Catalogo CVE

CVE-2023-36177

Snapcast vulnerability

An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.

Gravità: Medium
Published: Jan 23, 2024, 10:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 27.52% · Oct 27, 2026

Projects and upstream resources

[snapcast][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	snapcast	`0.30.0-1`	FixedDistribution-reported fixed boundary	[CVE-2023-36177]
Debiantrixie	snapcast	`0.31.0-1`	Fixed	[CVE-2023-36177]
Debiansid	snapcast	`0.30.0-1`	FixedDistribution-reported fixed boundary	[CVE-2023-36177]
Debiansid	snapcast	`0.34.0-2`	Fixed	[CVE-2023-36177]
Ubuntupro	snapcast	`0.27.0+dfsg-1ubuntu0.1~esm1`	Fixed	[USN-8767-1]Sep 16, 2026, 2:57:27 AM UTC[UBUNTU-CVE-2023-36177]Sep 15, 2026, 8:16:34 PM UTC
Debianforky	snapcast	`0.30.0-1`	FixedDistribution-reported fixed boundary	[CVE-2023-36177]
Debianforky	snapcast	`0.34.0-2`	Fixed	[CVE-2023-36177]
Debianbookworm-security	snapcast	`0.26.0+dfsg1-1+deb12u1`	Fixed	[CVE-2023-36177]
Debianbookworm	snapcast	`0.26.0+dfsg1-1+deb12u1`	FixedDistribution-reported fixed boundary	[CVE-2023-36177]

Showing 9 fix observations. All 15 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	snapcast	`0.26.0+dfsg1-1+deb12u1`	FixedDistribution-reported fixed boundary	[CVE-2023-36177]
Debianbookworm-security	snapcast	`0.26.0+dfsg1-1+deb12u1`	Fixed	[CVE-2023-36177]
Debianforky	snapcast	`0.30.0-1`	FixedDistribution-reported fixed boundary	[CVE-2023-36177]
Debianforky	snapcast	`0.34.0-2`	Fixed	[CVE-2023-36177]
Debiansid	snapcast	`0.30.0-1`	FixedDistribution-reported fixed boundary	[CVE-2023-36177]
Debiansid	snapcast	`0.34.0-2`	Fixed	[CVE-2023-36177]
Debiantrixie	snapcast	`0.30.0-1`	FixedDistribution-reported fixed boundary	[CVE-2023-36177]
Debiantrixie	snapcast	`0.31.0-1`	Fixed	[CVE-2023-36177]
Ubuntunoble	snapcast	`0.27.0+dfsg-1ubuntu0.1~esm1`	UnknownSource applicability is not established	Provider not reported
Ubuntunoble	snapclient	`0.27.0+dfsg-1ubuntu0.1~esm1`	UnknownSource applicability is not established	Provider not reported
Ubuntunoble	snapserver	`0.27.0+dfsg-1ubuntu0.1~esm1`	UnknownSource applicability is not established	Provider not reported
Ubuntupro	snapcast	`0.27.0+dfsg-1`	Affected	[USN-8767-1]Sep 16, 2026, 2:57:27 AM UTC[UBUNTU-CVE-2023-36177]Sep 15, 2026, 8:16:34 PM UTC
Ubuntupro	snapcast	`0.27.0+dfsg-1build1`	Affected	[USN-8767-1]Sep 16, 2026, 2:57:27 AM UTC[UBUNTU-CVE-2023-36177]Sep 15, 2026, 8:16:34 PM UTC
Ubuntupro	snapcast	`0.27.0+dfsg-1build2`	Affected	[USN-8767-1]Sep 16, 2026, 2:57:27 AM UTC[UBUNTU-CVE-2023-36177]Sep 15, 2026, 8:16:34 PM UTC
Ubuntupro	snapcast	`0.27.0+dfsg-1ubuntu0.1~esm1`	Fixed	[USN-8767-1]Sep 16, 2026, 2:57:27 AM UTC[UBUNTU-CVE-2023-36177]Sep 15, 2026, 8:16:34 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "snapcast",
      "status": "fixed",
      "release": "sid",
      "version": "0.34.0-2"
    },
    {
      "name": "snapcast",
      "status": "fixed",
      "release": "forky",
      "version": "0.34.0-2"
    },
    {
      "name": "snapcast",
      "status": "fixed",
      "release": "trixie",
      "version": "0.31.0-1"
    },
    {
      "name": "snapcast",
      "status": "fixed",
      "release": "bookworm",
      "version": "0.26.0+dfsg1-1+deb12u1"
    },
    {
      "name": "snapcast",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "0.26.0+dfsg1-1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "snapcast",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "0.30.0-1"
    },
    {
      "bug": null,
      "name": "snapcast",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "0.30.0-1"
    },
    {
      "bug": null,
      "name": "snapcast",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "0.30.0-1"
    },
    {
      "bug": null,
      "name": "snapcast",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "0.26.0+dfsg1-1+deb12u1"
    }
  ],
  "distribution_packages": [
    {
      "name": "snapcast",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "0.27.0+dfsg-1ubuntu0.1~esm1",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "0.27.0+dfsg-1ubuntu0.1~esm1",
      "applicability_unknown": true
    },
    {
      "name": "snapclient",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "0.27.0+dfsg-1ubuntu0.1~esm1",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "0.27.0+dfsg-1ubuntu0.1~esm1",
      "applicability_unknown": true
    },
    {
      "name": "snapserver",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "0.27.0+dfsg-1ubuntu0.1~esm1",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "0.27.0+dfsg-1ubuntu0.1~esm1",
      "applicability_unknown": true
    },
    {
      "name": "snapcast",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.27.0+dfsg-1ubuntu0.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "0.27.0+dfsg-1",
        "0.27.0+dfsg-1build1",
        "0.27.0+dfsg-1build2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-8767-1",
      "fixed_version": "0.27.0+dfsg-1ubuntu0.1~esm1",
      "provider_source": "pypi",
      "provider_record_id": "USN-8767-1",
      "provider_updated_at": "2026-09-16T02:57:27.437790819Z"
    },
    {
      "name": "snapcast",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.27.0+dfsg-1ubuntu0.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "0.27.0+dfsg-1",
        "0.27.0+dfsg-1build1",
        "0.27.0+dfsg-1build2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-36177",
      "fixed_version": "0.27.0+dfsg-1ubuntu0.1~esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-36177",
      "provider_updated_at": "2026-09-15T20:16:34.757836377Z"
    }
  ]
}

OpenFactory catalog packages

L’associazione dei pacchetti è in corso.

[Debian 12 (Bookworm)]

[snapclient]Sconosciuto
Pacchetto sorgente: [snapcast]
Dettagli (6)
- 0.26.0+dfsg1-1+deb12u1 · amd64 · bookworm
  Corretta · Corretta: 0.26.0+dfsg1-1+deb12u1
  usn · snapcast · debian · bookworm; usn · snapcast · debian · 12
- 0.26.0+dfsg1-1+deb12u1 · arm64 · bookworm
  Corretta · Corretta: 0.26.0+dfsg1-1+deb12u1
  usn · snapcast · debian · bookworm; usn · snapcast · debian · 12
- 0.30.0-1~bpo12+1 · amd64 · bookworm-backports
  Corretta · Corretta: 0.26.0+dfsg1-1+deb12u1
  usn · snapcast · debian · bookworm; usn · snapcast · debian · 12
- 0.30.0-1~bpo12+1 · arm64 · bookworm-backports
  Corretta · Corretta: 0.26.0+dfsg1-1+deb12u1
  usn · snapcast · debian · bookworm; usn · snapcast · debian · 12
- 0.26.0+dfsg1-1+deb12u1 · amd64 · bookworm-security
  Corretta · Corretta: 0.26.0+dfsg1-1+deb12u1
  usn · snapcast · debian · bookworm; usn · snapcast · debian · 12
- 0.26.0+dfsg1-1+deb12u1 · arm64 · bookworm-security
  Corretta · Corretta: 0.26.0+dfsg1-1+deb12u1
  usn · snapcast · debian · bookworm; usn · snapcast · debian · 12
[snapserver]Sconosciuto
Pacchetto sorgente: [snapcast]
Dettagli (6)
- 0.26.0+dfsg1-1+deb12u1 · amd64 · bookworm
  Corretta · Corretta: 0.26.0+dfsg1-1+deb12u1
  usn · snapcast · debian · bookworm; usn · snapcast · debian · 12
- 0.26.0+dfsg1-1+deb12u1 · arm64 · bookworm
  Corretta · Corretta: 0.26.0+dfsg1-1+deb12u1
  usn · snapcast · debian · bookworm; usn · snapcast · debian · 12
- 0.30.0-1~bpo12+1 · amd64 · bookworm-backports
  Corretta · Corretta: 0.26.0+dfsg1-1+deb12u1
  usn · snapcast · debian · bookworm; usn · snapcast · debian · 12
- 0.30.0-1~bpo12+1 · arm64 · bookworm-backports
  Corretta · Corretta: 0.26.0+dfsg1-1+deb12u1
  usn · snapcast · debian · bookworm; usn · snapcast · debian · 12
- 0.26.0+dfsg1-1+deb12u1 · amd64 · bookworm-security
  Corretta · Corretta: 0.26.0+dfsg1-1+deb12u1
  usn · snapcast · debian · bookworm; usn · snapcast · debian · 12
- 0.26.0+dfsg1-1+deb12u1 · arm64 · bookworm-security
  Corretta · Corretta: 0.26.0+dfsg1-1+deb12u1
  usn · snapcast · debian · bookworm; usn · snapcast · debian · 12

[Debian 13 (Trixie)]

[snapclient]Sconosciuto
Pacchetto sorgente: [snapcast]
Dettagli (2)
- 0.31.0-1 · amd64 · trixie
  Corretta · Corretta: 0.30.0-1
  usn · snapcast · debian · 13
- 0.31.0-1 · arm64 · trixie
  Corretta · Corretta: 0.30.0-1
  usn · snapcast · debian · 13
[snapserver]Sconosciuto
Pacchetto sorgente: [snapcast]
Dettagli (2)
- 0.31.0-1 · amd64 · trixie
  Corretta · Corretta: 0.30.0-1
  usn · snapcast · debian · 13
- 0.31.0-1 · arm64 · trixie
  Corretta · Corretta: 0.30.0-1
  usn · snapcast · debian · 13

Osservato: Oct 28, 2026, 5:39:07 PM UTC

Riferimenti

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Ubuntu Security Notices (USN)]