{"id":"CVE-2022-33967","aliases":["DEBIAN-CVE-2022-33967","DLA-4150-1","EUVD-2022-37003","GHSA-m6jw-rg4f-jw25","OESA-2022-1800","SUSE-SU-2022:2653-1","SUSE-SU-2022:2661-1","UBUNTU-CVE-2022-33967","USN-5764-1"],"status":"published","title":"squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains...","description":"squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00558,"percentile":0.46782,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2022-07-20T06:15:22Z","modified":"2026-11-03T06:02:22Z","fixes":[{"ecosystem":"Debian:12","package":"u-boot","fixed_in":["2022.07+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"u-boot","fixed_in":["2022.07+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"u-boot","fixed_in":["2022.07+dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"uboot-tools","fixed_in":["2021.10-6.oe2203"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"u-boot","fixed_in":["2020.10+dfsg-1ubuntu0~18.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"u-boot","fixed_in":["2021.01+dfsg-3ubuntu0~20.04.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"u-boot","fixed_in":["2022.01+dfsg-2ubuntu2.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.07+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.07+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.07+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01+dfsg-5+deb11u1"}]}],"versions":["2021.01+dfsg-5"],"bundled":14},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"uboot-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-6.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"u-boot-rpiarm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-avnetultra96rev1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-bananapim64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-dragonboard410c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-dragonboard820c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-evb-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-firefly-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-geekbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-hikey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-khadas-vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-khadas-vim2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-libretech-ac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-libretech-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-ls1012afrdmqspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-mvebudb-88f3720","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-mvebudbarmada8k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-mvebuespressobin-88f3720","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-mvebumcbin-88f8040","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-nanopia64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-odroid-c2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-odroid-c4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-odroid-n2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-orangepipc2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-p2371-2180","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-p2771-0000-500","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-p3450-0000","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-pine64plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-pinebook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-pinebook-pro-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-pineh64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-pinephone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-poplar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-rock-pi-4-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-rock64-rk3328","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-rock960-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-rockpro64-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-rpi3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-rpi4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-rpiarm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-xilinxzynqmpvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"u-boot-xilinxzynqmpzcu102rev10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"u-boot-rpiarm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-avnetultra96rev1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-bananapim64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-dragonboard410c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-dragonboard820c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-evb-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-firefly-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-geekbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-hikey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-khadas-vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-khadas-vim2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-libretech-ac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-libretech-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-ls1012afrdmqspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-mvebudb-88f3720","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-mvebudbarmada8k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-mvebuespressobin-88f3720","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-mvebumcbin-88f8040","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-nanopia64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-odroid-c2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-odroid-c4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-odroid-n2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-orangepipc2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-p2371-2180","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-p2771-0000-500","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-p3450-0000","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-pine64plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-pinebook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-pinebook-pro-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-pineh64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-pinephone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-poplar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-rock-pi-4-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-rock-pi-n10-rk3399pro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-rock64-rk3328","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-rock960-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-rockpro64-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-rpi3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-rpi4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-rpiarm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-xilinxzynqmpvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"u-boot-xilinxzynqmpzcu102rev10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2015.04+dfsg1-2ubuntu1","2015.10+dfsg1-2","2015.10+dfsg1-3","2015.10+dfsg1-4","2016.01+dfsg1-1","2016.01+dfsg1-1ubuntu1","2016.01+dfsg1-2ubuntu1","2016.01+dfsg1-2ubuntu2","2016.01+dfsg1-2ubuntu3","2016.01+dfsg1-2ubuntu5","2016.01+dfsg1-2ubuntu5+esm1","2016.01+dfsg1-2ubuntu5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.10+dfsg-1ubuntu0~18.04.3"}]}],"versions":["2016.03+dfsg1-6ubuntu2","2018.07~rc3+dfsg1-0ubuntu1~18.04.1","2018.07~rc3+dfsg1-0ubuntu2~18.04.1","2018.07~rc3+dfsg1-0ubuntu3~18.04.1","2019.07+dfsg-1ubuntu4~18.04.1","2020.10+dfsg-1ubuntu0~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01+dfsg-3ubuntu0~20.04.5"}]}],"versions":["2019.07+dfsg-1ubuntu3","2019.07+dfsg-1ubuntu5","2019.07+dfsg-1ubuntu6","2020.10+dfsg-1ubuntu0~20.04.2","2021.01+dfsg-3ubuntu0~20.04.1","2021.01+dfsg-3ubuntu0~20.04.3","2021.01+dfsg-3ubuntu0~20.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.01+dfsg-2ubuntu2.3"}]}],"versions":["2021.07+dfsg-0ubuntu8","2021.07+dfsg-0ubuntu9","2021.07+dfsg-0ubuntu10","2022.01+dfsg-2ubuntu1","2022.01+dfsg-2ubuntu2","2022.01+dfsg-2ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.10+dfsg-1ubuntu0~18.04.3"}]}],"versions":["2016.03+dfsg1-6ubuntu2","2018.07~rc3+dfsg1-0ubuntu1~18.04.1","2018.07~rc3+dfsg1-0ubuntu2~18.04.1","2018.07~rc3+dfsg1-0ubuntu3~18.04.1","2019.07+dfsg-1ubuntu4~18.04.1","2020.10+dfsg-1ubuntu0~18.04.2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01+dfsg-3ubuntu0~20.04.5"}]}],"versions":["2019.07+dfsg-1ubuntu3","2019.07+dfsg-1ubuntu5","2019.07+dfsg-1ubuntu6","2020.10+dfsg-1ubuntu0~20.04.2","2021.01+dfsg-3ubuntu0~20.04.1","2021.01+dfsg-3ubuntu0~20.04.3","2021.01+dfsg-3ubuntu0~20.04.4"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.01+dfsg-2ubuntu2.3"}]}],"versions":["2021.07+dfsg-0ubuntu8","2021.07+dfsg-0ubuntu9","2021.07+dfsg-0ubuntu10","2022.01+dfsg-2ubuntu1","2022.01+dfsg-2ubuntu2","2022.01+dfsg-2ubuntu2.1"],"bundled":7}],"products":[{"vendor":"denx","product":"u-boot"},{"vendor":"denx software engineering","product":"u-boot"}],"references":[{"url":"https://www.denx.de/project/u-boot/","tags":["x_refsource_MISC","x_transferred","Product","web","report"]},{"url":"https://lists.denx.de/pipermail/u-boot/2022-June/487467.html","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Vendor Advisory","web","report"]},{"url":"https://source.denx.de/u-boot/u-boot/-/commit/7f7fb9937c6cb49dd35153bd6708872b390b0a44","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","Vendor Advisory","web"]},{"url":"https://jvn.jp/en/vu/JVNVU97846460/index.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00001.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-33967","tags":["advisory"]},{"url":"https://www.denx.de/project/u-boot"},{"url":"https://github.com/advisories/GHSA-m6jw-rg4f-jw25"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/33xxx/CVE-2022-33967.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-33967","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1800","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222653-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201214","tags":["report"]},{"url":"https://bugzilla.suse.com/1201745","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-33967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34835","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222661-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-33967","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5764-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-33967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-2347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30552","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30767","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-33103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-34835","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-33967","description":"squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.","status":"published","published":"2022-07-20T06:15:22Z","modified":"2025-11-03T19:27:07.915Z","updated_at":"2026-11-02T14:34:40.621895Z"}],"euvd":[{"id":"EUVD-2022-37003","description":"squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.","status":"published","published":"2022-07-20T06:15:22Z","modified":"2025-11-03T19:27:07Z","updated_at":"2026-11-02T19:49:34.152725Z"}],"ghsa":[{"id":"GHSA-m6jw-rg4f-jw25","title":"squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains...","description":"squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.","status":"published","published":"2022-07-21T00:00:34Z","modified":"2025-11-03T21:31:46Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:04:19.274788Z"}],"nvd":[{"id":"CVE-2022-33967","description":"squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.","status":"published","published":"2022-07-20T07:15:08.667Z","modified":"2026-06-17T04:49:33.65Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:23.686531Z"}],"osv":[{"id":"OESA-2022-1800","title":"uboot-tools security update","description":"This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fw_printenv and fw_setenv programs to read and modify U-Boot's environment.\r\n\r\nSecurity Fix(es):\r\n\r\nsquashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.(CVE-2022-33967)","status":"published","published":"2022-08-05T11:05:04Z","modified":"2026-08-18T01:16:35.987857584Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-33967","description":"squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.","status":"published","published":"2022-07-20T07:15:00Z","modified":"2026-10-17T12:56:02.544876382Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"CVE-2022-33967","description":"squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.","status":"published","published":"2022-07-20T06:15:22Z","modified":"2026-10-28T02:31:03.228742148Z","updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"DEBIAN-CVE-2022-33967","description":"squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.","status":"published","published":"2022-07-20T07:15:08.667Z","modified":"2026-11-03T06:02:22.906981859Z","updated_at":"2026-11-03T06:44:05.456691Z"},{"id":"DLA-4150-1","title":"u-boot - security update","status":"published","published":"2025-05-01T00:00:00Z","modified":"2026-03-09T02:09:33.100542Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"SUSE-SU-2022:2653-1","title":"Security update for u-boot","description":"This update for u-boot fixes the following issues:\n\n- CVE-2022-33967: Fixed heap overflow in squashfs filesystem implementation (bsc#1201745).\n- CVE-2022-34835: Fixed stack buffer overflow vulnerability in i2c md command (bsc#1201214).\n","status":"published","published":"2022-08-03T13:33:54Z","modified":"2026-02-04T02:42:15.576593Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2661-1","title":"Security update for u-boot","description":"This update for u-boot fixes the following issues:\n\n- CVE-2022-33967: Fixed heap overflow in squashfs filesystem implementation (bsc#1201745).\n- CVE-2022-34835: Fixed stack buffer overflow vulnerability in i2c md command (bsc#1201214).\n","status":"published","published":"2022-08-03T19:07:34Z","modified":"2026-02-04T04:15:20.616074Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5764-1","title":"u-boot vulnerabilities","description":"It was discovered that U-Boot incorrectly handled certain USB DFU download\nsetup packets. A local attacker could use this issue to cause U-Boot to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2022-2347)\n\nNicolas Bidron and Nicolas Guigo discovered that U-Boot incorrectly handled\ncertain fragmented IP packets. A local attacker could use this issue to\ncause U-Boot to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu\n20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-30552, CVE-2022-30790)\n\nIt was discovered that U-Boot incorrectly handled certain NFS lookup\nreplies. A remote attacker could use this issue to cause U-Boot to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04\nLTS. (CVE-2022-30767)\n\nJincheng Wang discovered that U-Boot incorrectly handled certain SquashFS\nstructures. A local attacker could use this issue to cause U-Boot to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and\nUbuntu 22.04 LTS. (CVE-2022-33103)\n\nTatsuhiko Yasumatsu discovered that U-Boot incorrectly handled certain\nSquashFS structures. A local attacker could use this issue to cause U-Boot\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and\nUbuntu 22.04 LTS. (CVE-2022-33967)\n\nIt was discovered that U-Boot incorrectly handled the i2c command. A local\nattacker could use this issue to cause U-Boot to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only\naffected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.\n(CVE-2022-34835)\n","status":"published","published":"2022-12-06T12:54:01Z","modified":"2026-04-27T16:22:20.178238Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}