PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-6780 Fedoraproject CVE debrief

CVE-2023-6780 is a medium-severity issue in glibc's __vsyslog_internal path, which is used by syslog and vsyslog. According to the CVE record, very long log messages can cause an incorrect buffer-size calculation, leading to undefined behavior. The NVD data maps affected glibc releases to 2.37 through before 2.39, which means 2.37 and 2.38 are in scope in the supplied corpus.

Vendor
Fedoraproject
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2025-06-10
Original CVE updated
2026-05-14
Advisory published
2025-06-10
Advisory updated
2026-05-14

Who should care

Linux distribution maintainers, system administrators, and application owners running affected glibc releases, especially systems that call syslog or vsyslog and may process unusually long or untrusted log messages.

Technical summary

NVD describes an integer overflow in __vsyslog_internal, the internal glibc function behind syslog and vsyslog. When these APIs are called with a very long message, the code can miscalculate the buffer size needed to store the message, resulting in undefined behavior. The NVD record assigns CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L and lists CWE-131 and CWE-190 as weaknesses. The vulnerable glibc range in the supplied CPE criteria starts at 2.37 and ends before 2.39.

Defensive priority

Medium

Recommended defensive actions

  • Inventory systems using glibc 2.37 or 2.38 and confirm whether vendor packages are updated.
  • Apply the relevant vendor or distribution security updates for glibc.
  • Review any code or services that pass very large messages into syslog/vsyslog, especially where input may be externally influenced.
  • Monitor vendor advisories and package announcements referenced by NVD for backported fixes and packaging guidance.
  • Treat this as a stability and availability issue first; prioritize faster remediation on production systems that aggregate logs from untrusted sources.

Evidence notes

This debrief is based on the supplied NVD CVE record and its linked advisories. The record states the flaw is an integer overflow in __vsyslog_internal, reachable via syslog/vsyslog with very long messages. The NVD metadata includes CVSS 5.3, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, and weaknesses CWE-131 and CWE-190. The reference set includes Red Hat, Bugzilla, Fedora package announcements, Gentoo GLSA, and public third-party write-ups cited by NVD. No KEV entry is present in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-6780 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-6780

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-6780 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-6780

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.