CVE-2022-3715
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.
Risk Assessment
Buffer overflow can lead to program crash or potentially arbitrary code execution, which may compromise system security.
Recommendation
Update bash to the latest version that contains the fix. Monitor systems for unusual behavior.
Other vulnerabilities in bash
See all- CVE-2016-0634High
The vulnerability in bash 4.3 allows remote authenticated users to execute arbitrary code by injecting shell metacharacters into the hostname, which are expanded when processing the '\h' sequence in the prompt string.
- CVE-2017-5932High
The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a command substitution metacharacter.
- CVE-2016-7543High
Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.
- CVE-1999-0491Medium
The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute.
- CVE-1999-1048Medium
Buffer overflow in bash 2.0.0, 1.4.17, and other versions allows local attackers to gain privileges by creating an extremely large directory name, which is inserted into the password prompt via the \w option in the PS1 environmental variable when another user changes into that directory.
- CVE-1999-0234Medium
Bash treats any character with a value of 255 as a command separator, which can lead to unexpected behavior in scripts.
Original NVD description (English source)
A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS