Veracode Vulnerability DatabaseVERACODE:35559Heap-based Buffer Overflow
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
0.0004 Low
EPSS
Percentile
8.4%
fribidi:edge is vulnerable to heap-based buffer overflow. The fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file allows an attacker to pass a specially crafted file to the Fribidi application with the ‘–caprtl’ option, leading to a crash and causing a denial of service.
References
access.redhat.com/errata/RHSA-2022:7514
access.redhat.com/errata/RHSA-2022:8011
access.redhat.com/security/cve/CVE-2022-25309
bugzilla.redhat.com/show_bug.cgi?id=2047896
github.com/fribidi/fribidi/commit/f22593b82b5d1668d1997dbccd10a9c31ffea3b3
github.com/fribidi/fribidi/issues/182
secdb.alpinelinux.org/edge/main.yaml
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
0.0004 Low
EPSS
Percentile
8.4%