CVE-2022-0699 Use after free in shapelib
A double-free vulnerability in shapelib allows attackers to cause denial of service or potentially execute code via controlled memory allocation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-0699?
CVE-2022-0699 is a critical use after free vulnerability in shapelib, published on 17 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases. This issue may allow an attacker to cause a denial of service or have other unspecified impact via control over malloc.
Which versions are affected by CVE-2022-0699?
It affects 1 product.
Linux distribution packages (3)
shapelib SUSE:Package Hub 15 SP3 | All versions | 1.5.0-bp153.2.3.1 |
shapelib openSUSE:Leap 15.3 | All versions | 1.5.0-bp153.2.3.1 |
shapelib openSUSE:Tumbleweed | All versions | 1.5.0-2.1 |
Products include Osgeo Shapelib.
How do I fix CVE-2022-0699?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2022-0699 being exploited?
There is no known exploitation of CVE-2022-0699 in the wild and no public exploit code.
Sources
Also known as AZL-28599, AZL-37034, DEBIAN-CVE-2022-0699, DLA-4451-1, GHSA-j5p4-42cc-2j44, MGASA-2022-0096 and 4 more.