{"id":"CVE-2022-33070","aliases":["ALPINE-CVE-2022-33070","AZL-9973","BELL-CVE-2022-33070","DEBIAN-CVE-2022-33070","EUVD-2022-36127","GHSA-xcrq-6j7j-784j","OESA-2022-1789","OESA-2022-1904","UBUNTU-CVE-2022-33070","USN-5531-1","USN-5811-1","openSUSE-SU-2024:12175-1"],"status":"published","title":"Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function...","description":"Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0111,"percentile":0.66145,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-06-22T13:24:44Z","modified":"2026-11-03T08:04:08Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"protobuf-c","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"protobuf-c","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"protobuf-c","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"protobuf-c","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"protobuf-c","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"protobuf-c","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"protobuf-c","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"protobuf-c","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"protobuf-c","fixed_in":["1.4.0-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"protobuf-c","fixed_in":["1.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"protobuf-c","fixed_in":["1.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"protobuf-c","fixed_in":["1.4.1-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"protobuf-c","fixed_in":["1.4.0-2.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"sudo","fixed_in":["1.9.2-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"sudo","fixed_in":["1.9.2-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"sudo","fixed_in":["1.9.8p2-3.oe2203"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"protobuf-c","fixed_in":["1.3.3-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"protobuf-c","fixed_in":["1.3.3-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"sudo","fixed_in":["1.9.9-1ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-2.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.8p2-3.oe2203"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10.7-0ubuntu4.1","1:2.10.7-0ubuntu4.2","1:2.10.9-0ubuntu1","1:2.10.9-0ubuntu2","1:2.10.9-0ubuntu3","1:2.10.9-0ubuntu3.1","1:2.10.9-0ubuntu3.2","1:2.10.9-0ubuntu3.3","1:2.10.9-0ubuntu3.4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14-1ubuntu1","0.15-1","0.15-1build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"argyll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0+repack-4","1.8.2+repack-1","1.8.3+repack-1","1.8.3+repack-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libgadu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.12.1-2","1:1.12.1-2build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ocserv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1","0.10.10-1","0.10.10-1ubuntu1","0.10.11-1","0.10.11-1build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10.11-0ubuntu4","1:2.10.11-0ubuntu5","1:2.10.12-0ubuntu1","1:2.10.12-0ubuntu2","1:2.10.12-0ubuntu3","1:2.10.12-0ubuntu4","1:2.10.12-0ubuntu5","1:2.10.12-0ubuntu5.1","1:2.10.12-0ubuntu5.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-1build2","1.1.1-1","1.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"argyll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.2+repack-1","1.9.2+repack-2","2.0.0+repack-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libgadu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.12.2-2","1:1.12.2-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libsignal-protocol-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.1+git20171007-2","2.3.1+git20171007-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ocserv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.6-2","0.11.9-1","0.11.9-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.12.0-1ubuntu2","1:2.12.0-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-1ubuntu0.1"}]}],"versions":["1.3.1-1build1","1.3.2-1","1.3.3-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"argyll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+repack-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ccextractor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.87+ds1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libgadu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.12.2-3","1:1.12.2-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libsignal-protocol-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ocserv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.2-3build1","0.12.2-3build2","0.12.5-1","0.12.6-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.13.0-2.2ubuntu1","1:2.13.0-2.2ubuntu2","1:2.13.0-2.2ubuntu3","1:2.13.0-2.2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"argyll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+repack-2","2.2.0+repack-1","2.2.0+repack-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ccextractor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.88+ds1-1","0.93+ds2-1","0.93+ds2-1ubuntu1","0.93+ds2-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libgadu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.12.2-5","1:1.12.2-6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libpg-query","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["13-2.1.0-1","13-2.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsignal-protocol-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.3-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ocserv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2-2","1.1.3-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.14.1-1ubuntu1","1:2.14.8-1ubuntu1","1:2.14.8-1ubuntu2","1:2.14.8-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-1ubuntu2.1"}]}],"versions":["1.3.3-1build2","1.3.3-1ubuntu1","1.3.3-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-1ubuntu2.2"}]}],"versions":["1.9.5p2-3ubuntu2","1.9.9-1ubuntu2","1.9.9-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"argyll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.1+repack-1ubuntu2","3.1.0+repack-1","3.1.0+repack-1build2","3.1.0+repack-1build3","3.1.0+repack-1build4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ccextractor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.94+ds1-3","0.94+ds1-3build2","0.94+ds1-3build3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libgadu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.12.2-6","1:1.12.2-6.1","1:1.12.2-6.1build1","1:1.12.2-6.1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libpg-query","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15-4.2.3-1","15-4.2.3-2","16-5.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsignal-protocol-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.3-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ocserv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-1","1.2.1-1","1.2.2-1","1.2.4-1","1.2.4-1build1","1.2.4-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.14.12-1ubuntu1","1:2.14.12-1ubuntu2","1:2.14.13-1ubuntu1","1:2.14.13-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"argyll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.0+repack-1.1","3.3.0+repack-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libgadu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.12.2-6.1build2","1:1.12.2-6.1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libpg-query","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17-6.0.0-1","17-6.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libsignal-protocol-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.3-6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ocserv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0-1","1.3.0-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.14.14-1ubuntu1","1:2.14.14-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"argyll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0+repack-1.1","3.5.0+repack-1","3.5.0+repack-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libgadu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.12.2-7","1:1.12.2-8"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libpg-query","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17-6.2.2-1","18.0.0-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsignal-protocol-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.3-6.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ocserv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0-3","1.4.1-1","1.5.0-1","1.5.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.14.14-1ubuntu3","1:2.14.14-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"argyll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0+repack-1","3.3.0+repack-1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libgadu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.12.2-6.1build3","1:1.12.2-7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libpg-query","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17-6.1.0-1","17-6.2.0-1","17-6.2.0-2","17-6.2.1-1","17-6.2.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsignal-protocol-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.3-6","2.3.3-6.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ocserv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0-2","1.3.0-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pidgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.14.14-1ubuntu2","1:2.14.14-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-1ubuntu0.1"}]}],"versions":["1.3.1-1build1","1.3.2-1","1.3.3-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"protobuf-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-1ubuntu2.1"}]}],"versions":["1.3.3-1build2","1.3.3-1ubuntu1","1.3.3-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.21p2-3ubuntu1.5"}]}],"versions":["1.8.20p2-1ubuntu1","1.8.21p2-2ubuntu1","1.8.21p2-3ubuntu1","1.8.21p2-3ubuntu1.1","1.8.21p2-3ubuntu1.2","1.8.21p2-3ubuntu1.3","1.8.21p2-3ubuntu1.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.31-1ubuntu1.4"}]}],"versions":["1.8.27-1ubuntu4","1.8.29-1ubuntu1","1.8.31-1ubuntu1","1.8.31-1ubuntu1.1","1.8.31-1ubuntu1.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-1ubuntu2.2"}]}],"versions":["1.9.5p2-3ubuntu2","1.9.9-1ubuntu2","1.9.9-1ubuntu2.1"],"bundled":2}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"protobuf-c_project","product":"protobuf-c"}],"references":[{"url":"https://github.com/protobuf-c/protobuf-c/issues/506","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","report"]},{"url":"https://github.com/protobuf-c/protobuf-c/pull/508","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFN2GHUEGTSHRD7J5PKQ5DRSJSEQ2IKN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-33070","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFN2GHUEGTSHRD7J5PKQ5DRSJSEQ2IKN"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FFN2GHUEGTSHRD7J5PKQ5DRSJSEQ2IKN"},{"url":"https://github.com/advisories/GHSA-xcrq-6j7j-784j"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-33070","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-33070","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/33xxx/CVE-2022-33070.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-33070","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1789","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1904","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-33070","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5531-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5811-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-33070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-22809","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-33070","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-33070","description":"Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.","status":"published","published":"2022-06-22T13:24:44Z","modified":"2026-10-08T21:03:10.715Z","updated_at":"2026-11-02T14:34:40.621895Z"}],"euvd":[{"id":"EUVD-2022-36127","description":"Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.","status":"published","published":"2022-06-22T13:24:44Z","modified":"2026-10-08T21:03:10Z","updated_at":"2026-11-02T17:27:27.240961Z"}],"ghsa":[{"id":"GHSA-xcrq-6j7j-784j","title":"Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function...","description":"Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.","status":"published","published":"2022-06-24T00:00:30Z","modified":"2026-10-08T21:34:01Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:12:58.478725Z"}],"nvd":[{"id":"CVE-2022-33070","description":"Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.","status":"published","published":"2022-06-23T17:15:14.43Z","modified":"2026-10-08T21:17:48.77Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:07:22.613788Z"}],"osv":[{"id":"ALPINE-CVE-2022-33070","description":"Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.","status":"published","published":"2022-06-23T17:15:14.43Z","modified":"2026-11-03T07:18:33.453434603Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-9973","title":"CVE-2022-33070 affecting package protobuf-c for versions less than 1.4.0-2","description":"Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.","status":"published","published":"2022-06-23T17:15:14Z","modified":"2026-04-21T04:35:11.642022Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BELL-CVE-2022-33070","title":"CVE-2022-33070 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:13.336085Z","modified":"2026-01-26T09:49:19.977289Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"DEBIAN-CVE-2022-33070","description":"Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.","status":"published","published":"2022-06-23T17:15:14.43Z","modified":"2026-11-03T08:04:08.037670491Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"OESA-2022-1789","title":"protobuf-c security update","description":"This is protobuf-c, a C implementation of the Google Protocol Buffers data serialization format.\r\n\r\nSecurity Fix(es):\r\n\r\nProtobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.(CVE-2022-33070)","status":"published","published":"2022-07-30T11:05:03Z","modified":"2026-08-18T01:16:52.123106799Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-1904","title":"sudo security update","description":"Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity.  The basic philosophy is to give as few privileges as possible but still allow people to get their work done.\r\n\r\nSecurity Fix(es):\r\n\r\nProtobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.(CVE-2022-33070)","status":"published","published":"2022-09-09T11:05:11Z","modified":"2026-08-18T01:16:36.913948737Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-33070","description":"Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.","status":"published","published":"2022-06-23T17:15:00Z","modified":"2026-10-17T12:57:14.667444053Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"CVE-2022-33070","description":"Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.","status":"published","published":"2022-06-22T13:24:44Z","modified":"2026-10-28T02:30:40.485101144Z","updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"openSUSE-SU-2024:12175-1","title":"libprotobuf-c-devel-1.4.0-3.1 on GA media","description":"These are all security issues fixed in the libprotobuf-c-devel-1.4.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:24:32.817794Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"USN-5531-1","title":"protobuf-c vulnerability","description":"Pietro Borrello discovered that protobuf-c contained an invalid\narithmetic shift. This vulnerability allowed attackers to cause a\ndenial of service (system crash) via unspecified vectors\n(CVE-2022-33070).\n\nIt was discovered that protobuf-c contained an unsigned integer\noverflow. This vulnerability allowed attackers to cause a denial of\nservice (system crash) via unspecified vectors.\n\nTodd Miller discovered that protobuf-c contained a possible NULL\ndereference. This could cause a vulnerability that allowed attackers to\ncause a denial of service (system crash) via unspecified vectors.\n","status":"published","published":"2022-07-26T16:28:27Z","modified":"2026-04-27T19:19:35.611825Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5811-1","title":"sudo vulnerabilities","description":"Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly\nhandled user-specified editors when using the sudoedit command. A local\nattacker that has permission to use the sudoedit command could possibly use\nthis issue to edit arbitrary files. (CVE-2023-22809)\n\nIt was discovered that the Protobuf-c library, used by Sudo, incorrectly\nhandled certain arithmetic shifts. An attacker could possibly use this\nissue to cause Sudo to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 22.04 LTS. (CVE-2022-33070)\n","status":"published","published":"2023-01-18T17:44:58Z","modified":"2026-04-27T16:32:21.600085377Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}