CVE-2023-4016: fedoraproject fedora Heap-based Buffer Overflow
CVSS: 3.3v3.1LowModified
AliasesALPINE-CVE-2023-4016SUSE-SU-2023:3471-1SUSE-SU-2023:3472-1SUSE-SU-2025:0725-1SUSE-SU-2025:0741-1SUSE-SU-2025:20180-1RHSA-2023:6705RHSA-2023:7187UBUNTU-CVE-2023-4016USN-6477-1DEBIAN-CVE-2023-4016
Published 02-08-2023Last modified 14-10-2026
Vulnerability summary
CVE-2023-4016 is a low (CVSS 3.3) Heap-based Buffer Overflow vulnerability in fedoraproject fedora. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.8% of scored vulnerabilities.
CVSS score
3.3/10
010
Low · v3.1 (NVD)EPSS score
0.29%
0%100%
Low · +0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 02-08-2023PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap.
CVSS metrics
6 scores · 6 sources · 1 versionLow 3.3Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LSources6 sources · 2.5–3.3
- CVE.orgCNA2.5LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · AlpineEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- OSV · Red hatEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- OSV · UbuntuEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
21%
Versus all other CVEs
30-day change
+0.04 pp
From 0.26% on 19-09-2026
19-09-202619-10-2026
EPSS score0.29%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Suse30 products
- procps&distro=SUSE Enterprise Storage 7.1< 3.3.17-150000.7.42.1
- procps&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 3.3.17-150000.7.42.1
- procps&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 3.3.17-150000.7.42.1
- procps&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 3.3.17-150000.7.42.1
- procps&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 3.3.17-150000.7.42.1
Opensuse5 products
- procps&distro=openSUSE Leap 15.4< 3.3.15-150000.7.34.1
- procps&distro=openSUSE Leap 15.5< 3.3.15-150000.7.34.1
- procps&distro=openSUSE Leap 15.6< 3.3.17-150000.7.42.1
- procps&distro=openSUSE Leap Micro 5.3< 3.3.15-150000.7.34.1
- procps&distro=openSUSE Leap Micro 5.4< 3.3.15-150000.7.34.1
Redhat5 products
- procps-ng< 0:3.3.17-13.el9 | < 0:3.3.15-14.el8
- procps-ng-debuginfo< 0:3.3.17-13.el9 | < 0:3.3.15-14.el8
- procps-ng-debugsource< 0:3.3.17-13.el9 | < 0:3.3.15-14.el8
- procps-ng-devel< 0:3.3.17-13.el9 | < 0:3.3.15-14.el8
- procps-ng-i18n< 0:3.3.17-13.el9 | < 0:3.3.15-14.el8
Alpine2 products
- procps≥ 3.3.0, < 3.3.17-r1 | ≥ 3.3.0, < 3.3.17-r2 | ≥ 3.3.0, < 3.3.17-r3
- procps-ng< 4.0.4-r0
Debian1 product
- procpsAll versions (No fix recorded) | < 2:4.0.4-1
Fedoraproject1 product
- fedoraEOL38
Linux1 product
- linux kernal3.3.0 (might be earlier) - latest
Procps_project1 product
- procps≥ 3.3.0, ≤ 4.0.3
Ubuntu1 product
- procpsAll versions (No fix recorded) | < 2:3.3.10-4ubuntu2.5+esm1 | < 2:3.3.12-3ubuntu1.2+esm1 | < 2:3.3.16-1ubuntu2.4 | < 2:3.3.17-6ubuntu2.1
9 vendors · 47 products
References
30 links- gitlab.com/procps-ng/procpsProduct
