5.5

CVE-2023-46316

In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Buc ≫ Traceroute SwPlatform linux Version >= 2.0.12 < 2.1.3
Debian ≫ Debian Linux Version 10.0
Debian ≫ Debian Linux Version 11.0
Debian ≫ Debian Linux Version 12.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.37% 0.283
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CISA-ADP 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-234 Failure to Handle Missing Parameter

If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.

http://packetstormsecurity.com/files/176660/Traceroute-2.1.2-Privilege-Escalation.html
https://security-tracker.debian.org/tracker/CVE-2023-46316
Third Party Advisory
https://sourceforge.net/projects/traceroute/files/traceroute/traceroute-2.1.3/
Release Notes