{"id":"CVE-2022-0856","aliases":["DEBIAN-CVE-2022-0856","EUVD-2022-15899","GHSA-p2c9-9qhg-mq4q","MGASA-2022-0172","SUSE-SU-2022:1476-1","SUSE-SU-2022:1508-1","UBUNTU-CVE-2022-0856","USN-7943-1","openSUSE-SU-2024:12029-1"],"status":"published","title":"libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user...","description":"libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Service","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02752,"percentile":0.86408,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-369"],"published":"2022-03-08T00:00:00Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"Debian:14","package":"libcaca","fixed_in":["0.99.beta20-8"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"libcaca","fixed_in":["0.99-0.beta19.5.3.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libcaca","fixed_in":["0.99.beta19.git20171003-150200.11.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"libcaca","fixed_in":["0.99.beta19.git20171003-150200.11.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libcaca","fixed_in":["0.99.beta19.git20171003-150200.11.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"libcaca","fixed_in":["0.99.beta19.git20171003-150200.11.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libcaca","fixed_in":["0.99.beta18-14.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libcaca","fixed_in":["0.99.beta18-14.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libcaca","fixed_in":["0.99.beta18-14.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcaca","fixed_in":["0.99.beta18-1ubuntu5.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcaca","fixed_in":["0.99.beta19-2ubuntu0.16.04.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libcaca","fixed_in":["0.99.beta19-2ubuntu0.18.04.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libcaca","fixed_in":["0.99.beta19-2.1ubuntu1.20.04.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libcaca","fixed_in":["0.99.beta19-2.2ubuntu4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libcaca","fixed_in":["0.99.beta20-4ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libcaca","fixed_in":["0.99.beta20-5ubuntu0.25.10.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.99.beta20-3","0.99.beta20-3+deb12u1","0.99.beta20-4","0.99.beta20-5","0.99.beta20-6","0.99.beta20-7","0.99.beta20-8"]},{"source":"osv","ecosystem":"Debian:13","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.99.beta20-5","0.99.beta20-5+deb13u1","0.99.beta20-6","0.99.beta20-7","0.99.beta20-8"]},{"source":"osv","ecosystem":"Debian:14","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta20-8"}]}],"versions":["0.99.beta20-5","0.99.beta20-6","0.99.beta20-7"]},{"source":"osv","ecosystem":"Mageia:8","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99-0.beta19.5.3.mga8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta19.git20171003-150200.11.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta19.git20171003-150200.11.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta19.git20171003-150200.11.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta19.git20171003-150200.11.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta18-14.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta18-14.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta18-14.9.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta18-1ubuntu5.1+esm3"}]}],"versions":["0.99.beta18-1ubuntu2","0.99.beta18-1ubuntu3","0.99.beta18-1ubuntu4","0.99.beta18-1ubuntu5","0.99.beta18-1ubuntu5.1","0.99.beta18-1ubuntu5.1+esm1","0.99.beta18-1ubuntu5.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta19-2ubuntu0.16.04.2+esm2"}]}],"versions":["0.99.beta19-2build2~gcc5.1","0.99.beta19-2build2~gcc5.2","0.99.beta19-2ubuntu0.16.04.1","0.99.beta19-2ubuntu0.16.04.2","0.99.beta19-2ubuntu0.16.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta19-2ubuntu0.18.04.3+esm1"}]}],"versions":["0.99.beta19-2build2~gcc5.2","0.99.beta19-2build2~gcc5.3","0.99.beta19-2ubuntu0.18.04.1","0.99.beta19-2ubuntu0.18.04.2","0.99.beta19-2ubuntu0.18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta19-2.1ubuntu1.20.04.2+esm1"}]}],"versions":["0.99.beta19-2.1","0.99.beta19-2.1ubuntu1","0.99.beta19-2.1ubuntu1.20.04.1","0.99.beta19-2.1ubuntu1.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta19-2.2ubuntu4.1"}]}],"versions":["0.99.beta19-2.2ubuntu2","0.99.beta19-2.2ubuntu3","0.99.beta19-2.2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta20-4ubuntu0.1"}]}],"versions":["0.99.beta20-3build1","0.99.beta20-4","0.99.beta20-4build1","0.99.beta20-4build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta20-5ubuntu0.25.10.1"}]}],"versions":["0.99.beta20-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta18-1ubuntu5.1+esm3"}]}],"versions":["0.99.beta18-1ubuntu2","0.99.beta18-1ubuntu3","0.99.beta18-1ubuntu4","0.99.beta18-1ubuntu5","0.99.beta18-1ubuntu5.1","0.99.beta18-1ubuntu5.1+esm1","0.99.beta18-1ubuntu5.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta19-2ubuntu0.16.04.2+esm2"}]}],"versions":["0.99.beta19-2build2~gcc5.1","0.99.beta19-2build2~gcc5.2","0.99.beta19-2ubuntu0.16.04.1","0.99.beta19-2ubuntu0.16.04.2","0.99.beta19-2ubuntu0.16.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta19-2ubuntu0.18.04.3+esm1"}]}],"versions":["0.99.beta19-2build2~gcc5.2","0.99.beta19-2build2~gcc5.3","0.99.beta19-2ubuntu0.18.04.1","0.99.beta19-2ubuntu0.18.04.2","0.99.beta19-2ubuntu0.18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta19-2.1ubuntu1.20.04.2+esm1"}]}],"versions":["0.99.beta19-2.1","0.99.beta19-2.1ubuntu1","0.99.beta19-2.1ubuntu1.20.04.1","0.99.beta19-2.1ubuntu1.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta19-2.2ubuntu4.1"}]}],"versions":["0.99.beta19-2.2ubuntu2","0.99.beta19-2.2ubuntu3","0.99.beta19-2.2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta20-4ubuntu0.1"}]}],"versions":["0.99.beta20-3build1","0.99.beta20-4","0.99.beta20-4build1","0.99.beta20-4build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libcaca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.beta20-5ubuntu0.25.10.1"}]}],"versions":["0.99.beta20-5"]}],"products":[{"vendor":"cacalabs","product":"libcaca"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libcaca_project","product":"libcaca"}],"references":[{"url":"https://github.com/cacalabs/libcaca/issues/65","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTDRPVX3HCYLQCLMQ6NNSRC3B7L6WGUM/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3E5GF2LSX2ZEY5JZNM7HXJMLHMY436X/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MFOFTTMHO666HB3TVHBMCES6GCKG5PPG/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0856","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B3E5GF2LSX2ZEY5JZNM7HXJMLHMY436X/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTDRPVX3HCYLQCLMQ6NNSRC3B7L6WGUM/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MFOFTTMHO666HB3TVHBMCES6GCKG5PPG/"},{"url":"https://github.com/advisories/GHSA-p2c9-9qhg-mq4q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0856.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-0856","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0172.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30364","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PUXQNAUH2W6TRXYZGBDFHQTMXINVMOJB/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221476-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1197028","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0856","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221508-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-0856","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0856","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7943-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-0856","description":"libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Service","status":"published","published":"2022-03-08T00:00:00Z","modified":"2024-08-02T23:40:04.515Z","cwes":["CWE-369"],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-15899","description":"libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Service","status":"published","published":"2022-03-08T00:00:00Z","modified":"2024-08-02T23:40:04Z","updated_at":"2026-11-03T03:26:03.474849Z"}],"ghsa":[{"id":"GHSA-p2c9-9qhg-mq4q","title":"libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user...","description":"libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Service","status":"published","published":"2022-03-11T00:02:23Z","modified":"2023-11-03T21:30:18Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:54:48.673101Z"}],"nvd":[{"id":"CVE-2022-0856","description":"libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Service","status":"published","published":"2022-03-10T17:44:57.487Z","modified":"2026-06-17T04:21:22.763Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:07:13.7085Z"}],"osv":[{"id":"DEBIAN-CVE-2022-0856","description":"libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Service","status":"published","published":"2022-03-10T17:44:57.487Z","modified":"2026-11-03T08:02:08.012651808Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"UBUNTU-CVE-2022-0856","description":"libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Service","status":"published","published":"2022-03-10T17:44:00Z","modified":"2026-04-22T13:11:49.892405Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"CVE-2022-0856","description":"libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Service","status":"published","published":"2022-03-08T00:00:00Z","modified":"2026-10-28T02:31:13.733030321Z","cwes":["CWE-369"],"updated_at":"2026-11-02T15:44:23.245966Z"},{"id":"MGASA-2022-0172","title":"Updated libcaca packages fix security vulnerability","description":"libcaca is affected by a Divide By Zero issue via img2txt, which allows a\nremote malicious user to cause a Denial of Service. (CVE-2022-0856)\n","status":"published","published":"2022-05-12T10:24:45Z","modified":"2026-04-16T04:42:20.984898392Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:12029-1","title":"caca-utils-0.99.beta19.git20171003-9.1 on GA media","description":"These are all security issues fixed in the caca-utils-0.99.beta19.git20171003-9.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:54:47.063836Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:1476-1","title":"Security update for libcaca","description":"This update for libcaca fixes the following issues:\n\n- CVE-2022-0856: Fixed a divide by zero issue which could be exploited to cause\n  an application crash (bsc#1197028).\n","status":"published","published":"2022-04-29T15:31:36Z","modified":"2026-02-04T03:18:08.291872Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1508-1","title":"Security update for libcaca","description":"This update for libcaca fixes the following issues:\n\n- CVE-2022-0856: Fixed a divide by zero issue which could be exploited to cause\n  an application crash (bsc#1197028).\n","status":"published","published":"2022-05-03T14:08:38Z","modified":"2026-02-04T04:12:36.360345Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-7943-1","title":"libcaca vulnerability","description":"Han Zheng discovered that libcaca incorrectly handled certain images.\nAn attacker could possibly use this issue to cause libcaca to crash.","status":"published","published":"2026-01-07T09:18:49Z","modified":"2026-06-25T13:32:31.579760708Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}