Buffer overflow in libqb - CVE-2023-39976

Vulnerability identifier: #VU79803

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-39976

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in log_blackbox.c. A remote attacker can send an overly long log message tp the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

libqb
Amazon Linux AMI
Oracle Linux
SUSE Linux Enterprise High Availability Extension 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server 15 SP1 Business Critical Linux
SUSE Linux Enterprise Server 15 SP2 Business Critical Linux
SUSE Linux Enterprise Server 15 SP3 Business Critical Linux
Basesystem Module
openSUSE Leap
Ubuntu
Anolis OS
Fedora
IBM Tivoli Business Service Manager
IBM Operations Analytics Predictive Insights
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Intelligent Operations Center
WebSphere Remote Server
IBM Security Verify Governance
IBM Cloud Application Performance Management (APM)
IBM MQ
Db2 Big SQL
dashDB Local
Storage Protect Server
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libqb-tests
libqb-devel
libqb-debugsource
libqb20-debuginfo
libqb20
libqb20-32bit-debuginfo
libqb20-32bit
libqb-tools
libqb-tools-debuginfo
libqb-tests-debuginfo
doxygen2man
libqb100
libqb100-debuginfo
doxygen2man-debuginfo
libqb (Red Hat package)
libqb100 (Ubuntu package)
libqb-tools (Ubuntu package)
doxygen2man (Ubuntu package)
libqb100-32bit-debuginfo
libqb100-32bit
libqb-devel-32bit
libqb100-64bit
libqb100-64bit-debuginfo
libqb-devel-64bit
libqb
IBM DB2

Install updates from vendor's website.

libqb - update to 2.0.8
Db2 Big SQL - update to 7.6
dashDB Local - update to 11.5.9.0
libqb-tests - addressed in versions 1.0.3+20190326.a521604-150100.3.9.1, 2.0.2+20201203.def947e-150300.3.6.1, 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
libqb-devel - addressed in versions 1.0.3+20190326.a521604-150100.3.9.1, 2.0.2+20201203.def947e-150300.3.6.1, 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
libqb-debugsource - addressed in versions 1.0.3+20190326.a521604-150100.3.9.1, 2.0.2+20201203.def947e-150300.3.6.1, 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
libqb20-debuginfo - update to 1.0.3+20190326.a521604-150100.3.9.1
libqb20 - update to 1.0.3+20190326.a521604-150100.3.9.1
libqb20-32bit-debuginfo - update to 1.0.3+20190326.a521604-150100.3.9.1
libqb20-32bit - update to 1.0.3+20190326.a521604-150100.3.9.1
libqb-tools - addressed in versions 1.0.3+20190326.a521604-150100.3.9.1, 2.0.2+20201203.def947e-150300.3.6.1, 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
libqb-tools-debuginfo - addressed in versions 1.0.3+20190326.a521604-150100.3.9.1, 2.0.2+20201203.def947e-150300.3.6.1, 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
libqb-tests-debuginfo - addressed in versions 1.0.3+20190326.a521604-150100.3.9.1, 2.0.2+20201203.def947e-150300.3.6.1, 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
doxygen2man - addressed in versions 2.0.2+20201203.def947e-150300.3.6.1, 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
libqb100 - addressed in versions 2.0.2+20201203.def947e-150300.3.6.1, 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
libqb100-debuginfo - addressed in versions 2.0.2+20201203.def947e-150300.3.6.1, 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
doxygen2man-debuginfo - addressed in versions 2.0.2+20201203.def947e-150300.3.6.1, 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
libqb (Red Hat package) - addressed in versions 2.0.3-12.el9_0, 2.0.6-3.el9_2, 2.0.6-4.el9_3
libqb100 (Ubuntu package) - addressed in versions 2.0.4-1ubuntu0.2, 2.0.6-2ubuntu0.1
libqb-tools (Ubuntu package) - addressed in versions 2.0.4-1ubuntu0.2, 2.0.6-2ubuntu0.1
doxygen2man (Ubuntu package) - addressed in versions 2.0.4-1ubuntu0.2, 2.0.6-2ubuntu0.1
libqb100-32bit-debuginfo - addressed in versions 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
libqb100-32bit - addressed in versions 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
libqb-devel-32bit - addressed in versions 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
libqb100-64bit - addressed in versions 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
libqb100-64bit-debuginfo - addressed in versions 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
libqb-devel-64bit - addressed in versions 2.0.4+20211112.a2691b9-150400.4.3.1, 2.0.6+20220323.758044b-150500.3.3.1
libqb - update to 2.0.6-1
libqb-devel - update to 2.0.8-1
libqb - update to 2.0.8-1
doxygen2man - update to 2.0.8-1
libqb - update to 2.0.8-1.fc38
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
Storage Protect Server - update to 8.1.21
IBM MQ - addressed in versions 9.2.0.22, 9.3.0.16, 9.3.5
IBM DB2 - addressed in versions 11.5.7, 11.5.8

• https://github.com/ClusterLabs/libqb/pull/490
• https://github.com/ClusterLabs/libqb/commit/1bbaa929b77113532785c408dd1b41cd0521ffc8
• https://github.com/ClusterLabs/libqb/compare/v2.0.7...v2.0.8

• Remote code execution in libqb
• Fedora 38 update for libqb
• Ubuntu update for libqb
• SUSE update for libqb
• SUSE update for libqb
• SUSE update for libqb
• SUSE update for libqb
• Buffer overflow in IBM Db2
• Red Hat Enterprise Linux 9.0 Extended Update Support update for libqb
• Multiple vulnerabilities in IBM WebSphere Remote Server
• Red Hat Enterprise Linux 9 update for libqb
• Multiple vulnerabilities in IBM Intelligent Operations Center
• Multiple vulnerabilities in IBM Tivoli Business Service Manager
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in IBM Db2 shipped with IBM Security Guardium Key Lifecycle Manager
• Red Hat Enterprise Linux 9.2 Extended Update Support update for libqb
• Multiple vulnerabilities in IBM Storage Protect Server
• Multiple vulnerabilities in IBM Security Verify Governance
• Buffer overflow in IBM MQ
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM Operations Analytics Predictive Insights
• Multiple vulnerabilities in IBM dashDB Local
• Amazon Linux AMI update for libqb
• Multiple vulnerabilities in IBM Big SQL on IBM Cloud Pak for Data
• Anolis OS update for libqb