CVE-2022-3515

Gpg4win: Integer Overflow or Wraparound

CVE-2022-3515 is fixed in 6 products on 2 platforms, first by libksba8 1.3.5-2ubuntu0.18.04.1, released October 16, 2022. It is not reported as exploited. Patch Radar priority: High.

HighFixed on 2 platforms

CVSS

9.8

Important

Exploitation

None reported

No vendor assessment

CISA KEV

Not listed

Not in the Known Exploited Vulnerabilities catalog

EPSS

0.0170

77th percentile

A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.

Where it's fixed

Product	Fixed in	Fix	Released
Windows apps
Gpg4win	4.1.0	Gpg4win 4.1.0	Dec 19, 2022
Linux
libksba · Debian 11.6 (bullseye)	1.5.0-3+deb11u1	DSA-5255-1	Oct 17, 2022
libksba · Debian 12.15 (bookworm)	1.6.2-1	DEBIAN-CVE-2022-3515	Jan 12, 2023
libksba · Debian 13.5 (trixie)	1.6.2-1	DEBIAN-CVE-2022-3515	Jan 12, 2023
libksba · Debian 14	1.6.2-1	DEBIAN-CVE-2022-3515	Jan 12, 2023
libksba · RHEL 8	0:1.3.5-8.el8_6	RHSA-2022:7089	Oct 24, 2022
libksba · RHEL 9	0:1.5.1-5.el9_0	RHSA-2022:7090	Oct 24, 2022
libksba · almalinux 8	1.3.5-8.el8_6	ALSA-2022:7089	Oct 24, 2022
libksba · almalinux 9	1.5.1-5.el9_0	ALSA-2022:7090	Oct 24, 2022
libksba · amzn 2023	1.6.3-1.amzn2023.0.2	ALAS2023-2023-088	Feb 17, 2023
libksba · ol 8	0:1.3.5-8.el8_6	ELSA-2022-7089	Oct 24, 2022
libksba · ol 9	0:1.5.1-5.el9_0	ELSA-2022-7090	Oct 24, 2022
libksba · rocky 8	0:1.3.5-8.el8_6	RLSA-2022:7089	Oct 24, 2022
libksba · rocky 9	0:1.5.1-5.el9_0	RLSA-2022:7090	Oct 24, 2022
libksba-debuginfo · amzn 2023	1.6.3-1.amzn2023.0.2	ALAS2023-2023-088	Feb 17, 2023
libksba-debugsource · amzn 2023	1.6.3-1.amzn2023.0.2	ALAS2023-2023-088	Feb 17, 2023
libksba-devel · RHEL 8	0:1.3.5-8.el8_6	RHSA-2022:7089	Oct 24, 2022
libksba-devel · RHEL 9	0:1.5.1-5.el9_0	RHSA-2022:7090	Oct 24, 2022
libksba-devel · almalinux 8	1.3.5-8.el8_6	ALSA-2022:7089	Oct 24, 2022
libksba-devel · almalinux 9	1.5.1-5.el9_0	ALSA-2022:7090	Oct 24, 2022
libksba-devel · amzn 2023	1.6.3-1.amzn2023.0.2	ALAS2023-2023-088	Feb 17, 2023
libksba-devel · ol 8	0:1.3.5-8.el8_6	ELSA-2022-7089	Oct 24, 2022
libksba-devel · ol 9	0:1.5.1-5.el9_0	ELSA-2022-7090	Oct 24, 2022
libksba8 · Ubuntu 18.04.6 LTS (bionic)	1.3.5-2ubuntu0.18.04.1	libksba8 1.3.5-2ubuntu0.18.04.1	Oct 16, 2022
libksba8 · Ubuntu 20.04 LTS (focal)	1.3.5-2ubuntu0.20.04.1	libksba8 1.3.5-2ubuntu0.20.04.1	Oct 16, 2022
libksba8 · Ubuntu 22.04.1 LTS (jammy)	1.6.0-2ubuntu0.1	libksba8 1.6.0-2ubuntu0.1	Oct 16, 2022

Details

Published
October 16, 2022
Weakness
CWE-190: Integer Overflow or Wraparound
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-3515

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/cve/CVE-2022-3515">CVE-2022-3515 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Is this on your machines?

Patchblox finds every install below the fixed version on Windows, macOS and Linux, and updates them through your release rings.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.