Paper/Archive/CVE-2022-1253

CVE-2022-1253

strukturag strukturag/libde265 — Heap-based Buffer Overflow in strukturag/libde265

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 81.3.813 × 2016.3 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix is established in commit 8e89fe0e175d2870c39486fdd09250b230ec10b8 but does not yet belong to an official release.

Affected

ProductAffectedFixed inSource

strukturag/libde265unspecified – 1.0.8–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

@huntrdev (CNA)7.4CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

References

refhuntr.dev/bounties/1-other-strukturag/libde265 refgithub.com/strukturag/libde265/commit/8e89fe0e175d2870c39486fdd09250b230ec10b8 advisorydebian.org/security/2023/dsa-5346