ByteOS Network

Vulnerability Details :

CVE-2022-38496

Summary

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-13 Sep, 2022 | 20:16

Updated At-03 Aug, 2024 | 10:54

LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:13 Sep, 2022 | 20:16

Updated At:03 Aug, 2024 | 10:54

▼CVE Numbering Authority (CNA)

LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://github.com/lief-project/LIEF/issues/765	x_refsource_MISC

Hyperlink: https://github.com/lief-project/LIEF/issues/765

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://github.com/lief-project/LIEF/issues/765	x_refsource_MISC x_transferred

Hyperlink: https://github.com/lief-project/LIEF/issues/765

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:13 Sep, 2022 | 21:15

Updated At:18 Sep, 2022 | 01:02

LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Type: Primary

Version: 3.1

Base score: 5.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CPE Matches

lief-project>>lief>>Versions up to 0.12.1(inclusive)

cpe:2.3:a:lief-project:lief:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-617	Primary	nvd@nist.gov

CWE ID: CWE-617

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/lief-project/LIEF/issues/765	cve@mitre.org	Exploit Issue Tracking Patch Third Party Advisory

Hyperlink: https://github.com/lief-project/LIEF/issues/765

Source: cve@mitre.org

Resource:

Exploit

Issue Tracking

Patch

Third Party Advisory

Similar CVEs

60Records found

CVE-2021-46055

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.17% / 38.01%

7 Day CHG~0.00%

Published-07 Jan, 2022 | 22:25

Updated-04 Aug, 2024 | 04:54

A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).

Vendor-webassembly n/a

Product-binaryen n/a

CWE ID-CWE-617

Reachable Assertion

CVE-2021-46337

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.14% / 34.41%

7 Day CHG~0.00%

Published-20 Jan, 2022 | 21:14

Updated-04 Aug, 2024 | 05:02

There is an Assertion 'page_p != NULL' failed at /parser/js/js-parser-mem.c(parser_list_get) in JerryScript 3.0.0.

Vendor-jerryscript n/a

Product-jerryscript n/a

CWE ID-CWE-617

Reachable Assertion

CVE-2021-46346

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.14% / 34.41%

7 Day CHG~0.00%

Published-20 Jan, 2022 | 21:14

Updated-04 Aug, 2024 | 05:02

There is an Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-builtin-date-prototype.c(ecma_builtin_date_prototype_dispatch_set):421 in JerryScript 3.0.0.

Vendor-jerryscript n/a

Product-jerryscript n/a

CWE ID-CWE-617

Reachable Assertion

CVE-2021-46338

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.14% / 34.41%

7 Day CHG~0.00%

Published-20 Jan, 2022 | 21:14

Updated-04 Aug, 2024 | 05:02

There is an Assertion 'ecma_is_lexical_environment (object_p)' failed at /base/ecma-helpers.c(ecma_get_lex_env_type) in JerryScript 3.0.0.

Vendor-jerryscript n/a

Product-jerryscript n/a

CWE ID-CWE-617

Reachable Assertion

CVE-2021-45387

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.08% / 23.39%

7 Day CHG~0.00%

Published-11 Feb, 2022 | 00:00

Updated-04 Aug, 2024 | 04:39

tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c.

Vendor-n/a Broadcom Inc.

Product-tcpreplay n/a

CWE ID-CWE-617

Reachable Assertion

CVE-2021-32815

Matching Score-4

Assigner-GitHub, Inc.

View Details

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.15% / 36.58%

7 Day CHG~0.00%

Published-09 Aug, 2021 | 00:00

Updated-19 Nov, 2024 | 14:12

Denial of service due to assertion failure in crwimage_int.cpp

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The assertion failure is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when modifying the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `fi`. ### Patches The bug is fixed in version v0.27.5. ### References Regression test and bug fix: #1739 ### For more information Please see our [security policy](https://github.com/Exiv2/exiv2/security/policy) for information about Exiv2 security.

Vendor-Debian GNU/Linux Fedora Project Exiv2

Product-exiv2 debian_linux fedora exiv2

CWE ID-CWE-617

Reachable Assertion

CVE-2021-30501

Matching Score-4

Assigner-Red Hat, Inc.

View Details

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.12% / 32.53%

7 Day CHG~0.00%

Published-26 May, 2021 | 23:54

Updated-11 Apr, 2025 | 12:27

An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file.