CVE-2022-37454 — Integer Overflow or Wraparound in PHP
CWE-190 — Integer Overflow or WraparoundCWE-680 — Integer Overflow to Buffer Overflow26 documents11 sources
Severity
9.8CRITICALNVD
OSV7.6OSV5.5
EPSS
1.4%
top 19.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 21
Latest updateFeb 27
Description
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages18 packages
Also affects: Debian Linux 10.0, 11.0, Fedora 35, 36