Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2023-36328

critical

CVE-2023-36328

Integer Overflow vulnerability in mp_grow in libtom libtommath before ...

Published Modified CWE 190
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, Azure Linux, CBL-Mariner. Rated lower by Amazon (medium), Ubuntu (medium).

Description

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Affected packages and fixed versions

SourcePackageFixed in
Azure Linux 3.0libtommath, tcl0:1.1.0-5.azl3 and 1 more
CBL-Mariner 2.0libtommath, tcl0:1.1.0-5.cm2 and 1 more
alpine 3.23libtommath1.2.1-r0
alpine 3.24libtommath1.2.1-r0
alpine edgelibtommath1.2.1-r0
amazon linux 2023libtommath, libtommath-debuginfo, libtommath-debugsource and 2 more1.2.0-62.amzn2023.0.1
conan::GitLab Advisory Database Communitylibtommath1.2.1
debian 10libtommathno fix listed
debian 11libtommath1.2.0-6+deb11u1
debian 12libtommath1.2.0-6+deb12u1
debian 13libtommath1.2.1-1
debian 14libtommath1.2.1-1
Show all 29 entries from 21 sources
SourcePackageFixed in
Azure Linux 3.0libtommath0:1.1.0-5.azl3
Azure Linux 3.0tcl0:8.6.13-3.azl3
CBL-Mariner 2.0libtommath0:1.1.0-5.cm2
CBL-Mariner 2.0tcl0:8.6.13-2.cm2
alpine 3.23libtommath1.2.1-r0
alpine 3.24libtommath1.2.1-r0
alpine edgelibtommath1.2.1-r0
amazon linux 2023libtommath1.2.0-62.amzn2023.0.1
amazon linux 2023libtommath-debuginfo1.2.0-62.amzn2023.0.1
amazon linux 2023libtommath-debugsource1.2.0-62.amzn2023.0.1
amazon linux 2023libtommath-devel1.2.0-62.amzn2023.0.1
amazon linux 2023libtommath-doc1.2.0-62.amzn2023.0.1
conan::GitLab Advisory Database Communitylibtommath1.2.1
debian 10libtommathno fix listed
debian 11libtommath1.2.0-6+deb11u1
debian 12libtommath1.2.0-6+deb12u1
debian 13libtommath1.2.1-1
debian 14libtommath1.2.1-1
echolibtommath1.2.0-6+deb12u1
rapidfort amazon linux 2023libtommath1.2.0-62.amzn2023.0.1
rapidfort amazon linux 2023libtommath-devel1.2.0-62.amzn2023.0.1
rapidfort amazon linux 2023libtommath-doc1.2.0-62.amzn2023.0.1
ubuntu 16.04-ESMlibtommath0.42.0-1.2ubuntu0.1~esm1
ubuntu 18.04-ESMlibtommath1.0.1-1ubuntu0.1~esm1
ubuntu 20.04libtommath1.2.0-3ubuntu0.1
ubuntu 20.04-ESMlibtommath1.2.0-3ubuntu0.1
ubuntu 22.04libtommath1.2.0-6ubuntu0.22.04.1
ubuntu 23.04libtommath1.2.0-6ubuntu0.23.04.1
ubuntu 23.10libtommath1.2.0-6ubuntu0.23.10.1

References

All 10 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.