Log in Start free

Vulnerability · Published Nov 3, 2022 · Assigned by mitre

CVE-2022-44638

High 8.8

In plain English

A high-severity integer overflow in the mingw32-pixman package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.9%top 20.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixman_sample_floor_y.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9mingw32-pixman0.42.2-3.el9ALSA-2024:2525
AlmaLinux:9mingw64-pixman0.42.2-3.el9ALSA-2024:2525
AlmaLinux:8pixman0.38.4-3.el8_9ALSA-2024:0131
AlmaLinux:9pixman0.40.0-6.el9_3ALSA-2023:7754
AlmaLinux:8pixman-devel0.38.4-3.el8_9ALSA-2024:0131
AlmaLinux:9pixman-devel0.40.0-6.el9_3ALSA-2023:7754
Debian:12pixman0.40.0-1.1DEBIAN-CVE-2022-44638
Debian:13pixman0.40.0-1.1DEBIAN-CVE-2022-44638
Debian:14pixman0.40.0-1.1DEBIAN-CVE-2022-44638
Rocky Linux:9mingw-pixman0:0.42.2-3.el9RLSA-2024:2525
Rocky Linux:9pixman0:0.40.0-6.el9_3RLSA-2023:7754
Ubuntu:22.04:LTSpixman0.40.0-1ubuntu0.22.04.1USN-5718-1
Ubuntu:22.04:LTSpixman0.40.0-1ubuntu0.22.04.1UBUNTU-CVE-2022-44638

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References