{"id":"CVE-2022-40320","aliases":["AZL-10925","AZL-34910","DEBIAN-CVE-2022-40320","EUVD-2022-43611","GHSA-4f2q-2458-j6j8","MGASA-2022-0387","OESA-2022-1928","SUSE-SU-2022:3331-1","SUSE-SU-2022:3807-1","UBUNTU-CVE-2022-40320","openSUSE-SU-2024:12324-1"],"status":"published","title":"cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.","description":"cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01455,"percentile":0.73645,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2022-09-09T20:38:22Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:2","package":"libconfuse","fixed_in":["3.3-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libconfuse","fixed_in":["3.3-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libconfuse","fixed_in":["3.3-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libconfuse","fixed_in":["3.3-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libconfuse","fixed_in":["3.3-3"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"libconfuse","fixed_in":["3.3-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"libconfuse","fixed_in":["3.3-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"libconfuse","fixed_in":["3.3-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"libconfuse","fixed_in":["3.3-2.oe2203"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"libconfuse0","fixed_in":["2.8-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP3","package":"libconfuse0","fixed_in":["2.8-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"libconfuse0","fixed_in":["2.8-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"libconfuse0","fixed_in":["2.8-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"libconfuse0","fixed_in":["2.8-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"libconfuse0","fixed_in":["2.8-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"libconfuse0","fixed_in":["2.8-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"libconfuse0","fixed_in":["2.8-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"libconfuse0","fixed_in":["2.8-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libconfuse0","fixed_in":["2.8-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libconfuse0","fixed_in":["2.8-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"libconfuse0","fixed_in":["2.8-150000.3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"libconfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libconfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libconfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libconfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libconfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3-3"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"libconfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libconfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"libconfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"libconfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3-2.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"libconfuse0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP3","package":"libconfuse0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"libconfuse0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"libconfuse0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"libconfuse0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"libconfuse0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"libconfuse0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"libconfuse0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"libconfuse0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libconfuse0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libconfuse0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libconfuse0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libconfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libconfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3-3","3.3-3build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libconfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3-3build1","3.3-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libconfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3-4build1","3.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libconfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3-4","3.3-4build1"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libconfuse_project","product":"libconfuse"}],"references":[{"url":"https://github.com/libconfuse/libconfuse/issues/163","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EDUT2V62V2XF2IT5TJFPB6P3EQ6X5VLL/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BSAZK4KAWRWNAFUBBXOYU3PVNH3X7226/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FJKHAPJ6AUWVP4HDGKH4M5A2XXWQI73O/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40320","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSAZK4KAWRWNAFUBBXOYU3PVNH3X7226/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EDUT2V62V2XF2IT5TJFPB6P3EQ6X5VLL/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJKHAPJ6AUWVP4HDGKH4M5A2XXWQI73O/"},{"url":"https://github.com/advisories/GHSA-4f2q-2458-j6j8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/40xxx/CVE-2022-40320.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-40320","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0387.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30856","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/EDUT2V62V2XF2IT5TJFPB6P3EQ6X5VLL/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1928","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223331-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1203326","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-40320","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223807-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-40320","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40320","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-40320","description":"cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.","status":"published","published":"2022-09-09T20:38:22Z","modified":"2024-08-03T12:14:40.077Z","updated_at":"2026-11-02T14:34:30.493103Z"}],"euvd":[{"id":"EUVD-2022-43611","description":"cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.","status":"published","published":"2022-09-09T20:38:22Z","modified":"2024-08-03T12:14:40Z","updated_at":"2026-11-03T03:25:20.908483Z"}],"ghsa":[{"id":"GHSA-4f2q-2458-j6j8","title":"cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.","description":"cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.","status":"published","published":"2022-09-10T00:00:22Z","modified":"2023-01-30T05:03:35Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:46:52.374347Z"}],"nvd":[{"id":"CVE-2022-40320","description":"cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.","status":"published","published":"2022-09-09T21:15:08.577Z","modified":"2026-06-17T05:01:18.85Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:27.631109Z"}],"osv":[{"id":"AZL-10925","title":"CVE-2022-40320 affecting package libconfuse for versions less than 3.3-2","description":"cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.","status":"published","published":"2022-09-09T21:15:08Z","modified":"2026-04-21T04:21:40.994894Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"AZL-34910","title":"CVE-2022-40320 affecting package libconfuse for versions less than 3.3-2","description":"cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.","status":"published","published":"2022-09-09T21:15:08Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.380321Z"},{"id":"DEBIAN-CVE-2022-40320","description":"cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.","status":"published","published":"2022-09-09T21:15:08.577Z","modified":"2026-11-03T08:02:27.551488675Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"OESA-2022-1928","title":"libconfuse security update","description":"libConfuse is a configuration file parser library, licensed under the terms of the ISC license, and written in C. It supports sections and (lists of) values (strings, integers, floats, booleans or other sections), as well as some other features (such as single/double-quoted strings, environment variable expansion, functions and nested include statements). It makes it very easy to add configuration file capability to a program using a simple API. The goal of libConfuse is not to be the configuration file parser library with a gazillion of features. Instead, it aims to be easy to use and quick to integrate with your code.\r\n\r\nSecurity Fix(es):\r\n\r\ncfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.(CVE-2022-40320)","status":"published","published":"2022-09-23T11:05:14Z","modified":"2026-08-18T01:17:17.122881359Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-40320","description":"cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.","status":"published","published":"2022-09-09T21:15:00Z","modified":"2026-10-17T12:55:59.158123807Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"CVE-2022-40320","description":"cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.","status":"published","published":"2022-09-09T20:38:22Z","modified":"2026-10-28T02:30:55.924334507Z","updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"MGASA-2022-0387","title":"Updated libconfuse packages fix security vulnerability","description":"cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer\nover-read. (CVE-2022-40320)\n","status":"published","published":"2022-10-23T22:48:35Z","modified":"2026-04-16T04:42:50.078526841Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12324-1","title":"libconfuse-devel-3.3-2.1 on GA media","description":"These are all security issues fixed in the libconfuse-devel-3.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:03:24.192566Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:3331-1","title":"Security update for libconfuse0","description":"This update for libconfuse0 fixes the following issues:\n\n- CVE-2022-40320: Fixed a heap-based buffer over-read in cfg_tilde_expand in confuse.c (bsc#1203326).\n","status":"published","published":"2022-09-21T14:41:32Z","modified":"2026-02-04T04:29:44.20151Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3807-1","title":"Security update for libconfuse0","description":"This update for libconfuse0 fixes the following issues:\n\n- CVE-2022-40320: Fixed a heap-based buffer over-read in cfg_tilde_expand in confuse.c (bsc#1203326).\n","status":"published","published":"2022-10-28T04:34:57Z","modified":"2026-02-04T04:33:04.069944Z","updated_at":"2026-11-02T15:53:51.440565Z"}]}}