CVE-2022-25309

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-25309
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-25309.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-25309
Downstream
ALPINE (1)
ALSA (2)
AZL (1)
BELL (1)
CLEANSTART (1)
DEBIAN (1)
JLSEC (1)
MGASA (1)
OESA (1)
RHSA (2)
RLSA (2)
ROOT (1)
SUSE (4)
UBUNTU (1)
Related
ALSA (2)
SUSE (4)
Published
2022-09-06T17:18:52Z
Modified
2026-10-28T10:27:31Z
Summary
[none]
Details

A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service.

Database specific 
{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-122"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25309.json"
}
References

Affected packages

Git / github.com/fribidi/fribidi

Affected ranges

Type
GIT
Repo
https://github.com/fribidi/fribidi
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6428d8469e536bcbb6e12c7b79ba6659371c435a
Fixed
f22593b82b5d1668d1997dbccd10a9c31ffea3b3
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:gnu:fribidi:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.0.12"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "f22593b82b5d1668d1997dbccd10a9c31ffea3b3"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.19.4
0.19.5
0.19.6
0.19.7
Other
FRIBIDI_0_19_1
v1.*
v1.0.0
v1.0.1
v1.0.10
v1.0.11
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-25309.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "195929187198682414254044189776245323940",
                "192186857396851327318030455048936161433",
                "78482243105926605707148988574504835089",
                "307809941047441329916853161326584498925"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2022-25309-6b1a0181",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/fribidi/fribidi/commit/f22593b82b5d1668d1997dbccd10a9c31ffea3b3",
        "target": {
            "file": "lib/fribidi-char-sets-cap-rtl.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "303871518782851192660779115964107174272",
            "length": 1087
        },
        "id": "CVE-2022-25309-d80ae002",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/fribidi/fribidi/commit/f22593b82b5d1668d1997dbccd10a9c31ffea3b3",
        "target": {
            "file": "lib/fribidi-char-sets-cap-rtl.c",
            "function": "fribidi_cap_rtl_to_unicode"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:27:31Z"