Stack-based buffer overflow in HtmlUnit - CVE-2023-2798
Published: June 28, 2023
Vulnerability identifier: #VU77776
CSH Severity: Medium
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-2798
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can trick the victim to visit a malicious webpage, trigger a stack overflow and perform a denial of service (DoS) attack.
Affected software
HtmlUnit
IBM Cloud Pak for Multicloud Management
Migration Toolkit for Runtimes
Red Hat Migration Toolkit for Applications
IBM Security Verify Governance
IBM Cloud Pak for Multicloud Management
Migration Toolkit for Runtimes
Red Hat Migration Toolkit for Applications
IBM Security Verify Governance
How to mitigate CVE-2023-2798
Install updates from vendor's website.
HtmlUnit - update to 2.70.0
Migration Toolkit for Runtimes - update to 1.1.1
Red Hat Migration Toolkit for Applications - update to 6.2.0
IBM Security Verify Governance - update to 10.0.2.0.2
Migration Toolkit for Runtimes - update to 1.1.1
Red Hat Migration Toolkit for Applications - update to 6.2.0
IBM Security Verify Governance - update to 10.0.2.0.2
External References
Related Security Bulletins
- Denial of service in HtmlUnit
- Multiple vulnerabilities in Migration Toolkit for Runtimes
- Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
- Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager
- Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management