Paper/Archive/CVE-2023-36660

CVE-2023-36660

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem — The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.

EPSS 1%CVSS 9.8

critical.is priorityof 100

42

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 63.4.634 × 2012.7 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem< V1.1V1.1siemens-SADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refbugzilla.suse.com/show_bug.cgi?id=1212112 refgit.lysator.liu.se/nettle/nettle/-/commit/867a4548b95705291a3afdd66d76e7f17ba2618f refgit.lysator.liu.se/nettle/nettle/-/compare/nettle_3.9_release_20230514...nettle_3.9.1_release_20230601 advisorysecurity.gentoo.org/glsa/202401-24 refcert-portal.siemens.com/productcert/html/ssa-794697.html