CVE-2022-43634

2023-03-2919:15:20

Google

osv.dev

0.058 Low

EPSS

Percentile

93.4%

JSON

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dsi_writeinit function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17646.

CPENameOperatorVersion
netatalkeqnetatalk-3-1-5
netatalkeqnetatalk-3-1-10
netatalkeqnetatalk-3-1-4
netatalkeqnetatalk-3-1-6
netatalkeqnetatalk-3-1-8
netatalkeqnetatalk-3-1-11
netatalkeqnetatalk-3-1-9
netatalkeqnetatalk-3-1-3
netatalkeqnetatalk-3-1-12
netatalkeqnetatalk-3-1-13

Name	Operator	Version
netatalk	eq	netatalk-3-1-5
netatalk	eq	netatalk-3-1-10
netatalk	eq	netatalk-3-1-4
netatalk	eq	netatalk-3-1-6
netatalk	eq	netatalk-3-1-8
netatalk	eq	netatalk-3-1-11
netatalk	eq	netatalk-3-1-9
netatalk	eq	netatalk-3-1-3
netatalk	eq	netatalk-3-1-12
netatalk	eq	netatalk-3-1-13