VDB
DEBIAN-CVE-2022-3437
DEBIAN-CVE-2022-3437
PUBLISHED
CVSS 6.5 MEDIUM
A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | samba | 0, 0, 0 |
| Debian:14 | heimdal | 0, 0, 0 |
| Debian:14 | samba | 0, 0, 0 |
| Debian:12 | heimdal | 0, 0, 0 |
| Debian:12 | samba | 0, 0, 0 |
| Debian:11 | heimdal | 7.7.0+dfsg, 7.7.0+dfsg-2, 7.7.0+dfsg-2+deb11u1 |
| Debian:13 | heimdal | 0, 0, 0 |
| Debian:11 | samba | 2:4.13.13+dfsg-1~deb11u3, 0, 4.13.13+dfsg |
Exploit Intelligence
- macos_v2_generated.go (github-poc)
- macos_v1_generated.go (github-poc)
Timeline
- Jan 12, 2023 CVE Published
- Apr 28, 2026 CVE Updated