PT-2023-6724 · Unknown+1 · Open Babel+1

Claudio Bozzato · Published 2023-07-21 · Updated 2023-07-27 · CVE-2022-46294

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Open Babel versions 3.1.1 and master commit 530dbfa3

Description The issue is related to out-of-bounds write vulnerabilities in the translationVectors parsing functionality. This can be triggered by a specially-crafted malformed file, potentially leading to arbitrary code execution. An attacker can exploit this by providing a malicious file. The vulnerability affects the MOPAC Cartesian file format.

Recommendations For Open Babel version 3.1.1, consider disabling the translationVectors parsing functionality until a patch is available. For Open Babel master commit 530dbfa3, restrict the use of the affected MOPAC Cartesian file format to minimize the risk of exploitation. Avoid using malicious or untrusted files with the affected software until the issue is resolved.

Exploit

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2023-07499

CVE-2022-46294

Affected Products

Debian

Open Babel

References · 11

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1666 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-46294 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-46294 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46294 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46294 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07499 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-46294 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-46294 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-46294 · Vendor Advisory
• https://t.me/cvenotify/54948 · Telegram Post
• https://t.me/cvenotify/54914 · Telegram Post