CVE-2022-46290
published 2023-07-21CVE-2022-46290: Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially-crafted…
PriorityP339high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.82%
52.9th percentile
Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially-crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.The loop that stores the coordinates does not check its index against nAtoms
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openbabel | — | — |
| debian | openbabel | >= 0 < 3.2.0 | 3.2.0 |
| open_babel | open_babel | — | — |
| open_babel | open_babel | — | — |
| openbabel | open_babel | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2022-46290: openbabel - Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms fun...
vendor_debian·2022·CVSS 9.8
CVE-2022-46290 [CRITICAL] CVE-2022-46290: openbabel - Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms fun...
Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially-crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.The loop that stores the coordinates does not check its index against nAtoms
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
GHSA
Open Babel has out-of-bounds write in ORCA nAtoms parser (second variant)
ghsa·2026-07-01
CVE-2022-46290 [HIGH] CWE-122 Open Babel has out-of-bounds write in ORCA nAtoms parser (second variant)
Open Babel has out-of-bounds write in ORCA nAtoms parser (second variant)
### Summary
A memory-safety vulnerability in Open Babel's ORCA parser allowed an
out-of-bounds write when reading a crafted input file.
### Details
A second variant of the `nAtoms` out-of-bounds write in the ORCA
reader: a different malformed-input path produced the same class of
write past the end of the destination buffer.
### Impact
Open Babel is a C++ library and CLI used to read and write chemistry
file formats; it is shipped by Linux distributions and embedded in
services that may parse untrusted input. Triggering this vulnerability
requires the victim to open a malicious ORCA file with the `obabel`
tool, the `OBConversion` API, or any of the language bindings (Python,
Ruby, Java, R, Perl, C#, PHP).
###
GHSA
GHSA-wj42-v2p3-fq2w: Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3
ghsa_unreviewed·2023-07-21
CVE-2022-46290 [HIGH] CWE-122 GHSA-wj42-v2p3-fq2w: Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3
Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially-crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.The loop that stores the coordinates does not check its index against nAtoms
OSV
CVE-2022-46290: Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3
osv·2023-07-21·CVSS 7.8
CVE-2022-46290 [HIGH] CVE-2022-46290: Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3
Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially-crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.The loop that stores the coordinates does not check its index against nAtoms
No detection rules found.
No public exploits indexed.
Talos
Out-of-bounds write vulnerabilities in popular chemistry software; Foxit PDF Reader issues could lead to remote code execution
blogs_talos·2023-08-09·CVSS 7.3
[HIGH] Out-of-bounds write vulnerabilities in popular chemistry software; Foxit PDF Reader issues could lead to remote code execution
Cisco Talos recently worked with two vendors to patch multiple vulnerabilities in a favored software library used in chemistry laboratories and the Foxit PDF Reader, one of the most popular PDF reader alternatives to Adobe Acrobat.
Attackers could exploit these vulnerabilities to carry out a variety of attacks, in some cases gaining the ability to execute remote code on the targeted machine.
Seven of the vulnerabilities included in today’s Vulnerability Roundup have a CVSS severity score of 9.8 out of a possible 10.
For Snort coverage that can detect the exploitation of these vulnerabilities, download the latest rule sets from Snort.org, and our latest Vulnerability Advisories are always posted on Talos Intelligence’s website.
## Multiple vulnerabilities in Open Babel software
Talos r
Talos
Out-of-bounds write vulnerabilities in popular chemistry software; Foxit PDF Reader issues could lead to remote code execution
blogs_talos·2023-08-09·CVSS 9.8
[CRITICAL] Out-of-bounds write vulnerabilities in popular chemistry software; Foxit PDF Reader issues could lead to remote code execution
## Out-of-bounds write vulnerabilities in popular chemistry software; Foxit PDF Reader issues could lead to remote code execution
Cisco Talos recently worked with two vendors to patch multiple vulnerabilities in a favored software library used in chemistry laboratories and the Foxit PDF Reader, one of the most popular PDF reader alternatives to Adobe Acrobat.
Attackers could exploit these vulnerabilities to carry out a variety of attacks, in some cases gaining the ability to execute remote code on the targeted machine.
Seven of the vulnerabilities included in today’s Vulnerability Roundup have a CVSS severity score of 9.8 out of a possible 10.
For Snort coverage that can detect the exploitation of these vulnerabilities, download the latest rule sets from Snort.org , and our latest Vuln
2023-07-21
Published