Cloud Vulnerability DB
A community-led vulnerabilities database
PHP2Shell: Read our blog on the critical RCE vulnerabilities affecting 70% of the Internet
Vulnerability DatabaseCVE-2022-35017
CVE-2022-35017:
NixOS vulnerability analysis and mitigation
Overview
Advancecomp version 2.3 was identified with a heap buffer overflow vulnerability, tracked as CVE-2022-35017. The vulnerability was discovered and initially recorded on July 4, 2022, affecting the AdvanceCOMP compression utility package (CVE MITRE).
Technical details
The vulnerability is classified with a CVSS 3.1 base score of 5.5 (Medium severity). The attack vector is Local, with low attack complexity, requiring no privileges but user interaction. The scope is unchanged, with no impact on confidentiality and integrity, but high impact on availability (Ubuntu Security).
Impact
If exploited, this vulnerability could lead to a denial of service condition. When a user is tricked into opening a specially crafted MNG file, the vulnerability could cause AdvanceCOMP to crash (Ubuntu Notice).
Exploitability
The vulnerability requires local access and user interaction to be exploited. A proof of concept has been published demonstrating the heap buffer overflow condition (GitHub PoC).
Mitigation and workarounds
Multiple Linux distributions have released patches to address this vulnerability. Ubuntu has released fixes across multiple versions: Ubuntu 22.10 (2.3-1ubuntu0.22.10.1), Ubuntu 22.04 LTS (2.1-2.1ubuntu2.1), Ubuntu 20.04 LTS (2.1-2.1ubuntu0.20.04.1), Ubuntu 18.04 LTS (2.1-1ubuntu0.18.04.3), and Ubuntu 16.04 LTS (1.20-1ubuntu0.2+esm2) (Ubuntu Security).
Additional resources
Linux Distribution fix status
Fix availability across major Linux distributions and their releases.
Source: This report was generated using AI
Related NixOS vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management