Detections
Analytics
Alpine: multiple fribidi packages: security update to 1.0.12-r0
high Tenable Cloud Security Plugin ID 423920
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass
a specially crafted file to the Fribidi application, which leads to a possible memory leak or a denial of
service. (CVE-2022-25308)
- A heap-based buffer overflow flaw was found in the Fribidi package and affects the
fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an
attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading
to a crash and causing a denial of service. (CVE-2022-25309)
- A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the
fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw allows an attacker to pass a
specially crafted file to Fribidi, leading to a crash and causing a denial of service. (CVE-2022-25310)
See Also
https://security.alpinelinux.org/vuln/CVE-2022-25308
Plugin Details
Severity: High
ID: 423920
Version: Revision 1.8
Type: Local
Published: 4/4/2025
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 5.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2022-25308
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 7
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 4/1/2022