CVE-2023-7158
CVE-2023-7158 · MicroPython objslice.c slice_indices heap-based overflow
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A vulnerability was found in MicroPython up to 1.21.0. It has been classified as critical. Affected is the function slice_indices of the file objslice.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.22.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249180.
CVSS 7.3 · High · EPSS 1.2%
- Published
- Updated
Stack: system
Affected products and versions
micropython
- Versions
- 1.13.0: Affected
- 1.14.0: Affected
- 1.15.0: Affected
- 1.16.0: Affected
- 1.17.0: Affected
- 1.18.0: Affected
- 1.19.0: Affected
- 1.20.0: Affected
- 1.21.0: Affected
No fix published
giac Ubuntu:18.04:LTS
- Versions
- 1.2.3.57+dfsg1-2build1
- 1.2.3.57+dfsg1-2build2
- 1.2.3.57+dfsg1-2build3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
giac Ubuntu:20.04:LTS
- Versions
- 1.4.9.69+dfsg1-2build1
- 1.5.0.85+dfsg1-2
- 1.5.0.85+dfsg1-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
giac Ubuntu:22.04:LTS
- Versions
- 1.6.0.41+dfsg1-1
- 1.7.0.39+dfsg2-1build1
- 1.7.0.39+dfsg2-1build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
giac Ubuntu:24.04:LTS
- Versions
- 1.9.0.35+dfsg2-1.1
- 1.9.0.59+dfsg2-1
- 1.9.0.69+dfsg2-1
- 1.9.0.93+dfsg2-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
giac Ubuntu:25.10
- Versions
- 1.9.0.93+dfsg2-3build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
giac Ubuntu:26.10
- Versions
- 1.9.0.93+dfsg2-3build2
- 1.9.0.93+dfsg2-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
giac Ubuntu:26.04:LTS
- Versions
- 1.9.0.93+dfsg2-3build1
- 1.9.0.93+dfsg2-3build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://vuldb.com/?id.249180
- https://vuldb.com/?ctiid.249180
- https://github.com/micropython/micropython/issues/13007
- https://github.com/micropython/micropython/pull/13039
- https://github.com/micropython/micropython/pull/13039/commits/f397a3ec318f3ad05aa287764ae7cef32202380f
- https://github.com/micropython/micropython/releases/tag/v1.22.0
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TEK46QAJOXXDZOWOIE2YACUOCZFWOBCK/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4E2HYWCZB5R4SHY4SZZZSFDMD64N4SOZ/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/D3WWY5JY4RTJE25APB4REGDUDPATG6H7/
- https://nvd.nist.gov/vuln/detail/CVE-2023-7158