log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ecf9a798-9aa9-11ef-a8f0-a8a15998b5cb advisory.

    cve@mitre.org reports:
    log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via             long log messages because the header size is not considered.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7376 advisory.

    The libqb packages provide a library with the primary purpose of providing high performance client/server     reusable features, such as high performance logging, tracing, inter-process communication, and polling.

    Security Fix(es):

    * libqb: Buffer overflow in log_blackbox.c (CVE-2023-39976)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-6578 advisory.

    [2.0.6-4]
    - bump rpm version for rhel-exception build       Resolves: rhbz#2230712

    [2.0.6-3]
    - blackbox: fix buffer overflow with long log lines       Resolves: rhbz#2236171

    [2.0.6-1]
    - ipc: Retry receiving credentials if the the message is short       Resolves: rhbz2149647

    [2.0.6-1]
    - Rebase to 2.0.6       Resolves: rhbz#2072903

    [2.0.3-8]
    - Fix negative errno in qb_ipcc_connect (introduced in 2.0.3-4)       Resolves: rhbz#2057527

    [2.0.3-7]
    - Bump soname for async-connect API addition       Resolves: rhbz#bz2031865

    [2.0.3-6]
    - Fix gating.yaml for RHEL-9       Resolves: rhbz#bz2031865

    [2.0.3-5]
    - Add gating.yaml from RHEL       Resolves: rhbz#bz2031865

    [2.0.3-4]
    - Add async connect call for Pacemaker       Resolves: rhbz#bz2031865

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6578 advisory.

    The libqb packages provide a library with the primary purpose of providing high performance client/server     reusable features, such as high performance logging, tracing, inter-process communication, and polling.

    Security Fix(es):

    * libqb: Buffer overflow in log_blackbox.c (CVE-2023-39976)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5597 advisory.

    The libqb packages provide a library with the primary purpose of providing high performance client/server     reusable features, such as high performance logging, tracing, inter-process communication, and polling.

    Security Fix(es):

    * libqb: Buffer overflow in log_blackbox.c (CVE-2023-39976)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3944-1 advisory.

  - log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header     size is not considered. (CVE-2023-39976)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3897-1 advisory.

  - log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header     size is not considered. (CVE-2023-39976)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:3727-1 advisory.

  - log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header     size is not considered. (CVE-2023-39976)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3728-1 advisory.

  - log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header     size is not considered. (CVE-2023-39976)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6308-1 advisory.

    It was discovered that Libqb incorrectly handled certain messages. An attacker could possibly use this     issue to cause a crash or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-294 advisory.

  - log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header     size is not considered. (CVE-2023-39976)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-5a717dd33d advisory.

    Update libqb for CVE-2023-39976

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210360	FreeBSD : libqb -- Buffer overflow (ecf9a798-9aa9-11ef-a8f0-a8a15998b5cb)	Nessus	FreeBSD Local Security Checks	critical
186063	RHEL 9 : libqb (RHSA-2023:7376)	Nessus	Red Hat Local Security Checks	critical
185843	Oracle Linux 9 : libqb (ELSA-2023-6578)	Nessus	Oracle Linux Local Security Checks	critical
185159	RHEL 9 : libqb (RHSA-2023:6578)	Nessus	Red Hat Local Security Checks	critical
182836	RHEL 9 : libqb (RHSA-2023:5597)	Nessus	Red Hat Local Security Checks	critical
182506	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libqb (SUSE-SU-2023:3944-1)	Nessus	SuSE Local Security Checks	critical
182393	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libqb (SUSE-SU-2023:3897-1)	Nessus	SuSE Local Security Checks	critical
181827	SUSE SLES15 Security Update : libqb (SUSE-SU-2023:3727-1)	Nessus	SuSE Local Security Checks	critical
181819	SUSE SLES15 / openSUSE 15 Security Update : libqb (SUSE-SU-2023:3728-1)	Nessus	SuSE Local Security Checks	critical
180223	Ubuntu 22.04 LTS / 23.04 : Libqb vulnerability (USN-6308-1)	Nessus	Ubuntu Local Security Checks	critical
180128	Amazon Linux 2023 : doxygen2man, libqb, libqb-devel (ALAS2023-2023-294)	Nessus	Amazon Linux Local Security Checks	critical
180104	Fedora 38 : libqb (2023-5a717dd33d)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2023-39976

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical