Vulnerability Details : CVE-2023-42799
Potential exploit
Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code execution (RCE) on the client (with insufficient exploit mitigations or if mitigations can be bypassed). The bug was addressed in commit 02b7742f4d19631024bd766bd2bb76715780004e.
Vulnerability category: OverflowExecute code
Products affected by CVE-2023-42799
- Moonlight-stream » Moonlight » For AndroidVersions from including (>=) 10.10 and up to, including, (<=) 11.0cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:android:*:*
- Moonlight-stream » Moonlight » For Iphone OsVersions from including (>=) 8.4.0 and up to, including, (<=) 8.5.0cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:iphone_os:*:*
- Moonlight-stream » Moonlight » For TvosVersions from including (>=) 8.4.0 and up to, including, (<=) 8.5.0cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:tvos:*:*
- cpe:2.3:a:moonlight-stream:moonlight:0.10.22:*:*:*:*:chrome:*:*
- Moonlight-stream » Moonlight-common-cVersions from including (>=) 2022-11-04 and before (<) 2023-10-06cpe:2.3:a:moonlight-stream:moonlight-common-c:*:*:*:*:*:*:*:*
- cpe:2.3:a:moonlight-stream:moonlight_embedded:2.6.0:*:*:*:*:*:*:*
- Moonlight-stream » Moonlight XboxVersions from including (>=) 1.12.0 and up to, including, (<=) 1.14.40cpe:2.3:a:moonlight-stream:moonlight_xbox:*:*:*:*:*:*:*:*
- Moonlight-stream » Moonlight TvVersions from including (>=) 1.5.4 and up to, including, (<=) 1.5.27cpe:2.3:a:moonlight-stream:moonlight_tv:*:*:*:*:*:*:*:*
- Moonlight-stream » Moonlight SwitchVersions from including (>=) 0.13 and up to, including, (<=) 0.13.3cpe:2.3:a:moonlight-stream:moonlight_switch:*:*:*:*:*:*:*:*
- Moonlight-stream » Moonlight VitaVersions from including (>=) 0.9.2 and up to, including, (<=) 0.9.3cpe:2.3:a:moonlight-stream:moonlight_vita:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-42799
0.87%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 82 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-42799
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
GitHub, Inc. |
CWE ids for CVE-2023-42799
-
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.Assigned by: security-advisories@github.com (Primary)
References for CVE-2023-42799
-
https://github.com/moonlight-stream/moonlight-common-c/commit/02b7742f4d19631024bd766bd2bb76715780004e
Fix buffer overflow in parseUrlAddrFromRtspUrlString (CVE-2023-42799) · moonlight-stream/moonlight-common-c@02b7742 · GitHubPatch
-
https://github.com/moonlight-stream/moonlight-common-c/commit/50c0a51b10ecc5b3415ea78c21d96d679e2288f9
Improve high quality audio support · moonlight-stream/moonlight-common-c@50c0a51 · GitHubPatch
-
https://github.com/moonlight-stream/moonlight-common-c/security/advisories/GHSA-r8cf-45f4-vf8m
Buffer overflow due to use of `strcpy` in `parseUrlAddrFromRtspUrlString` · Advisory · moonlight-stream/moonlight-common-c · GitHubExploit;Third Party Advisory
Jump to