Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2022-44370: NASM 2.16 can crash or be exploited through memory error
CVE-2022-44370 · published 3 years ago
Summary
The assembler program NASM version 2.16 has a coding mistake that lets a specially crafted input overflow a temporary memory area. This can cause the program to stop working or let an attacker run their own code. Upgrade to the latest NASM release or apply the vendor's patch to fix the issue.
What to do
- Update debian nasm to version 2.16.01-1.
- Update nasm netwide_assembler to version 2.16 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:16.04:LTS | canonical | nasm | All versions |
| Ubuntu:18.04:LTS | canonical | nasm | All versions |
| Ubuntu:20.04:LTS | canonical | nasm | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | nasm | All versions |
| – | nasm | netwide_assembler |
< 2.16 2.16 cpe:2.3:a:nasm:netwide_assembler:*:*:*:*:*:*:*:* |
| Debian:12 | debian | nasm |
< 2.16.01-1 Fix: upgrade to 2.16.01-1
|
Original advisory text
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
References
- https://ubuntu.com/security/CVE-2022-44370 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-44370 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/44xxx/CVE-2022-44370... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-44370 Vendor Advisory
- https://security.gentoo.org/glsa/202312-09 Vendor Advisory
- https://bugzilla.nasm.us/show_bug.cgi?id=3392815 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-44370 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-787Out-of-bounds Write
Timeline
Published29 Mar 2023
Updated4 Nov 2026
First seen8 May 2026
Sources
UBUNTU-CVE-2022-44370 · OSV
CVE-2022-44370 · NVD
CVE-2022-44370 · OSV
DEBIAN-CVE-2022-44370 · OSV
Track software like this
Free during beta