei Local Security Checks	critical
188275	EulerOS 2.0 SP11 : libtommath (EulerOS-SA-2023-3014)	Nessus	Huawei Local Security Checks	critical
188156	EulerOS 2.0 SP10 : libtommath (EulerOS-SA-2023-3220)	Nessus	Huawei Local Security Checks	critical
188155	EulerOS Virtualization 2.9.0 : libtommath (EulerOS-SA-2024-1013)	Nessus	Huawei Local Security Checks	critical
188099	EulerOS 2.0 SP9 : libtommath (EulerOS-SA-2023-3308)	Nessus	Huawei Local Security Checks	critical
188085	EulerOS Virtualization 2.11.1 : libtommath (EulerOS-SA-2023-3362)	Nessus	Huawei Local Security Checks	critical
186327	Ubuntu 23.10 : LibTomMath vulnerability (USN-6402-2)	Nessus	Ubuntu Local Security Checks	critical
185264	Fedora 39 : libtommath (2023-f357a25877)	Nessus	Fedora Local Security Checks	critical
182446	Amazon Linux 2023 : libtommath, libtommath-devel (ALAS2023-2023-370)	Nessus	Amazon Linux Local Security Checks	critical
182420	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : LibTomMath vulnerability (USN-6402-1)	Nessus	Ubuntu Local Security Checks	critical
182375	CBL Mariner 2.0 Security Update: libtommath / tcl (CVE-2023-36328)	Nessus	MarinerOS Local Security Checks	critical
182148	CBL Mariner 2.0 Security Update: tcl (CVE-2023-36328)	Nessus	MarinerOS Local Security Checks	critical
181932	Amazon Linux 2 : libtommath (ALASANSIBLE2-2023-010)	Nessus	Amazon Linux Local Security Checks	critical
181519	Fedora 37 : libtommath (2023-f5680e3b4b)	Nessus	Fedora Local Security Checks	critical
180490	Fedora 38 : libtommath (2023-69b85312f0)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2023-36328

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical