CVE-2022-32323 Memory corruption in n/a

High 7.3 Published 14 Jul 2022 Updated 3 Aug 2024

A heap overflow in AutoTrace allows attackers to execute arbitrary code or cause denial of service via crafted BMP files.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-32323?

CVE-2022-32323 is a high-severity memory corruption vulnerability in Autotrace Project Autotrace, published on 14 Jul 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.

Weakness: CWE-787

Which versions are affected by CVE-2022-32323?

It affects 2 products.

Linux distribution packages (15)

`autotrace` AlmaLinux:8	All versions	`0.31.1-55.el8`
`autotrace` AlmaLinux:9	All versions	`0.31.1-65.el9`
`autotrace` Red Hat:enterprise_linux:8::crb	All versions	`0:0.31.1-55.el8`
`autotrace-debuginfo` Red Hat:enterprise_linux:8::crb	All versions	`0:0.31.1-55.el8`
`autotrace-debugsource` Red Hat:enterprise_linux:8::crb	All versions	`0:0.31.1-55.el8`
`autotrace` Red Hat:enterprise_linux:9::crb	All versions	`0:0.31.1-65.el9`
`autotrace-debuginfo` Red Hat:enterprise_linux:9::crb	All versions	`0:0.31.1-65.el9`
`autotrace-debugsource` Red Hat:enterprise_linux:9::crb	All versions	`0:0.31.1-65.el9`
`autotrace` Rocky Linux:8	All versions	`0:0.31.1-55.el8`
`autotrace` Rocky Linux:9	All versions	`0:0.31.1-65.el9`
`autotrace` SUSE:Package Hub 15 SP3	All versions	`0.31.1-bp153.2.6.1`
`autotrace` SUSE:Package Hub 15 SP4	All versions	`0.31.1-bp154.3.3.1`
`autotrace` openSUSE:Leap 15.3	All versions	`0.31.1-bp153.2.6.1`
`autotrace` openSUSE:Leap 15.4	All versions	`0.31.1-bp154.3.3.1`
`autotrace` openSUSE:Tumbleweed	All versions	`0.31.1-646.1`

Products include Autotrace Project Autotrace, Fedoraproject Fedora.

How do I fix CVE-2022-32323?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-32323 being exploited?

There is no known exploitation of CVE-2022-32323 in the wild and no public exploit code.

All Autotrace Project Autotrace vulnerabilities

Sources

Also known as ALSA-2023:2589, ALSA-2023:3067, GHSA-5j5g-gfrq-r5jc, RHSA-2023:2589, RHSA-2023:3067, RLSA-2023:2589 and 5 more.