Every CVE Search/ Get API key

CVE-2022-4603

ppp pppdump pppdump.c dumpppp array index

4.3 MediumFix availableDisputed

CVE-2022-4603 is a medium vulnerability (CVSS 4.3) in Samba Ppp, published December 18, 2022. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in ppp 2.4.9-r1.

A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.89%Unchanged since Dec 19, 2022
90%50%10%1%

What each source reports

CVE List Score used 4.3

ppp pppdump pppdump.c dumpppp array index

A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.

Record
CVE-2022-4603
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Weakness
CWE-119
Updated
2026-11-02
EUVDEUVD-2022-51935 4.3

A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.

Record
EUVD-2022-51935
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-82mr-xx64-4rjv 8.8

** DISPUTED ** A vulnerability classified as problematic has been found in ppp. Affected is the...

** DISPUTED ** A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.

Record
GHSA-82mr-xx64-4rjv
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
NVD 4.3

A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.

Record
CVE-2022-4603
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVALPINE-CVE-2022-4603 6.5

A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.

Record
ALPINE-CVE-2022-4603
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVAZL-11860 6.5

CVE-2022-4603 affecting package ppp 2.4.7-36

A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.

Record
AZL-11860
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVAZL-36979 6.5

CVE-2022-4603 affecting package ppp for versions less than 2.5.0-1

A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.

Record
AZL-36979
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2022-4603 6.5

CVE-2022-4603 does not affect BellSoft software

Record
BELL-CVE-2022-4603
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 4.3

ppp pppdump pppdump.c dumpppp array index

A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.

Record
CVE-2022-4603
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Weakness
CWE-119
Updated
2026-11-02
OSVDEBIAN-CVE-2022-4603 6.5

A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.

Record
DEBIAN-CVE-2022-4603
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVOESA-2023-1015 8.8

ppp security update

The Point-to-Point Protocol (PPP) provides a standard way to establish a network connection over a serial link. At present, this package supports IP and IPV6 and the protocols layered above them, such as TCP and UDP. The Linux port of this package also has support for IPX.

Security Fix(es):

** DISPUTED ** A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.(CVE-2022-4603)

Record
OESA-2023-1015
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2026-1785768873 No score

ppp: Fix of CVE-2022-4603

  • CVE-2022-4603: prevent out-of-range access to pppdump packet buffers
Record
CLSA-2026-1785768873
Updated
2026-11-02
OSVCLSA-2026-1786622639 No score

ppp: Fix of CVE-2022-4603

  • CVE-2022-4603: prevent out-of-range access to pppdump packet buffers
Record
CLSA-2026-1786622639
Updated
2026-11-02
OSVopenSUSE-SU-2024:13529-1 No score

ppp-2.5.0-1.1 on GA media

These are all security issues fixed in the ppp-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13529-1
Updated
2026-11-02
OSVSUSE-SU-2023:4961-1 No score

Security update for ppp

This update for ppp fixes the following issues:

  • CVE-2022-4603: Fixed improper validation of array index of the component pppdump (bsc#1218251).
Record
SUSE-SU-2023:4961-1
Updated
2026-11-02
OSVSUSE-SU-2023:4965-1 No score

Security update for ppp

This update for ppp fixes the following issues:

  • CVE-2022-4603: Fixed improper validation of array index of the component pppdump (bsc#1218251).
Record
SUSE-SU-2023:4965-1
Updated
2026-11-02
OSVSUSE-SU-2024:2380-1 No score

Security update for ppp

This update for ppp fixes the following issues:

  • CVE-2022-4603: Fixed improper validation of array index of the component pppdump (bsc#1218251).
Record
SUSE-SU-2024:2380-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ppp
Alpine:v3.14
 before 2.4.9-r1
2.4.9-r1
ppp
Alpine:v3.15
 before 2.4.9-r3
2.4.9-r3
ppp
Alpine:v3.16
 before 2.4.9-r4
2.4.9-r4
ppp
Alpine:v3.17
 before 2.4.9-r6
2.4.9-r6
ppp
Alpine:v3.18
 before 2.4.9-r6
2.4.9-r6
ppp
Alpine:v3.19
 before 2.4.9-r6
2.4.9-r6
ppp
Alpine:v3.20
 before 2.4.9-r6
2.4.9-r6
ppp
Alpine:v3.21
 before 2.4.9-r6
2.4.9-r6
ppp
Alpine:v3.22
 before 2.4.9-r6
2.4.9-r6
ppp
Alpine:v3.23
 before 2.4.9-r6
2.4.9-r6
Show 29 moreShow less
Affected packages
PackageAffectedFixed
ppp
Alpine:v3.24
 before 2.4.9-r6
2.4.9-r6
ppp
Azure Linux:2
 through 2.4.7-36 None known
ppp
Azure Linux:3
 before 2.5.0-1
2.5.0-1
network-scripts-ppp
TuxCare:AlmaLinux:9.2
 before 2.4.9-5.el9.tuxcare.els1
2.4.9-5.el9.tuxcare.els1
ppp
TuxCare:AlmaLinux:9.2
 before 2.4.9-5.el9.tuxcare.els1
2.4.9-5.el9.tuxcare.els1
ppp-devel
TuxCare:AlmaLinux:9.2
 before 2.4.9-5.el9.tuxcare.els1
2.4.9-5.el9.tuxcare.els1
network-scripts-ppp
TuxCare:AlmaLinux:9.6
 before 2.4.9-5.el9.tuxcare.els1
2.4.9-5.el9.tuxcare.els1
ppp
TuxCare:AlmaLinux:9.6
 before 2.4.9-5.el9.tuxcare.els1
2.4.9-5.el9.tuxcare.els1
ppp-devel
TuxCare:AlmaLinux:9.6
 before 2.4.9-5.el9.tuxcare.els1
2.4.9-5.el9.tuxcare.els1
ppp
Debian:12
 All versions, plus listed versions
2.4.9-1+1.12.5.0-1+12.5.0-1+22.5.1-1+12.5.1-1+1~exp1
Show 5 moreShow less
2.5.2-1+12.5.2-1+1.12.5.2-1+1.22.5.2-1+1~exp12.5.2-1+2
 None known
ppp
Debian:13
 before 2.5.0-1+2
2.5.0-1+2
ppp
Debian:14
 before 2.5.0-1+2
2.5.0-1+2
ppp
openEuler:20.03-LTS-SP1
 before 2.4.8-4.oe1
2.4.8-4.oe1
ppp
openEuler:20.03-LTS-SP3
 before 2.4.8-4.oe1
2.4.8-4.oe1
ppp
openEuler:22.03-LTS
 before 2.4.9-3.oe2203sp1
2.4.9-3.oe2203sp1
ppp
openEuler:22.03-LTS-SP1
 before 2.4.9-3.oe2203sp1
2.4.9-3.oe2203sp1
ppp
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 2.4.7-4.6.1
2.4.7-4.6.1
ppp
SUSE:Linux Enterprise Server 12 SP5
 before 2.4.7-4.6.1
2.4.7-4.6.1
ppp
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 2.4.7-4.6.1
2.4.7-4.6.1
ppp
SUSE:Linux Enterprise Micro 5.3
 before 2.4.7-150000.5.13.1
2.4.7-150000.5.13.1
ppp
SUSE:Linux Enterprise Micro 5.4
 before 2.4.7-150000.5.13.1
2.4.7-150000.5.13.1
ppp
SUSE:Linux Enterprise Micro 5.5
 before 2.4.7-150000.5.13.1
2.4.7-150000.5.13.1
ppp
SUSE:Linux Enterprise Module for Desktop Applications 15 SP5
 before 2.4.7-150000.5.13.1
2.4.7-150000.5.13.1
ppp
SUSE:Linux Enterprise Real Time 15 SP4
 before 2.4.7-150000.5.13.1
2.4.7-150000.5.13.1
ppp
openSUSE:Leap Micro 5.3
 before 2.4.7-150000.5.13.1
2.4.7-150000.5.13.1
ppp
openSUSE:Leap Micro 5.4
 before 2.4.7-150000.5.13.1
2.4.7-150000.5.13.1
ppp
openSUSE:Leap 15.4
 before 2.4.7-150000.5.13.1
2.4.7-150000.5.13.1
ppp
openSUSE:Leap 15.5
 before 2.4.7-150000.5.13.1
2.4.7-150000.5.13.1
ppp
openSUSE:Tumbleweed
 before 2.5.0-1.1
2.5.0-1.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open