CVE-2022-25309
published 2022-09-06CVE-2022-25309: A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c…
PriorityP420medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.48%
38.2th percentile
A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | fribidi | < fribidi 1.0.8-2.1 (bookworm) | fribidi 1.0.8-2.1 (bookworm) |
| gnu | fribidi | < 1.0.12 | 1.0.12 |
| gnu | fribidi | — | — |
| gnu | fribidi | >= 0 < 1.0.8-2+deb11u1 | 1.0.8-2+deb11u1 |
| gnu | fribidi | >= 0 < 1.0.8-2.1 | 1.0.8-2.1 |
| gnu | fribidi | >= 0 < 1.0.8-2.1 | 1.0.8-2.1 |
| gnu | fribidi | >= 0 < 1.0.8-2.1 | 1.0.8-2.1 |
| gnu | fribidi | >= 0 < 0.19.7-2ubuntu0.1 | 0.19.7-2ubuntu0.1 |
| gnu | fribidi | >= 0 < 1.0.8-2ubuntu0.1 | 1.0.8-2ubuntu0.1 |
| gnu | fribidi | >= 0 < 1.0.8-2ubuntu3.1 | 1.0.8-2ubuntu3.1 |
| gnu | fribidi | >= 0 < 0.19.7-1ubuntu0.1~esm1 | 0.19.7-1ubuntu0.1~esm1 |
| msrc | cbl2_fribidi_1.0.12-1_on_cbl_mariner_2.0 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
FriBidi vulnerabilities
vendor_ubuntu·2023-03-06·CVSS 7.8
CVE-2022-25308 [HIGH] FriBidi vulnerabilities
Title: FriBidi vulnerabilities
Summary: Several security issues were fixed in fribidi.
It was discovered that FriBidi incorrectly handled the processing of input
strings, resulting in memory corruption. An attacker could possibly use this
issue to cause FriBidi to crash, resulting in a denial of service, or
potentially execute arbitrary code. (CVE-2022-25308)
It was discovered that FriBidi incorrectly validated input data to its CapRTL
unicode encoder, resulting in memory corruption. An attacker could possibly
use this issue to cause FriBidi to crash, resulting in a denial of service, or
potentially execute arbitrary code. (CVE-2022-25309)
It was discovered that FriBidi incorrectly handled empty input when removing
marks from unicode strings. An attacker could possibly use this to caus
Microsoft
A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a
vendor_msrc·2022-09-13·CVSS 5.5
CVE-2022-25309 [MEDIUM] CWE-122 A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a
A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option leading to a crash and causing a denial of service.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF
Ubuntu
FriBidi vulnerabilities
vendor_ubuntu·2022-04-27·CVSS 7.8
CVE-2022-25310 [HIGH] FriBidi vulnerabilities
Title: FriBidi vulnerabilities
Summary: Several security issues were fixed in fribidi.
USN-5366-1 fixed several vulnerabilities in FriBidi. This update provides the
corresponding updates for Ubuntu 22.04 LTS.
Original advisory details:
It was discovered that FriBidi incorrectly handled processing of input strings
resulting in memory corruption. An attacker could use this issue to cause
FriBidi to crash, resulting in a denial of service, or potentially execute
arbitrary code. (CVE-2022-25308)
It was discovered that FriBidi incorrectly validated input data to its CapRTL
unicode encoder, resulting in memory corruption. An attacker could use this
issue to cause FriBidi to crash, resulting in a denial of service, or
potentially execute arbitrary code. (CVE-2022-25309)
It was discovered th
Ubuntu
FriBidi vulnerabilities
vendor_ubuntu·2022-04-07·CVSS 7.8
CVE-2022-25310 [HIGH] FriBidi vulnerabilities
Title: FriBidi vulnerabilities
Summary: Several security issues were fixed in fribidi.
It was discovered that FriBidi incorrectly handled processing of input strings
resulting in memory corruption. An attacker could use this issue to cause
FriBidi to crash, resulting in a denial of service, or potentially execute
arbitrary code.
(CVE-2022-25308)
It was discovered that FriBidi incorrectly validated input data to its CapRTL
unicode encoder, resulting in memory corruption. An attacker could use this
issue to cause FriBidi to crash, resulting in a denial of service, or
potentially execute arbitrary code.
(CVE-2022-25309)
It was discovered that FriBidi incorrectly handled empty input when removing
marks from unicode strings, resulting in a crash. An attacker could use this
to cause FriBidi
Debian
CVE-2022-25309: fribidi - A heap-based buffer overflow flaw was found in the Fribidi package and affects t...
vendor_debian·2022·CVSS 5.5
CVE-2022-25309 [MEDIUM] CVE-2022-25309: fribidi - A heap-based buffer overflow flaw was found in the Fribidi package and affects t...
A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service.
Scope: local
bookworm: resolved (fixed in 1.0.8-2.1)
bullseye: resolved (fixed in 1.0.8-2+deb11u1)
forky: resolved (fixed in 1.0.8-2.1)
sid: resolved (fixed in 1.0.8-2.1)
trixie: resolved (fixed in 1.0.8-2.1)
Red Hat
fribidi: Heap-buffer-overflow in fribidi_cap_rtl_to_unicode
vendor_redhat·2021-12-22·CVSS 5.5
CVE-2022-25309 [MEDIUM] CWE-122 fribidi: Heap-buffer-overflow in fribidi_cap_rtl_to_unicode
fribidi: Heap-buffer-overflow in fribidi_cap_rtl_to_unicode
A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service.
A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service.
Statement: Red Hat Product Security has rated this issue as having a Modera
OSV
fribidi vulnerabilities
osv·2023-03-06·CVSS 7.8
CVE-2022-25308 [HIGH] fribidi vulnerabilities
fribidi vulnerabilities
It was discovered that FriBidi incorrectly handled the processing of input
strings, resulting in memory corruption. An attacker could possibly use this
issue to cause FriBidi to crash, resulting in a denial of service, or
potentially execute arbitrary code. (CVE-2022-25308)
It was discovered that FriBidi incorrectly validated input data to its CapRTL
unicode encoder, resulting in memory corruption. An attacker could possibly
use this issue to cause FriBidi to crash, resulting in a denial of service, or
potentially execute arbitrary code. (CVE-2022-25309)
It was discovered that FriBidi incorrectly handled empty input when removing
marks from unicode strings. An attacker could possibly use this to cause
FriBidi to crash, resulting in a denial of service, or potenti
GHSA
GHSA-4fjx-j6jj-8pm5: A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-
ghsa_unreviewed·2022-09-07
CVE-2022-25309 [MEDIUM] CWE-122 GHSA-4fjx-j6jj-8pm5: A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-
A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service.
OSV
CVE-2022-25309: A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-
osv·2022-09-06·CVSS 5.5
CVE-2022-25309 [MEDIUM] CVE-2022-25309: A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-
A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service.
OSV
fribidi vulnerabilities
osv·2022-04-27·CVSS 7.8
CVE-2022-25308 [HIGH] fribidi vulnerabilities
fribidi vulnerabilities
USN-5366-1 fixed several vulnerabilities in FriBidi. This update provides the
corresponding updates for Ubuntu 22.04 LTS.
Original advisory details:
It was discovered that FriBidi incorrectly handled processing of input strings
resulting in memory corruption. An attacker could use this issue to cause
FriBidi to crash, resulting in a denial of service, or potentially execute
arbitrary code. (CVE-2022-25308)
It was discovered that FriBidi incorrectly validated input data to its CapRTL
unicode encoder, resulting in memory corruption. An attacker could use this
issue to cause FriBidi to crash, resulting in a denial of service, or
potentially execute arbitrary code. (CVE-2022-25309)
It was discovered that FriBidi incorrectly handled empty input when removing
marks f
OSV
fribidi vulnerabilities
osv·2022-04-07·CVSS 7.8
CVE-2022-25308 [HIGH] fribidi vulnerabilities
fribidi vulnerabilities
It was discovered that FriBidi incorrectly handled processing of input strings
resulting in memory corruption. An attacker could use this issue to cause
FriBidi to crash, resulting in a denial of service, or potentially execute
arbitrary code.
(CVE-2022-25308)
It was discovered that FriBidi incorrectly validated input data to its CapRTL
unicode encoder, resulting in memory corruption. An attacker could use this
issue to cause FriBidi to crash, resulting in a denial of service, or
potentially execute arbitrary code.
(CVE-2022-25309)
It was discovered that FriBidi incorrectly handled empty input when removing
marks from unicode strings, resulting in a crash. An attacker could use this
to cause FriBidi to crash, resulting in a denial of service, or potentially
execu
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://access.redhat.com/security/cve/CVE-2022-25309https://bugzilla.redhat.com/show_bug.cgi?id=2047896https://github.com/fribidi/fribidi/commit/f22593b82b5d1668d1997dbccd10a9c31ffea3b3https://github.com/fribidi/fribidi/issues/182https://access.redhat.com/security/cve/CVE-2022-25309https://bugzilla.redhat.com/show_bug.cgi?id=2047896https://github.com/fribidi/fribidi/commit/f22593b82b5d1668d1997dbccd10a9c31ffea3b3https://github.com/fribidi/fribidi/issues/182
2022-09-06
Published