{"id":"CVE-2022-44370","aliases":["AZL-25934","BELL-CVE-2022-44370","DEBIAN-CVE-2022-44370","EUVD-2022-47315","GHSA-5hm2-2whx-4749","JLSEC-2026-203","OESA-2023-1245","UBUNTU-CVE-2022-44370"],"status":"published","title":"NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake()...","description":"NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00445,"percentile":0.3904,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2023-03-29T00:00:00Z","modified":"2026-10-28T02:31:10Z","fixes":[{"ecosystem":"Azure Linux:2","package":"nasm","fixed_in":["2.16-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nasm","fixed_in":["2.16.01-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nasm","fixed_in":["2.16.01-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nasm","fixed_in":["2.16.01-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nasm","fixed_in":["2.16.01-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nasm","fixed_in":["2.16.01-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"NASM_jll","fixed_in":["2.16.1+0"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"nasm","fixed_in":["2.15.03-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"nasm","fixed_in":["2.15.03-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"nasm","fixed_in":["2.15.05-5.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"nasm","fixed_in":["2.15.05-5.oe2203sp1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.05-r1"},{"fixed":"2.16.01-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.05-r1"},{"fixed":"2.16.01-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.01-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.01-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.01-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"NASM_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.16.1+0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.03-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.03-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.05-5.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.05-5.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.11.06-1really2.11.05-1","2.11.08-1","2.11.08-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.13.01-2","2.13.02-0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.02-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.15.05-1","2.15.05-1ubuntu0.1~esm1","2.15.05-1ubuntu0.1~esm2"]}],"products":[{"vendor":"nasm","product":"netwide_assembler"}],"references":[{"url":"https://bugzilla.nasm.us/show_bug.cgi?id=3392815","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://security.gentoo.org/glsa/202312-09","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44370","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5hm2-2whx-4749"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-44370","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/44xxx/CVE-2022-44370.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-44370","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1245","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-44370","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-44370","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-44370","description":"NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856","status":"published","published":"2023-03-29T00:00:00Z","modified":"2024-08-03T13:54:02.572Z","updated_at":"2026-11-02T14:34:30.176321Z"}],"euvd":[{"id":"EUVD-2022-47315","description":"NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856","status":"published","published":"2023-03-29T00:00:00Z","modified":"2024-08-03T13:54:02Z","updated_at":"2026-11-03T03:25:19.130756Z"}],"ghsa":[{"id":"GHSA-5hm2-2whx-4749","title":"NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake()...","description":"NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856","status":"published","published":"2023-03-29T21:30:16Z","modified":"2023-12-22T15:30:26Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:55:16.323735Z"}],"nvd":[{"id":"CVE-2022-44370","description":"NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856","status":"published","published":"2023-03-29T20:15:07.25Z","modified":"2026-06-17T05:08:14.097Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:37.020555Z"}],"osv":[{"id":"AZL-25934","title":"CVE-2022-44370 affecting package nasm for versions less than 2.16-1","description":"NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856","status":"published","published":"2023-03-29T20:15:07Z","modified":"2026-04-21T04:23:22.137849Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"BELL-CVE-2022-44370","status":"published","published":"2023-09-01T12:47:36.782103Z","modified":"2026-01-26T09:32:58.103033Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"JLSEC-2026-203","description":"NASM v2.16 was discovered to contain a heap buffer overflow in the component `quote_for_pmake()` `asm/nasm.c:856`","status":"published","published":"2026-04-27T13:45:07.015Z","modified":"2026-07-25T18:23:48.602506692Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2023-1245","title":"nasm security update","description":"NASM is the Netwide Assembler, a free portable assembler for the Intel 80x86 microprocessor series, using primarily the traditional Intel instruction mnemonics and syntax. It also provides tools in RDOFF binary format, includes linker, library manager, loader, and information dump.\r\n\r\nSecurity Fix(es):\r\n\r\nNASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856(CVE-2022-44370)","status":"published","published":"2023-04-21T11:05:43Z","modified":"2026-08-18T01:17:40.24336187Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2022-44370","description":"NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856","status":"published","published":"2023-03-29T20:15:00Z","modified":"2026-05-20T16:08:19.181696113Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"CVE-2022-44370","description":"NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856","status":"published","published":"2023-03-29T00:00:00Z","modified":"2026-10-28T02:31:10.549514161Z","updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"DEBIAN-CVE-2022-44370","description":"NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856","status":"published","published":"2023-03-29T20:15:07.25Z","modified":"2026-11-03T06:02:59.922198947Z","updated_at":"2026-11-03T06:43:01.507088Z"}]}}