PT-2022-7067 · Unknown+1 · Open Babel+1

Claudio Bozzato · Published 2022-07-21 · Updated 2023-07-27 · CVE-2022-46291

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Open Babel versions 3.1.1 and earlier

Description The issue is related to out-of-bounds write vulnerabilities in the translationVectors parsing functionality of Open Babel, which can be triggered by a specially-crafted malformed file, potentially leading to arbitrary code execution. This vulnerability affects the MSI file format.

Recommendations For Open Babel version 3.1.1, consider disabling the translationVectors parsing functionality until a patch is available. Restrict access to the MSI file format to minimize the risk of exploitation. Avoid using malicious or untrusted files with Open Babel until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2023-07397

CVE-2022-46291

Affected Products

Debian

Open Babel

References · 11

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1666 · Exploit
• https://cve.org/CVERecord?id=CVE-2022-46291 · Security Note
• https://ubuntu.com/security/CVE-2022-46291 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46291 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46291 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-46291 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07397 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-46291 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-46291 · Vendor Advisory
• https://t.me/cvenotify/54918 · Telegram Post
• https://t.me/cvenotify/54942 · Telegram Post