{"id":"CVE-2022-32323","aliases":["ALSA-2023:2589","ALSA-2023:3067","EUVD-2022-53502","GHSA-5j5g-gfrq-r5jc","RHSA-2023:2589","RHSA-2023:3067","RLSA-2023:2589","RLSA-2023:3067","UBUNTU-CVE-2022-32323","openSUSE-SU-2022:10197-1","openSUSE-SU-2022:10199-1","openSUSE-SU-2024:12493-1"],"status":"published","title":"AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input...","description":"AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00943,"percentile":0.61333,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2022-07-14T20:11:45Z","modified":"2026-11-04T02:30:35Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"autotrace","fixed_in":["0.31.1-65.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"autotrace","fixed_in":["0.31.1-55.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"autotrace","fixed_in":["0:0.31.1-65.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"autotrace-debuginfo","fixed_in":["0:0.31.1-65.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"autotrace-debugsource","fixed_in":["0:0.31.1-65.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"autotrace","fixed_in":["0:0.31.1-55.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"autotrace-debuginfo","fixed_in":["0:0.31.1-55.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"autotrace-debugsource","fixed_in":["0:0.31.1-55.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"autotrace","fixed_in":["0:0.31.1-65.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"autotrace","fixed_in":["0:0.31.1-55.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"autotrace","fixed_in":["0.31.1-bp154.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"autotrace","fixed_in":["0.31.1-bp154.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"autotrace","fixed_in":["0.31.1-bp153.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"autotrace","fixed_in":["0.31.1-bp153.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"autotrace","fixed_in":["0.31.1-646.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"autotrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.1-65.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"autotrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.1-55.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"autotrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.31.1-65.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"autotrace-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.31.1-65.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"autotrace-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.31.1-65.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"autotrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.31.1-55.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"autotrace-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.31.1-55.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"autotrace-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.31.1-55.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"autotrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.31.1-65.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"autotrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.31.1-55.el8"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"autotrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.31.1-16build2","0.31.1-16+deb7u1build0.14.04.1","0.31.1-16+deb7u1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"autotrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.31.1-16+nmu1build1","0.31.1-16+nmu1.1","0.31.1-16+nmu1.2","0.31.1-16+nmu1.2ubuntu0.1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"autotrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.1-bp154.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"autotrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.1-bp154.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"autotrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.1-bp153.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"autotrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.1-bp153.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"autotrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.1-646.1"}]}]}],"products":[{"vendor":"autotrace_project","product":"autotrace"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://github.com/autotrace/autotrace/commit/2b44c173027736c64b3f379bd154c41bab745423","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKZPC4WCDOJ7BPJOMZ46AV27RCABZRYA/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CZVCQH4L7KC5GXLU6SCESXR5TGSKQ2H/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32323","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKZPC4WCDOJ7BPJOMZ46AV27RCABZRYA/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4CZVCQH4L7KC5GXLU6SCESXR5TGSKQ2H/"},{"url":"https://github.com/advisories/GHSA-5j5g-gfrq-r5jc"},{"url":"https://access.redhat.com/errata/RHSA-2023:2589","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32323","tags":["report"]},{"url":"https://bugzilla.redhat.com/2107471","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2589.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3067","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-3067.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/32xxx/CVE-2022-32323.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107471","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2589.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32323","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3067.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:2589","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:3067","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-32323","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BL5EXN47HTWFDUDXIE4KX7GLILJAE7FU/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201529","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32323","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WUMZT6BYF7XO3BJFTLFUUIIAHPDB3QMW/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-32323","description":"AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.","status":"published","published":"2022-07-14T20:11:45Z","modified":"2024-08-03T07:39:50.472Z","updated_at":"2026-11-02T14:34:36.917505Z"}],"euvd":[{"id":"EUVD-2022-53502","description":"AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.","status":"published","published":"2022-07-14T20:11:45Z","modified":"2024-08-03T07:39:50Z","updated_at":"2026-11-03T03:25:31.965622Z"}],"ghsa":[{"id":"GHSA-5j5g-gfrq-r5jc","title":"AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input...","description":"AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.","status":"published","published":"2022-07-15T00:00:15Z","modified":"2023-01-30T05:06:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:47:34.433705Z"}],"nvd":[{"id":"CVE-2022-32323","description":"AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.","status":"published","published":"2022-07-14T21:15:08.513Z","modified":"2026-06-17T04:47:06.79Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:23.686531Z"}],"osv":[{"id":"RHSA-2023:2589","title":"Red Hat Security Advisory: autotrace security update","status":"published","published":"2024-09-13T21:11:10Z","modified":"2026-06-29T10:47:42Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:3067","title":"Red Hat Security Advisory: autotrace security update","status":"published","published":"2024-09-13T21:11:10Z","modified":"2026-06-29T10:47:55Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RLSA-2023:2589","title":"Moderate: autotrace security update","description":"AutoTrace is a program for converting bitmaps to vector graphics.\n\nSecurity Fix(es):\n\n* autotrace: heap-buffer overflow via the ReadImage() at input-bmp.c (CVE-2022-32323)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.2 Release Notes linked from the References section.","status":"published","published":"2026-06-28T00:03:40.626303Z","modified":"2026-06-28T00:30:04.329964098Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2023:3067","title":"Moderate: autotrace security update","description":"AutoTrace is a program for converting bitmaps to vector graphics.\n\nSecurity Fix(es):\n\n* autotrace: heap-buffer overflow via the ReadImage() at input-bmp.c (CVE-2022-32323)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.","status":"published","published":"2026-06-28T00:01:40.098233Z","modified":"2026-06-28T00:30:04.29338638Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2022-32323","description":"AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.","status":"published","published":"2022-07-14T21:15:00Z","modified":"2026-04-22T13:25:03.329359Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"ALSA-2023:2589","title":"Moderate: autotrace security update","description":"AutoTrace is a program for converting bitmaps to vector graphics.\n\nSecurity Fix(es):\n\n* autotrace: heap-buffer overflow via the ReadImage() at input-bmp.c (CVE-2022-32323)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:30:55.914715529Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:3067","title":"Moderate: autotrace security update","description":"AutoTrace is a program for converting bitmaps to vector graphics.\n\nSecurity Fix(es):\n\n* autotrace: heap-buffer overflow via the ReadImage() at input-bmp.c (CVE-2022-32323)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-16T00:00:00Z","modified":"2026-10-29T11:02:05.847294134Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CVE-2022-32323","description":"AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.","status":"published","published":"2022-07-14T20:11:45Z","modified":"2026-11-04T02:30:35.656997398Z","updated_at":"2026-11-04T02:54:44.889498Z"},{"id":"openSUSE-SU-2022:10197-1","title":"Security update for autotrace","description":"This update for autotrace fixes the following issues:\n\n- CVE-2022-32323: Fixed Heap overflow in ReadImage() (boo#1201529).\n","status":"published","published":"2022-11-11T11:15:27Z","modified":"2025-05-07T18:14:08.52293Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:10199-1","title":"Security update for autotrace","description":"This update for autotrace fixes the following issues:\n\n- CVE-2022-32323: Fixed Heap overflow in ReadImage() (boo#1201529).\n","status":"published","published":"2022-11-11T11:15:43Z","modified":"2026-02-04T04:27:04.817397Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12493-1","title":"autotrace-0.31.1-646.1 on GA media","description":"These are all security issues fixed in the autotrace-0.31.1-646.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:38.705628Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}