CVE-2023-28798 : An out-of-bounds write to heap in the pacparser library on Zscaler Client Connec

An out-of-bounds write to heap in the pacparser library on Zscaler Client Connector on Mac may lead to arbitrary code execution.

Published 2024-05-02 13:23:06

Updated 2024-05-02 13:27:25

Source Zscaler, Inc.

View at NVD, CVE.org

Vulnerability category: Overflow

Products affected by CVE-2023-28798

Please log in to view affected product information.

EPSS FAQ

0.21%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 44 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.5	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L	2.2	3.7	Zscaler, Inc.	2024-05-02
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Changed Confidentiality: Low Integrity: Low Availability: Low

CWE-122 Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Assigned by: cve@zscaler.com (Secondary)

Jump to