CVE-2022-46292 Open Babel has out-of-bounds write in MOPAC translationVectors[] (UNIT CELL TRANSLATION)
HighCVSS 7.8
EPSS 0.80%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Babel 3.1.1 and master commit 530dbfa3. A specially-crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability affects the MOPAC file format, inside the Unit Cell Translation section
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi openbabel(PyPI) | < 3.2.0 | 3.2.0 |
| pypi openbabel(PyPI) | = 1.8 | No fix listed |
| pypi openbabel(PyPI) | = 1.8.1 | No fix listed |
| pypi openbabel(PyPI) | = 1.8.2 | No fix listed |
| pypi openbabel(PyPI) | = 1.8.3 | No fix listed |
| pypi openbabel(PyPI) | = 1.8.4 | No fix listed |
| pypi openbabel(PyPI) | = 2.4.0 | No fix listed |
| pypi openbabel(PyPI) | = 2.4.1 | No fix listed |
| pypi openbabel(PyPI) | = 3.0.0 | No fix listed |
| pypi openbabel(PyPI) | = 3.0.0a1 | No fix listed |
| pypi openbabel(PyPI) | = 3.1.1 | No fix listed |
| pypi openbabel(PyPI) | = 3.1.1.1 | No fix listed |
| debian/openbabel(Debian:12) | All versions | No fix listed |
| debian/openbabel(Debian:12) | = 3.1.1+dfsg-10 | No fix listed |
| debian/openbabel(Debian:12) | = 3.1.1+dfsg-11 | No fix listed |
| debian/openbabel(Debian:12) | = 3.1.1+dfsg-12 | No fix listed |
| debian/openbabel(Debian:12) | = 3.1.1+dfsg-13 | No fix listed |
| debian/openbabel(Debian:12) | = 3.1.1+dfsg-14 | No fix listed |
| debian/openbabel(Debian:12) | = 3.1.1+dfsg-15~exp | No fix listed |
| debian/openbabel(Debian:12) | = 3.1.1+dfsg-9 | No fix listed |
| debian/openbabel(Debian:12) | = 3.2.0+dfsg-1 | No fix listed |
| debian/openbabel(Debian:12) | = 3.2.0+dfsg-1~exp | No fix listed |
| debian/openbabel(Debian:12) | = 3.2.0+dfsg-2 | No fix listed |
| debian/openbabel(Debian:13) | All versions | No fix listed |
| debian/openbabel(Debian:13) | = 3.1.1+dfsg-12 | No fix listed |
Show 21 more
| debian/openbabel(Debian:13) | = 3.1.1+dfsg-13 | No fix listed |
| debian/openbabel(Debian:13) | = 3.1.1+dfsg-14 | No fix listed |
| debian/openbabel(Debian:13) | = 3.1.1+dfsg-15~exp | No fix listed |
| debian/openbabel(Debian:13) | = 3.2.0+dfsg-1 | No fix listed |
| debian/openbabel(Debian:13) | = 3.2.0+dfsg-1~exp | No fix listed |
| debian/openbabel(Debian:13) | = 3.2.0+dfsg-2 | No fix listed |
| debian/openbabel(Debian:14) | All versions | No fix listed |
| debian/openbabel(Debian:14) | = 3.1.1+dfsg-12 | No fix listed |
| debian/openbabel(Debian:14) | = 3.1.1+dfsg-13 | No fix listed |
| debian/openbabel(Debian:14) | = 3.1.1+dfsg-14 | No fix listed |
| debian/openbabel(Debian:14) | = 3.1.1+dfsg-15~exp | No fix listed |
| debian/openbabel(Debian:14) | = 3.2.0+dfsg-1 | No fix listed |
| debian/openbabel(Debian:14) | = 3.2.0+dfsg-1~exp | No fix listed |
| debian/openbabel(Debian:14) | = 3.2.0+dfsg-2 | No fix listed |
| open babel | = 3.1.1 | No fix listed |
| open babel | = master commit 530dbfa3 | No fix listed |
| ubuntu/openbabel(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/openbabel(Ubuntu:24.04) | All versions | No fix listed |
| openbabel open babel | = 3.1.1 | No fix listed |
| ubuntu/openbabel(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/openbabel(Ubuntu:26.10) | All versions | No fix listed |
References
- github.com vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1666 exploit technical-description third-party-advisory
- www.talosintelligence.com
- pypi.org product
- github.com vendor-advisory
- security-tracker.debian.org vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org