PT-2022-13752 · Libde265+3 · Libde265+3

Published 2022-04-06 · Updated 2024-02-08 · CVE-2022-1253

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libde265 versions prior to 1.0.11

Description A Heap-based Buffer Overflow issue has been identified in the libde265 library. The issue is related to a buffer overflow, which can be exploited. The fix for this issue is established in a specific commit, but it has not been included in an official release yet.

Recommendations For versions prior to 1.0.11, update to version 1.0.11 to fix the security issues.

Exploit

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

ALT-PU-2022-3124

ALT-PU-2023-2045

ALT-PU-2023-2046

ALT-PU-2023-5125

CVE-2022-1253

DSA-5346-1

MGASA-2023-0093

USN-6627-1

Affected Products

Alt Linux

Linuxmint

Ubuntu

Libde265

References · 43

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1253.json · Exploit
• 🔥 https://huntr.dev/bounties/1-other-strukturag/libde265 · Exploit
• https://github.com/strukturag/libde265/commit/8e89fe0e175d2870c39486fdd09250b230ec10b8 · Patch
• https://debian.org/lts/security/2022/dla-3240 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43237 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-1253 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0093 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43241 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1253 · Security Note
• https://ubuntu.com/security/CVE-2022-43239 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-36410 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43235 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43253 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43238 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-35452 · Vendor Advisory