Base Score

CRITICAL9.8

CVE-2022-28044

Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.

VectorNETWORK

Published Bycve@mitre.org

Published DateApr 15, 2022, 14:15

Weakness Type (CWE):CWE-787

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Severity

CRITICAL

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

HIGH

References

https://github.com/ckolivas/lrzip/commit/5faf80cd53ecfd16b636d653483144cd12004f46
https://github.com/ckolivas/lrzip/issues/216
https://lists.debian.org/debian-lts-announce/2022/05/msg00016.html
https://www.debian.org/security/2022/dsa-5145

Base Score

CRITICAL9.8

Weakness Type (CWE):CWE-787

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Severity

CRITICAL

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

HIGH