Vulnerability · Published May 4, 2022 · Assigned by mitre
CVE-2022-30292
Critical 10.0
In plain English
A critical-severity security flaw in the squirrel3 package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)10.0Critical
Exploit odds (30 days)3.6%top 10.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sq_reservestack call.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | squirrel3 | 3.1-8.2 | DEBIAN-CVE-2022-30292 |
| Ubuntu:22.04:LTS | squirrel3 | no fix listed | UBUNTU-CVE-2022-30292 |
| Ubuntu:25.10 | squirrel3 | no fix listed | UBUNTU-CVE-2022-30292 |
| Ubuntu:26.04:LTS | squirrel3 | no fix listed | UBUNTU-CVE-2022-30292 |
| Ubuntu:26.10 | squirrel3 | no fix listed | UBUNTU-CVE-2022-30292 |
Affected products (as reported)
References
- https://github.com/albertodemichelis/squirrel/commit/a6413aa690e0bdfef648c68693349a7b878fe60d x_refsource_MISC
- https://github.com/sprushed/CVE-2022-30292 x_refsource_MISC
- FEDORA-2022-509887bd99 vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-88e3257aef vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-e81c0db364 vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-e139f256f6 vendor-advisory, x_refsource_FEDORA