CVE catalog

CVE-2023-0687

A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The mani

[CVE catalog]

Severity
Medium · CVSS 4.6CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.09% · Oct 25, 2026

A vulnerability was found in the GNU C Library. This flaw affects the __monstartup function of the gmon.c of the component Call Graph Monitor file. The manipulation leads to buffer overflow. glibc: gmon memory corruption due wrong calculation of required buffer size Red Hat Product Security does not consider this to be a vulnerability. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpeglibcNot reported2.38fixed
Opensusebinutilstumbleweed2.40-3.1fixed
Suseglibclinux enterprise micro 5.42.31-150300.46.1fixed
Suseglibclinux enterprise micro 5.32.31-150300.46.1fixed
Suseglibclinux enterprise module for basesystem 15 sp42.31-150300.46.1fixed
Suseglibclinux enterprise module for development tools 15 sp42.31-150300.46.1fixed
Suseglibclinux enterprise high performance computing 15 sp3-espos2.31-150300.46.1fixed
Suseglibclinux enterprise high performance computing 15 sp3-ltss2.31-150300.46.1fixed
Suseglibclinux enterprise real time 15 sp32.31-150300.46.1fixed
Suseglibclinux enterprise server 15 sp3-ltss2.31-150300.46.1fixed
Suseglibclinux enterprise server for sap applications 15 sp32.31-150300.46.1fixed
Suseglibcmanager proxy 4.22.31-150300.46.1fixed
Suseglibcmanager server 4.22.31-150300.46.1fixed
Suseglibclinux enterprise micro 5.12.31-150300.46.1fixed
Suseglibclinux enterprise micro 5.22.31-150300.46.1fixed
Suseglibcenterprise storage 7.12.31-150300.46.1fixed
Opensuseglibcleap micro 5.32.31-150300.46.1fixed
Opensuseglibcleap 15.42.31-150300.46.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpeglibccpeNot reported2.38Not reportedNVD-CVE-2023-0687Not reported
Opensusebinutilsrpmtumbleweed2.40-3.1Not reportedOPENSUSE-SU-2024:12816-1Not reported
Suseglibcrpmlinux enterprise micro 5.42.31-150300.46.1Not reportedSUSE-SU-2023:1718-2Not reported
Suseglibcrpmlinux enterprise micro 5.32.31-150300.46.1Not reportedSUSE-SU-2023:1718-1Not reported
Suseglibcrpmlinux enterprise module for basesystem 15 sp42.31-150300.46.1Not reportedSUSE-SU-2023:1718-1Not reported
Suseglibcrpmlinux enterprise module for development tools 15 sp42.31-150300.46.1Not reportedSUSE-SU-2023:1718-1Not reported
Suseglibcrpmlinux enterprise high performance computing 15 sp3-espos2.31-150300.46.1Not reportedSUSE-SU-2023:1718-1Not reported
Suseglibcrpmlinux enterprise high performance computing 15 sp3-ltss2.31-150300.46.1Not reportedSUSE-SU-2023:1718-1Not reported
Suseglibcrpmlinux enterprise real time 15 sp32.31-150300.46.1Not reportedSUSE-SU-2023:1718-1Not reported
Suseglibcrpmlinux enterprise server 15 sp3-ltss2.31-150300.46.1Not reportedSUSE-SU-2023:1718-1Not reported
Suseglibcrpmlinux enterprise server for sap applications 15 sp32.31-150300.46.1Not reportedSUSE-SU-2023:1718-1Not reported
Suseglibcrpmmanager proxy 4.22.31-150300.46.1Not reportedSUSE-SU-2023:1718-1Not reported
Suseglibcrpmmanager server 4.22.31-150300.46.1Not reportedSUSE-SU-2023:1718-1Not reported
Suseglibcrpmlinux enterprise micro 5.12.31-150300.46.1Not reportedSUSE-SU-2023:1718-1Not reported
Suseglibcrpmlinux enterprise micro 5.22.31-150300.46.1Not reportedSUSE-SU-2023:1718-1Not reported
Suseglibcrpmenterprise storage 7.12.31-150300.46.1Not reportedSUSE-SU-2023:1718-1Not reported
Opensuseglibcrpmleap micro 5.32.31-150300.46.1Not reportedSUSE-SU-2023:1718-1Not reported
Opensuseglibcrpmleap 15.42.31-150300.46.1Not reportedSUSE-SU-2023:1718-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [binutils-devel]Unknown

    Source package: [binutils]

    Details (1)

    • 2.45-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.40-3.1

      Version impact unknown

      nvd · binutils · opensuse · tumbleweed

  • [binutils-devel-32bit]Unknown

    Source package: [binutils]

    Details (1)

    • 2.45-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.40-3.1

      Version impact unknown

      nvd · binutils · opensuse · tumbleweed

  • [gprofng]Unknown

    Source package: [binutils]

    Details (1)

    • 2.45-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.40-3.1

      Version impact unknown

      nvd · binutils · opensuse · tumbleweed

  • [libctf0]Unknown

    Source package: [binutils]

    Details (1)

    • 2.45-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.40-3.1

      Version impact unknown

      nvd · binutils · opensuse · tumbleweed

  • [libctf-nobfd0]Unknown

    Source package: [binutils]

    Details (1)

    • 2.45-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.40-3.1

      Version impact unknown

      nvd · binutils · opensuse · tumbleweed

  • [libsframe2]Unknown

    Source package: [binutils]

    Details (1)

    • 2.45-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.40-3.1

      Version impact unknown

      nvd · binutils · opensuse · tumbleweed

  • [binutils]Fixed

    Source package: [binutils]

    Details (1)

    • 2.45-4.3 · x86_64 · tumbleweed

      Fixed · Fixed: 2.40-3.1

      nvd · binutils · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]