CVE-2023-36377

Buffer Overflow vulnerability in mtrojnar osslsigncode v.2.3 and before allows a local attacker to execute arbitrary code via a crafted .exe, .sys, and .dll files.

References

Affected packages

Debian:11 / osslsigncode

Package

Name: osslsigncode
Purl: pkg:deb/debian/osslsigncode?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.1-1

2.2-1

2.3.0-1

2.4-1

2.5-1

2.5-2

2.5-3

2.5-4

2.8-1

2.8-2

2.9-1~bpo12+1

2.9-1

2.9-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / osslsigncode

Package

Name: osslsigncode
Purl: pkg:deb/debian/osslsigncode?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.3.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / osslsigncode

Package

Name: osslsigncode
Purl: pkg:deb/debian/osslsigncode?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.3.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/mtrojnar/osslsigncode

Affected ranges

Type: GIT
Repo: https://github.com/mtrojnar/osslsigncode
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

73d7cf011e660bcee98dcfe5f9128412ac97191d

Affected versions

2.*

2.0

2.1

2.2