CVE-2022-48554

low-risk

Published 2023-08-22

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

File

Debian Linux

Debian File Project

http://seclists.org/fulldisclosure/2024/Mar/21

http://seclists.org/fulldisclosure/2024/Mar/24

http://seclists.org/fulldisclosure/2024/Mar/25

Exploit https://bugs.astron.com/view.php?id=310

Third Party Advisory https://security.netapp.com/advisory/ntap-20231116-0002/

https://support.apple.com/kb/HT214081

https://support.apple.com/kb/HT214084

https://support.apple.com/kb/HT214086

https://support.apple.com/kb/HT214088

Third Party Advisory https://www.debian.org/security/2023/dsa-5489