CVE catalog

CVE-2023-4156

gawk: CVE-2023-4156

[CVE catalog]

Severity
Low · CVSS 3.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.41% · Oct 25, 2026

A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangawksid1:5.3.2-1fixed
Debiangawkforky1:5.3.2-1fixed
Debiangawktrixie1:5.2.1-2fixed
Debiangawkbookworm1:5.2.1-2fixed
Ubuntugawkpro1:4.1.4+dfsg-1vulnerable
Ubuntugawkpro1:4.1.4+dfsg-1build1vulnerable
Ubuntugawkpro1:4.1.4+dfsg-1ubuntu0.1~esm1fixed
Ubuntugawk20.041:4.2.1+dfsg-1.1build1vulnerable
Ubuntugawk20.041:5.0.1+dfsg-1vulnerable
Ubuntugawk20.041:5.0.1+dfsg-1ubuntu0.1fixed
Ubuntugawk22.041:5.1.0-1build1vulnerable
Ubuntugawk22.041:5.1.0-1build2vulnerable
Ubuntugawk22.041:5.1.0-1build3vulnerable
Ubuntugawk22.041:5.1.0-1ubuntu0.1fixed
Susegawklinux enterprise micro 5.34.2.1-150000.3.3.1fixed
Susegawklinux enterprise micro 5.44.2.1-150000.3.3.1fixed
Susegawklinux enterprise module for basesystem 15 sp44.2.1-150000.3.3.1fixed
Susegawklinux enterprise module for basesystem 15 sp54.2.1-150000.3.3.1fixed
Susegawkmanager proxy 4.24.2.1-150000.3.3.1fixed
Susegawkmanager server 4.24.2.1-150000.3.3.1fixed
Susegawklinux enterprise micro 5.14.2.1-150000.3.3.1fixed
Susegawklinux enterprise micro 5.24.2.1-150000.3.3.1fixed
Opensusegawkleap micro 5.34.2.1-150000.3.3.1fixed
Opensusegawkleap micro 5.44.2.1-150000.3.3.1fixed
Opensusegawkleap 15.44.2.1-150000.3.3.1fixed
Opensusegawkleap 15.54.2.1-150000.3.3.1fixed
Ubuntugawkpro1:4.1.4+dfsg-1vulnerable
Ubuntugawkpro1:4.1.4+dfsg-1build1vulnerable
Ubuntugawkpro1:4.1.4+dfsg-1ubuntu0.1~esm1fixed
Ubuntugawk20.041:4.2.1+dfsg-1.1build1vulnerable
Ubuntugawk20.041:5.0.1+dfsg-1vulnerable
Ubuntugawk20.041:5.0.1+dfsg-1ubuntu0.1fixed
Ubuntugawk22.041:5.1.0-1build1vulnerable
Ubuntugawk22.041:5.1.0-1build2vulnerable
Ubuntugawk22.041:5.1.0-1build3vulnerable
Ubuntugawk22.041:5.1.0-1ubuntu0.1fixed
Susegawklinux enterprise server 12 sp54.1.0-5.3.1fixed
Susegawklinux enterprise server for sap applications 12 sp54.1.0-5.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangawksourcesid1:5.2.1-1not yet assignedNot reportedNot reported
Debiangawksourceforky1:5.2.1-1not yet assignedNot reportedNot reported
Debiangawksourcetrixie1:5.2.1-1not yet assignedNot reportedNot reported
Debiangawksourcebookworm1:5.2.1-1not yet assignedNot reportedNot reported
Ubuntugawkdebpro1:4.1.4+dfsg-1ubuntu0.1~esm1Not reportedUSN-6373-1Not reported
Ubuntugawkdeb20.041:5.0.1+dfsg-1ubuntu0.1Not reportedUSN-6373-1Not reported
Ubuntugawkdeb22.041:5.1.0-1ubuntu0.1Not reportedUSN-6373-1Not reported
Susegawkrpmlinux enterprise micro 5.34.2.1-150000.3.3.1Not reportedSUSE-SU-2023:3440-1Not reported
Susegawkrpmlinux enterprise micro 5.44.2.1-150000.3.3.1Not reportedSUSE-SU-2023:3440-1Not reported
Susegawkrpmlinux enterprise module for basesystem 15 sp44.2.1-150000.3.3.1Not reportedSUSE-SU-2023:3440-1Not reported
Susegawkrpmlinux enterprise module for basesystem 15 sp54.2.1-150000.3.3.1Not reportedSUSE-SU-2023:3440-1Not reported
Susegawkrpmmanager proxy 4.24.2.1-150000.3.3.1Not reportedSUSE-SU-2023:3440-1Not reported
Susegawkrpmmanager server 4.24.2.1-150000.3.3.1Not reportedSUSE-SU-2023:3440-1Not reported
Susegawkrpmlinux enterprise micro 5.14.2.1-150000.3.3.1Not reportedSUSE-SU-2023:3440-1Not reported
Susegawkrpmlinux enterprise micro 5.24.2.1-150000.3.3.1Not reportedSUSE-SU-2023:3440-1Not reported
Opensusegawkrpmleap micro 5.34.2.1-150000.3.3.1Not reportedSUSE-SU-2023:3440-1Not reported
Opensusegawkrpmleap micro 5.44.2.1-150000.3.3.1Not reportedSUSE-SU-2023:3440-1Not reported
Opensusegawkrpmleap 15.44.2.1-150000.3.3.1Not reportedSUSE-SU-2023:3440-1Not reported
Opensusegawkrpmleap 15.54.2.1-150000.3.3.1Not reportedSUSE-SU-2023:3440-1Not reported
Ubuntugawkdebpro1:4.1.4+dfsg-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2023-4156Not reported
Ubuntugawkdeb20.041:5.0.1+dfsg-1ubuntu0.1Not reportedUBUNTU-CVE-2023-4156Not reported
Ubuntugawkdeb22.041:5.1.0-1ubuntu0.1Not reportedUBUNTU-CVE-2023-4156Not reported
Susegawkrpmlinux enterprise server 12 sp54.1.0-5.3.1Not reportedSUSE-SU-2023:3431-1Not reported
Susegawkrpmlinux enterprise server for sap applications 12 sp54.1.0-5.3.1Not reportedSUSE-SU-2023:3431-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]