PT-2022-6880 · File+6 · File+6

Amir Bazine + 6 · Published 2022-01-21 · Updated 2024-07-18 · CVE-2022-48554

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions File versions prior to 5.43

Description The issue is related to a stack-based buffer over-read in the file copystr function in funcs.c, which can lead to a denial of service when a specially crafted file is used. This can be exploited by an attacker to cause service disruption.

Recommendations For versions prior to 5.43, update to version 5.43 or later to resolve the issue. As a temporary workaround, consider restricting the use of the file copystr function in funcs.c until a patch is available.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2024:2512

AZL-28055

BDU:2023-05320

CVE-2022-48554

DSA-5489-1

INFSA-2024_2512

MGASA-2023-0268

OESA-2023-1574

RHSA-2024:2512

RHSA-2024_2512

RLSA-2024:2512

USN-6359-1

Affected Products

Almalinux

File

Linuxmint

Apple Macos

Red Hat

Rocky Linux

Ubuntu

References · 46

• 🔥 https://bugs.astron.com/view.php?id=310 · Exploit
• https://linux.oracle.com/errata/ELSA-2024-2512.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0268 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-48554 · Security Note
• https://bdu.fstec.ru/vul/2023-05320 · Security Note
• https://osv.dev/vulnerability/RLSA-2024:2512 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6359-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48554 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6359-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48554 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2024:2512 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48554 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48554 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48554 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1574 · Vendor Advisory