{"schemaVersion":3,"id":"CVE-2022-4603","aliases":["ALPINE-CVE-2022-4603","SUSE-SU-2023:4961-1","SUSE-SU-2023:4965-1","SUSE-SU-2024:2380-1","DEBIAN-CVE-2022-4603","openSUSE-SU-2024:13529-1"],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.","dates":{"published":"2022-12-18T00:00:00.000Z","modified":"2024-08-03T01:41:45.809Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Alpine","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","exploitability":7.2,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","exploitability":7.2,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00891,"percentile":0.58966,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.06999999999999992,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00821},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00891,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00891,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00891,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00891,"percentile":0.58966}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00821,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00859,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00891,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00891,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00891,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00891,"percentile":0.58966}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"alpine","product":"ppp","name":"ppp","label":"ppp","ecosystem":"Alpine Linux","cpePart":null,"purl":"pkg:apk/alpine/ppp","purlType":"apk","versions":[{"text":"< 2.4.9-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.4.9-r3","noFixRecorded":false,"fixedIn":null},{"text":"< 2.4.9-r4","noFixRecorded":false,"fixedIn":null},{"text":"< 2.4.9-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.9-r1 | < 2.4.9-r3 | < 2.4.9-r4 | < 2.4.9-r6","eol":null,"hubHref":null},{"vendor":"debian","product":"ppp","name":"ppp","label":"ppp","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/ppp","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 2.5.0-1+2","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 2.5.0-1+2","eol":null,"hubHref":null},{"vendor":"opensuse","product":"ppp&distro=openSUSE Leap 15.4","name":"ppp","label":"ppp&distro=openSUSE Leap 15.4","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/ppp&distro=openSUSE Leap 15.4","purlType":"rpm","versions":[{"text":"< 2.4.7-150000.5.13.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.7-150000.5.13.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"ppp&distro=openSUSE Leap 15.5","name":"ppp","label":"ppp&distro=openSUSE Leap 15.5","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/ppp&distro=openSUSE Leap 15.5","purlType":"rpm","versions":[{"text":"< 2.4.7-150000.5.13.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.7-150000.5.13.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"ppp&distro=openSUSE Leap Micro 5.3","name":"ppp","label":"ppp&distro=openSUSE Leap Micro 5.3","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/ppp&distro=openSUSE Leap Micro 5.3","purlType":"rpm","versions":[{"text":"< 2.4.7-150000.5.13.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.7-150000.5.13.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"ppp&distro=openSUSE Leap Micro 5.4","name":"ppp","label":"ppp&distro=openSUSE Leap Micro 5.4","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/ppp&distro=openSUSE Leap Micro 5.4","purlType":"rpm","versions":[{"text":"< 2.4.7-150000.5.13.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.7-150000.5.13.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"ppp&distro=openSUSE Tumbleweed","name":"ppp","label":"ppp&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/ppp&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 2.5.0-1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.0-1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"ppp&distro=SUSE Linux Enterprise Micro 5.3","name":"ppp","label":"ppp&distro=SUSE Linux Enterprise Micro 5.3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/ppp&distro=SUSE Linux Enterprise Micro 5.3","purlType":"rpm","versions":[{"text":"< 2.4.7-150000.5.13.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.7-150000.5.13.1","eol":null,"hubHref":null},{"vendor":"suse","product":"ppp&distro=SUSE Linux Enterprise Micro 5.4","name":"ppp","label":"ppp&distro=SUSE Linux Enterprise Micro 5.4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/ppp&distro=SUSE Linux Enterprise Micro 5.4","purlType":"rpm","versions":[{"text":"< 2.4.7-150000.5.13.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.7-150000.5.13.1","eol":null,"hubHref":null},{"vendor":"suse","product":"ppp&distro=SUSE Linux Enterprise Micro 5.5","name":"ppp","label":"ppp&distro=SUSE Linux Enterprise Micro 5.5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/ppp&distro=SUSE Linux Enterprise Micro 5.5","purlType":"rpm","versions":[{"text":"< 2.4.7-150000.5.13.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.7-150000.5.13.1","eol":null,"hubHref":null},{"vendor":"suse","product":"ppp&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP5","name":"ppp","label":"ppp&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/ppp&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP5","purlType":"rpm","versions":[{"text":"< 2.4.7-150000.5.13.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.7-150000.5.13.1","eol":null,"hubHref":null},{"vendor":"suse","product":"ppp&distro=SUSE Linux Enterprise Real Time 15 SP4","name":"ppp","label":"ppp&distro=SUSE Linux Enterprise Real Time 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/ppp&distro=SUSE Linux Enterprise Real Time 15 SP4","purlType":"rpm","versions":[{"text":"< 2.4.7-150000.5.13.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.7-150000.5.13.1","eol":null,"hubHref":null},{"vendor":"suse","product":"ppp&distro=SUSE Linux Enterprise Server 12 SP5","name":"ppp","label":"ppp&distro=SUSE Linux Enterprise Server 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/ppp&distro=SUSE Linux Enterprise Server 12 SP5","purlType":"rpm","versions":[{"text":"< 2.4.7-4.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.7-4.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"ppp&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","name":"ppp","label":"ppp&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/ppp&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","purlType":"rpm","versions":[{"text":"< 2.4.7-4.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.7-4.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"ppp&distro=SUSE Linux Enterprise Software Development Kit 12 SP5","name":"ppp","label":"ppp&distro=SUSE Linux Enterprise Software Development Kit 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/ppp&distro=SUSE Linux Enterprise Software Development Kit 12 SP5","purlType":"rpm","versions":[{"text":"< 2.4.7-4.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.7-4.6.1","eol":null,"hubHref":null},{"vendor":"samba","product":"ppp","name":"ppp","label":"ppp","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.5.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.0","eol":null,"hubHref":"/vendor/samba/ppp"},{"vendor":"unspecified","product":"ppp","name":"ppp","label":"ppp","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"n/a","noFixRecorded":false,"fixedIn":null}],"versionsText":"n/a","eol":null,"hubHref":"/vendor/unspecified/ppp"}],"affectedCount":17,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/ppp-project/ppp/commit/a75fb7b198eed50d769c80c36629f38346882cbf","label":"github.com/ppp-project/ppp/commit/a75fb7b198eed50d769c80c36629f38346882cbf","hostname":"github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://vuldb.com/?id.216198","label":"vuldb.com?id.216198","hostname":"vuldb.com","tags":["Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J43NP7ABHOCIWOFHWCH6ZCZOYKZH6723/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J43NP7ABHOCIWOFHWCH6ZCZOYKZH6723/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":[]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-4603","label":"security.alpinelinux.org/vuln/CVE-2022-4603","hostname":"security.alpinelinux.org","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234961-1/","label":"www.suse.com/support/update/announcement/2023/suse-su-20234961-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1218251","label":"bugzilla.suse.com/1218251","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4603","label":"www.suse.com/security/cve/CVE-2022-4603","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234965-1/","label":"www.suse.com/support/update/announcement/2023/suse-su-20234965-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242380-1/","label":"www.suse.com/support/update/announcement/2024/suse-su-20242380-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-4603","label":"security-tracker.debian.org/tracker/CVE-2022-4603","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4603","label":"nvd.nist.gov/vuln/detail/CVE-2022-4603","hostname":"nvd.nist.gov","tags":["Oval","Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-12-18T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-03T01:41:45.809Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":26,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T00:07:48.131Z","stale":false,"partial":false}}