CVE-2022-30549
published 2022-06-16CVE-2022-30549: Out-of-bounds read vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attacker to obtain…
PriorityP338high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.87%
54.2th percentile
Out-of-bounds read vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fuji_electric_co_ltd | hakko_electronics_co_ltd_v-server_and_v-server_lite | — | — |
| fujielectric | v-server | <= 4.0.11.0 | — |
| fujielectric | v-server | <= 4.0.13.0 | — |
| github.com | apptainer_apptainer | >= 0 < 1.1.8 | 1.1.8 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
ghsa5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer
ghsa·2023-04-25·CVSS 5.5
CVE-2023-30549 [MEDIUM] CWE-416 Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer
Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer
### Impact
There is an ext4 use-after-free flaw described in CVE-2022-1184 that is exploitable through versions of Apptainer < 1.1.0 and installations that include apptainer-suid < 1.1.8 on older operating systems where that CVE has not been patched. That includes Red Hat Enterprise Linux 7, Debian 10 buster (unless the linux-5.10 package is installed), Ubuntu 18.04 bionic and Ubuntu 20.04 focal. Use-after-free flaws in the kernel can be used to attack the kernel for denial of service and potentially for privilege escalation.
### Background
Historically there have been many CVEs published for extfs and a smaller number for squashfs, including serious use-after-free and buffer overrun vulnerabilities, that are sco
GHSA
GHSA-vgp9-ghj6-rf88: Out-of-bounds read vulnerability exists in V-Server v4
ghsa_unreviewed·2022-06-17
CVE-2022-30549 [HIGH] CWE-125 GHSA-vgp9-ghj6-rf88: Out-of-bounds read vulnerability exists in V-Server v4
Out-of-bounds read vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://jvn.jp/en/vu/JVNVU93134398/index.htmlhttps://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.phphttps://monitouch.fujielectric.com/site/download-eu/03tellus_inf/index.phphttps://jvn.jp/en/vu/JVNVU93134398/index.htmlhttps://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.phphttps://monitouch.fujielectric.com/site/download-eu/03tellus_inf/index.php
2022-06-16
Published