In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-pkgconf | Mar 26, 2024 | Jan 22, 2023 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-libpkgconfamazon-linux-2023-upgrade-libpkgconf-debuginfoamazon-linux-2023-upgrade-libpkgconf-develamazon-linux-2023-upgrade-pkgconfamazon-linux-2023-upgrade-pkgconf-debuginfoamazon-linux-2023-upgrade-pkgconf-debugsourceamazon-linux-2023-upgrade-pkgconf-m4amazon-linux-2023-upgrade-pkgconf-pkg-config | Feb 17, 2025 | Jan 21, 2023 | |
| Debian | debian-upgrade-pkgconf | Jul 30, 2024 | Jan 22, 2023 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-pkgconf | Mar 20, 2023 | Jan 22, 2023 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-pkgconf | May 8, 2023 | Jan 22, 2023 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-libpkgconfhuawei-euleros-2_0_sp8-upgrade-pkgconfhuawei-euleros-2_0_sp8-upgrade-pkgconf-m4huawei-euleros-2_0_sp8-upgrade-pkgconf-pkg-config | Apr 13, 2023 | Jan 22, 2023 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-pkgconf | May 10, 2023 | Jan 22, 2023 | |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Jan 22, 2023 |
| Suse | — | suse-upgrade-libpkgconf-develsuse-upgrade-libpkgconf3suse-upgrade-pkgconf | Feb 13, 2023 | Jan 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub