{"id":"UBUNTU-CVE-2023-46046","details":"** DISPUTED ** An issue in MiniZinc before 2.8.0 allows a NULL pointer dereference via ti_expr in a crafted .mzn file. NOTE: this is disputed because there is no common libminizinc use case in which an unattended process is supposed to run forever to process a series of atttacker-controlled .mzn files.","modified":"2024-03-27T05:15:00Z","published":"2024-03-27T05:15:00Z","withdrawn":"2025-06-23T15:56:55Z","references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-46046"},{"type":"REPORT","url":"https://github.com/MiniZinc/libminizinc/issues/730"},{"type":"REPORT","url":"http://seclists.org/fulldisclosure/2024/Jan/63"},{"type":"REPORT","url":"https://www.minizinc.org/doc-2.8.3/en/changelog.html"},{"type":"REPORT","url":"https://github.com/MiniZinc/libminizinc/commit/afe67acc20898e4308044b54c4acf7a08df544f0"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2023-46046"}],"affected":[{"package":{"name":"minizinc","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/minizinc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.8+dfsg1-1","2.0.10+dfsg1-1","2.0.11+dfsg1-1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-46046.json"}},{"package":{"name":"minizinc","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/minizinc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.14+dfsg1-1","2.1.5+dfsg1-1","2.1.7+dfsg1-1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-46046.json"}},{"package":{"name":"minizinc","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/minizinc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.7+dfsg1-1","2.4.2-1","2.4.2-1build1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-46046.json"}},{"package":{"name":"minizinc","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/minizinc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.3+dfsg1-1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-46046.json"}},{"package":{"name":"minizinc","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/minizinc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.4+dfsg1-1","2.8.2+dfsg1-1","2.8.2+dfsg1-1build1","2.8.2+dfsg1-1build2"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-46046.json"}}],"schema_version":"1.7.3"}