In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade pkgconf | Mar 26, 2024 | Jan 22, 2023 |
| Amazon_linux_2023 | — | Upgrade pkgconf-debugsourceUpgrade pkgconf-m4Upgrade pkgconf-debuginfoUpgrade libpkgconfUpgrade pkgconf-pkg-configUpgrade libpkgconf-develUpgrade libpkgconf-debuginfoUpgrade pkgconf | Feb 17, 2025 | Jan 21, 2023 |
| Debian | — | Upgrade pkgconf | Jul 30, 2024 | Jan 22, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade pkgconf | Mar 20, 2023 | Jan 22, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade pkgconf | May 8, 2023 | Jan 22, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade pkgconf-m4Upgrade libpkgconfUpgrade pkgconf-pkg-configUpgrade pkgconf | Apr 13, 2023 | Jan 22, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade pkgconf | May 10, 2023 | Jan 22, 2023 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 22, 2023 |
| Suse | — | Upgrade libpkgconf3Upgrade libpkgconf-develUpgrade pkgconf | Feb 13, 2023 | Jan 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub