CVE-2022-32292: Buffer Overflow
First published: Wed Aug 03 2022(Updated: )
In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to exploit a heap-based buffer overflow in received_data to execute code.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Intel Connman | <=1.41 | |
| Debian Debian Linux | =11.0 | |
| debian/connman | <=1.36-2.1~deb10u2 | 1.36-2.1~deb10u5 1.36-2.2+deb11u2 1.41-3 1.42-5 |
| ubuntu/connman | <1.36-2ubuntu0.1 | 1.36-2ubuntu0.1 |
| ubuntu/connman | <1.36-2.3ubuntu0.1 | 1.36-2.3ubuntu0.1 |
| ubuntu/connman | <1.35-6ubuntu0.1~ | 1.35-6ubuntu0.1~ |
| ubuntu/connman | <1.21-1.2+ | 1.21-1.2+ |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2022-32292
- https://lore.kernel.org/connman/20220801080043.4861-5-wagi@monom.org/
- https://bugzilla.suse.com/show_bug.cgi?id=1200189
- https://security-tracker.debian.org/tracker/CVE-2022-32293
- https://lore.kernel.org/connman/20220801080043.4861-1-wagi@monom.org/
- https://lore.kernel.org/connman/20220801080043.4861-3-wagi@monom.org/
- https://bugzilla.suse.com/show_bug.cgi?id=1200190
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32292
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32293
- https://git.kernel.org/pub/scm/network/connman/connman.git
- https://security-tracker.debian.org/tracker/CVE-2022-23096
- https://security-tracker.debian.org/tracker/CVE-2022-23097
- https://security-tracker.debian.org/tracker/CVE-2022-23098
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1016976
- https://www.debian.org/security/2022/dsa-5231
- https://security.gentoo.org/glsa/202310-21
- https://launchpad.net/bugs/cve/CVE-2022-32292
- https://lore.kernel.org/connman/20220801080043.4861-5-wagi%40monom.org/
- https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=d1a5ede5d255bde8ef707f8441b997563b9312bd
- https://ubuntu.com/security/notices/USN-6236-1
- https://nvd.nist.gov/vuln/detail/CVE-2022-32292
- https://ubuntu.com/security/CVE-2022-32292
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-32292.
What is the title of the vulnerability?
The title of the vulnerability is 'In ConnMan through 1.41 remote attackers able to send HTTP requests to the gweb component are able to...'
What is the description of the vulnerability?
The description of the vulnerability is 'In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to exploit a heap-based buffer overflow in received_data to execute code.'
What software versions are affected by this vulnerability?
The affected software versions are 1.36-2.1~deb10u5, 1.36-2.2+deb11u1, 1.36-2.2+deb11u2, and 1.41-3.
What is the fix for this vulnerability?
The fix for this vulnerability depends on the affected software package. Please refer to the provided references for the specific remedy.
What are the references for this vulnerability?
The references for this vulnerability are 'https://lore.kernel.org/connman/20220801080043.4861-5-wagi@monom.org/', 'https://bugzilla.suse.com/show_bug.cgi?id=1200189', and 'https://www.debian.org/security/2022/dsa-5231'.
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The Common Weakness Enumeration (CWE) ID for this vulnerability is CWE-119.
- collector/debian-bugs
- alias/CVE-2022-32292
- collector/nvd-index
- collector/nvd-api
- agent/type
- agent/remedy
- agent/last-modified-date
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/weakness
- agent/references
- agent/severity
- collector/usn-cve
- source/Ubuntu
- agent/software-canonical-lookup
- agent/description
- collector/security-tracker-debian
- source/Debian
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/intel
- canonical/intel connman
- version/intel connman/1.41
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/11.0
- package-manager/ubuntu
- package-manager/debian