CVE-2022-47021: fedoraproject fedora NULL Pointer Dereference
CVSS: 7.8v3.1HighModified
AliasesALPINE-CVE-2022-47021MGASA-2023-0042openSUSE-SU-2024:0013-1UBUNTU-CVE-2022-47021USN-5937-1DEBIAN-CVE-2022-47021
Published 20-01-2023Last modified 03-04-2025
Vulnerability summary
CVE-2022-47021 is a high (CVSS 7.8) NULL Pointer Dereference vulnerability in fedoraproject fedora. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.8/10
010
High · v3.1 (CVE.org)EPSS score
0.39%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Timeline
- 20-01-2023PublishedVulnerability first disclosed.
- 03-04-2025Last modifiedVulnerability information updated.
Description
A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 7.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
0.00 pp
From 0.39% on 22-09-2026
22-09-202622-10-2026
EPSS score0.39%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundOpusfile
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- opusfile≥ 0.9, < 0.12-r3 | ≥ 0.9, < 0.12-r4
Debian1 product
- opusfile< 0.12-4
Fedoraproject1 product
- fedoraEOL36 | 37
Mageia1 product
- opusfile< 0.12-1.1.mga8
Opensuse1 product
- opusfile&distro=openSUSE Leap 15.5< 0.12-bp155.3.3.1
Suse1 product
- opusfile&distro=SUSE Package Hub 15 SP5< 0.12-bp155.3.3.1
Ubuntu1 product
- opusfile< 0.7-1ubuntu0.1~esm1 | < 0.9+20170913-1ubuntu0.18.04.1~esm1 | < 0.9+20170913-1ubuntu0.20.04.1~esm1 | < 0.9+20170913-1.1ubuntu0.1~esm1
Xiph1 product
- opusfile≥ 0.9, ≤ 0.12
8 vendors · 8 products
References
18 links- github.com/xiph/opusfile/commit/0a4cd796df5b030cb866f3f4a5e41a4b92caddf5REPORTPatchThird Party Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
Show all 18 references
- lists.opensuse.org/archives/…Advisory
