A vulnerability was found in MicroPython up to 1.21.0. It has been classified as critical. Affected is the function slice_indices of the file objslice.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.22.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249180.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-9f2a705459 advisory.

    Automatic update for micropython-1.22.2-1.fc41.

    ##### **Changelog**

    ```
    * Fri Mar 22 2024 Charalampos Stratakis <cstratak@redhat.com> - 1.22.2-1
    - Update to 1.22.2
    - Security fixes for CVE-2023-7158 and CVE-2023-7152
    - Fixes: rhbz#2256176, rhbz#2256178, rhbz#2259215
    * Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.21.0-3
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
    * Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.21.0-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a3b517705e advisory.

    - Update to 1.22.2
    - Security fixes for CVE-2023-7158 and CVE-2023-7152

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-34aa24af35 advisory.

    - Update to 1.22.2
    - Security fixes for CVE-2023-7158 and CVE-2023-7152


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-51e55a7065 advisory.

    - Update to 1.22.2
    - Security fixes for CVE-2023-7158 and CVE-2023-7152


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210976	Fedora 41 : micropython (2024-9f2a705459)	Nessus	Fedora Local Security Checks	critical
194510	Fedora 40 : micropython (2024-a3b517705e)	Nessus	Fedora Local Security Checks	critical
192903	Fedora 39 : micropython (2024-34aa24af35)	Nessus	Fedora Local Security Checks	critical
192902	Fedora 38 : micropython (2024-51e55a7065)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2023-7158

critical

Tenable Plugins

critical

critical

critical

critical