CVE-2022-39170

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

libdwarf 0.4.1 has a double free in _dwarf_exec_frame_instr in dwarf_frame.c.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/davea42/libdwarf-code/commit/60303eb80ecc7747bf29776d545e2a5c5a76f6f8Patch, Third Party Advisory
https://github.com/davea42/libdwarf-code/issues/132Issue Tracking, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IKUE4XT62AEZ3H5D6GMREYOSCMMRFXBH/
https://github.com/davea42/libdwarf-code/commit/60303eb80ecc7747bf29776d545e2a5c5a76f6f8Patch, Third Party Advisory
https://github.com/davea42/libdwarf-code/issues/132Issue Tracking, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IKUE4XT62AEZ3H5D6GMREYOSCMMRFXBH/

Timeline

Published: Sep 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-391725.4A stored XSS in the process overview (bersicht zugewiesener Vorgaenge) in mbsupport openVIVA c2 20220101 allows a remote, authenticated, low CVE-2022-391737.5In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly r CVE-2022-391768.8BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate par CVE-2022-391778.8BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be proce CVE-2022-391785.3Webvendome - webvendome Internal Server IP Disclosure. Send GET Request to the request which is shown in the picture. Internal Server IP and CVE-2022-391797.2College Management System v1.0 - Authenticated remote code execution. An admin user (the authentication can be bypassed using SQL Injection CVE-2022-39188.8A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF ( ) injection in URLRequest headers. In CVE-2022-391809.8College Management System v1.0 - SQL Injection (SQLi). By inserting SQL commands to the username and password fields in the login.php page CVE-2022-391816.1GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS). Type 1: Reflected XSS (or Non-Persistent) - The server reads data dire CVE-2022-391828.8H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation.Version 1.6 is vulnerable to privilege escalation which may allow a malicious actor CVE-2022-391836.1Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors.CVE-2022-391849.8EXFO - BV-10 Performance Endpoint Unit authentication bypass User can manually manipulate access enabling authentication bypass.