CVE-2022-4337

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	openvswitch	openvswitch 3.0.3, openvswitch 2.17.5, openvswitch 2.16.6, openvswitch 2.15.7, openvswitch 2.14.8, openvswitch 2.13.10

References

https://github.com/openvswitch/ovs/pull/405Patch, Third Party Advisory
https://mail.openvswitch.org/pipermail/ovs-dev/2022-December/400596.htmlMailing List, Patch, Vendor Advisory
https://security.gentoo.org/glsa/202311-16
https://www.debian.org/security/2023/dsa-5319Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/12/21/4Mailing List, Third Party Advisory
https://github.com/openvswitch/ovs/pull/405Patch, Third Party Advisory
https://mail.openvswitch.org/pipermail/ovs-dev/2022-December/400596.htmlMailing List, Patch, Vendor Advisory
https://security.gentoo.org/glsa/202311-16
https://www.debian.org/security/2023/dsa-5319Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/12/21/4Mailing List, Third Party Advisory

Timeline

Published: Jan 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-433724.8Emlog Pro v1.7.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /admin/store.php.CVE-2022-433766.1A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause code an CVE-2022-433777.5A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute for CVE-2022-433786.5A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be tricked into performin CVE-2022-43389.8An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.CVE-2022-433806.2IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX NFS kernel extension to ca CVE-2022-433816.2IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denia CVE-2022-433824.4IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a local user with elevated privileges to exploit a vulnerability in the lpd daemon to cause a CVE-2022-433845.4IBM Aspera Console 3.4.0 through 3.4.2 PL5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScr CVE-2022-433899.8A buffer overflow vulnerability in the library of the web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an una CVE-2022-433908.8A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated a CVE-2022-433916.5A buffer overflow vulnerability in the parameter of the CGI program in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an