UBUNTU-CVE-2022-0699: Critical severity ubuntu/shapelib vulnerability
Published Oct 17, 2022
·Updated
A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases. This issue may allow an attacker to cause a denial of service or have other unspecified impact via control over malloc.
Affected Software
4 affected components
ubuntu/shapelib*
ubuntu/shapelib*
ubuntu/shapelib*
ubuntu/shapelib*
Event History
Oct 17, 2022
CVE Published
via OSV·04:15 PM
Data Sourced
via OSV·04:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network reachability, low attack complexity, no required privileges, and no user interaction.
2
What level of impact should be assumed during triage?
The reported severity is critical at 9.8, with high confidentiality, integrity, and availability impact in the CVSS vector. Denial of service is explicitly identified, while other impacts are unspecified.