{"id":"CVE-2022-28044","aliases":["ALPINE-CVE-2022-28044","DEBIAN-CVE-2022-28044","DLA-3005-1","DSA-5145-1","EUVD-2022-32530","GHSA-2qww-cm69-c4w4","UBUNTU-CVE-2022-28044","USN-5840-1"],"status":"published","title":"Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c...","description":"Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01926,"percentile":0.80099,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2022-04-15T13:06:35Z","modified":"2026-11-03T08:01:11Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"lrzip","fixed_in":["0.650-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"lrzip","fixed_in":["0.650-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"lrzip","fixed_in":["0.650-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"lrzip","fixed_in":["0.650-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"lrzip","fixed_in":["0.650-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"lrzip","fixed_in":["0.650-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"lrzip","fixed_in":["0.650-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"lrzip","fixed_in":["0.650-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"lrzip","fixed_in":["0.650-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lrzip","fixed_in":["0.650-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lrzip","fixed_in":["0.650-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"lrzip","fixed_in":["0.631-1+deb9u3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"lrzip","fixed_in":["0.616-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lrzip","fixed_in":["0.621-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"lrzip","fixed_in":["0.631-1+deb9u3build0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"lrzip","fixed_in":["0.631+git180528-1+deb10u1build0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"lrzip","fixed_in":["0.651-2ubuntu0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.650-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.650-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.650-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.650-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.650-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.650-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.650-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.650-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.650-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.650-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.650-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.631-1+deb9u3"}]}],"versions":["0.631-1","0.631-1+deb9u1","0.631-1+deb9u2"]},{"source":"osv","ecosystem":"Debian:10","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.631+git180528-1+deb10u1"}]}],"versions":["0.631+git180528-1"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.641-1+deb11u1"}]}],"versions":["0.641-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.616-1ubuntu0.1~esm2"}]}],"versions":["0.608-2","0.616-1","0.616-1ubuntu0.1~esm","0.616-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.621-1ubuntu0.1~esm2"}]}],"versions":["0.621-1","0.621-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.631-1+deb9u3build0.18.04.1"}]}],"versions":["0.631-1","0.631-1+deb9u1build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.631+git180528-1+deb10u1build0.20.04.1"}]}],"versions":["0.631+git180528-1","0.631+git180528-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.651-2ubuntu0.22.04.1"}]}],"versions":["0.641-1","0.651-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.616-1ubuntu0.1~esm2"}]}],"versions":["0.608-2","0.616-1","0.616-1ubuntu0.1~esm","0.616-1ubuntu0.1~esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.621-1ubuntu0.1~esm2"}]}],"versions":["0.621-1","0.621-1ubuntu0.1~esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.631-1+deb9u3build0.18.04.1"}]}],"versions":["0.631-1","0.631-1+deb9u1build0.18.04.1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.631+git180528-1+deb10u1build0.20.04.1"}]}],"versions":["0.631+git180528-1","0.631+git180528-1build1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.651-2ubuntu0.22.04.1"}]}],"versions":["0.641-1","0.651-2"],"bundled":6}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"irzip_project","product":"irzip"}],"references":[{"url":"https://github.com/ckolivas/lrzip/issues/216","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","report"]},{"url":"https://github.com/ckolivas/lrzip/commit/5faf80cd53ecfd16b636d653483144cd12004f46","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00016.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://www.debian.org/security/2022/dsa-5145","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28044","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2qww-cm69-c4w4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-28044","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28044.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-28044","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-28044","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5840-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-5786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25467","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-27345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-27347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26291","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-28044","description":"Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.","status":"published","published":"2022-04-15T13:06:35Z","modified":"2024-08-03T05:41:11.307Z","updated_at":"2026-11-02T14:34:39.233406Z"}],"euvd":[{"id":"EUVD-2022-32530","description":"Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.","status":"published","published":"2022-04-15T13:06:35Z","modified":"2024-08-03T05:41:11Z","updated_at":"2026-11-03T03:25:41.471197Z"}],"ghsa":[{"id":"GHSA-2qww-cm69-c4w4","title":"Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c...","description":"Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.","status":"published","published":"2022-04-16T00:00:52Z","modified":"2023-01-27T05:01:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:41:56.851256Z"}],"nvd":[{"id":"CVE-2022-28044","description":"Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.","status":"published","published":"2022-04-15T14:15:07.66Z","modified":"2026-06-17T04:37:54.203Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:15.414503Z"}],"osv":[{"id":"ALPINE-CVE-2022-28044","description":"Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.","status":"published","published":"2022-04-15T14:15:07.66Z","modified":"2026-11-03T07:31:25.649539649Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"DEBIAN-CVE-2022-28044","description":"Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.","status":"published","published":"2022-04-15T14:15:07.66Z","modified":"2026-11-03T08:01:11.358184717Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"UBUNTU-CVE-2022-28044","description":"Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.","status":"published","published":"2022-04-15T14:15:00Z","modified":"2026-03-14T09:06:31.665857Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"CVE-2022-28044","description":"Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.","status":"published","published":"2022-04-15T13:06:35Z","modified":"2026-10-28T10:27:56.884605928Z","updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"DLA-3005-1","title":"lrzip - security update","status":"published","published":"2022-05-13T00:00:00Z","modified":"2026-03-09T01:23:35.869669Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5145-1","title":"lrzip - security update","status":"published","published":"2022-05-24T00:00:00Z","modified":"2026-03-09T02:09:15.971317Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"USN-5840-1","title":"lrzip vulnerabilities","description":"It was discovered that Long Range ZIP incorrectly handled pointers. If \na user or an automated system were tricked into opening a certain \nspecially crafted ZIP file, an attacker could possibly use this issue\nto cause a denial of service. This issue only affected Ubuntu 14.04 ESM,\nUbuntu 16.04 ESM, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2020-25467)\n\nIt was discovered that Long Range ZIP incorrectly handled pointers. If \na user or an automated system were tricked into opening a certain \nspecially crafted ZIP file, an attacker could possibly use this issue \nto cause a denial of service. This issue only affected Ubuntu 18.04 LTS\nand Ubuntu 20.04 LTS. (CVE-2021-27345, CVE-2021-27347)\n\nIt was discovered that Long Range ZIP incorrectly handled pointers. If \na user or an automated system were tricked into opening a certain \nspecially crafted ZIP file, an attacker could possibly use this issue\nto cause a denial of service. This issue only affected Ubuntu 16.04 ESM,\nUbuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2022-26291)\n\nIt was discovered that Long Range ZIP incorrectly handled memory allocation, \nwhich could lead to a heap memory corruption. An attacker could possibly use\nthis issue to cause denial of service. This issue affected Ubuntu 14.04 ESM,\nUbuntu 16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and \nUbuntu 22.10. (CVE-2022-28044)\n","status":"published","published":"2023-02-02T13:36:09Z","modified":"2026-06-29T13:50:46.347622385Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}