Filtered by vendor Pkgconf Subscriptions
Filtered by product Pkgconf Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-1000221 1 Pkgconf 1 Pkgconf 2024-09-17 N/A
pkgconf version 1.5.0 to 1.5.2 contains a Buffer Overflow vulnerability in dequote() that can result in dequote() function returns 1-byte allocation if initial length is 0, leading to buffer overflow. This attack appear to be exploitable via specially crafted .pc file. This vulnerability appears to have been fixed in 1.5.3.
CVE-2023-24056 1 Pkgconf 1 Pkgconf 2024-08-02 5.5 Medium
In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.