CVE-2023-36660

The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2023-06-25

Last modified

2026-10-15

Weaknesses

CWE-787

Affected products

• Nettle (Nettle Project)
• Simatic S7-1500 Tm Mfp - Gnulinux Subsystem (Siemens)

References

• https://bugzilla.suse.com/show_bug.cgi?id=1212112
• https://git.lysator.liu.se/nettle/nettle/-/commit/867a4548b95705291a3afdd66d76e7f17ba2618f
• https://git.lysator.liu.se/nettle/nettle/-/compare/nettle_3.9_release_20230514...nettle_3.9.1_release_20230601
• https://security.gentoo.org/glsa/202401-24
• https://cert-portal.siemens.com/productcert/html/ssa-794697.html