PT-2023-2366 · Unknown+2 · Netwide Assembler+2

13579And24680 · Publicado 2023-03-29 · Atualizado 2024-12-16 · CVE-2022-44370

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Netwide Assembler (NASM) version 2.16

Description The issue is related to a heap buffer overflow in the quote for pmake() function of the Netwide Assembler (NASM). This overflow can occur due to the operation exceeding the memory buffer boundaries. Exploitation of this issue may allow an attacker to execute arbitrary code.

Recommendations For Netwide Assembler (NASM) version 2.16, consider disabling the quote for pmake() function as a temporary workaround until a patch is available.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

ALT-PU-2023-1613

ALT-PU-2024-16552

ALT-PU-2024-16908

AZL-25934

BDU:2023-02141

CVE-2022-44370

OESA-2023-1245

Produtos afetados

Alt Linux

Debian

Netwide Assembler

Referências · 19

• 🔥 https://bugzilla.nasm.us/show_bug.cgi?id=3392815 · Exploit
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1245 · Nota
• https://bdu.fstec.ru/vul/2023-02141 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2022-44370 · Nota de Segurança
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.9 · Nota
• https://ubuntu.com/security/CVE-2022-44370 · Aviso do Fabricante
• https://docs.bell-sw.com/security/cves/CVE-2022-44370 · Nota
• https://osv.dev/vulnerability/BELL-CVE-2022-44370 · Aviso do Fabricante
• https://t.me/cvenotify/47607 · Publicação no Telegram
• https://security-tracker.debian.org/tracker/CVE-2022-44370 · Aviso do Fabricante
• https://t.me/cibsecurity/61152 · Publicação no Telegram
• https://osv.dev/vulnerability/OESA-2023-1245 · Aviso do Fabricante
• https://t.me/cvenotify/64878 · Publicação no Telegram
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-44370 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2022-44370 · Nota de Segurança