PT-2021-7465 · Shapelib+3 · Shapelib+3

Eldstal · Published 2021-12-30 · Updated 2026-01-24 · CVE-2022-0699

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions shapelib versions 1.5.0 and older

Description The issue is related to a double-free condition in the shapelib library, specifically in the contrib/shpsort.c file. This condition may allow a remote attacker to cause a denial of service or have other unspecified impact via control over malloc.

Recommendations For shapelib versions 1.5.0 and older, update to a version newer than 1.5.0 to resolve the issue. As a temporary workaround, consider restricting access to the contrib/shpsort.c file until a patch is available.

Exploit

Fix

DoS

Double Free

Use After Free

Weakness Enumeration

CWE-415

CWE-416

Related Identifiers

ALT-PU-2025-15006

AZL-28599

AZL-37034

BDU:2022-06588

CVE-2022-0699

MGASA-2022-0096

OESA-2022-1858

OPENSUSE-SU-2022:0068-1

OPENSUSE-SU-2024:11863-1

ROSA-SA-2025-2671

Affected Products

Alt Linux

Debian

Red Os

Shapelib

References · 31

• 🔥 https://github.com/OSGeo/shapelib/issues/39 · Exploit
• https://github.com/OSGeo/shapelib/commit/c75b9281a5b9452d92e1682bdfe6019a13ed819f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0699 · Security Note
• https://osv.dev/vulnerability/AZL-37034 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0096 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06588 · Security Note
• https://ubuntu.com/security/CVE-2022-0699 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0096.html · Security Note
• https://osv.dev/vulnerability/AZL-28599 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0699 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0699 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1858 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11863-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-0699 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-0699 · Vendor Advisory