{"id":"CVE-2022-4603","aliases":["ALPINE-CVE-2022-4603","AZL-11860","AZL-36979","BELL-CVE-2022-4603","CLSA-2026-1785768873","CLSA-2026-1786622639","DEBIAN-CVE-2022-4603","EUVD-2022-51935","GHSA-82mr-xx64-4rjv","OESA-2023-1015","SUSE-SU-2023:4961-1","SUSE-SU-2023:4965-1","SUSE-SU-2024:2380-1","openSUSE-SU-2024:13529-1"],"status":"disputed","title":"ppp pppdump pppdump.c dumpppp array index","description":"A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00891,"percentile":0.59716,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2022-12-18T00:00:00Z","modified":"2026-10-28T10:31:07Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"ppp","fixed_in":["2.4.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"ppp","fixed_in":["2.4.9-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"ppp","fixed_in":["2.4.9-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"ppp","fixed_in":["2.4.9-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"ppp","fixed_in":["2.4.9-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"ppp","fixed_in":["2.4.9-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"ppp","fixed_in":["2.4.9-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ppp","fixed_in":["2.4.9-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ppp","fixed_in":["2.4.9-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ppp","fixed_in":["2.4.9-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ppp","fixed_in":["2.4.9-r6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"ppp","fixed_in":["2.5.0-1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"network-scripts-ppp","fixed_in":["2.4.9-5.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"ppp","fixed_in":["2.4.9-5.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"ppp-devel","fixed_in":["2.4.9-5.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"network-scripts-ppp","fixed_in":["2.4.9-5.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"ppp","fixed_in":["2.4.9-5.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"ppp-devel","fixed_in":["2.4.9-5.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ppp","fixed_in":["2.5.0-1+2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ppp","fixed_in":["2.5.0-1+2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"ppp","fixed_in":["2.4.8-4.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"ppp","fixed_in":["2.4.8-4.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"ppp","fixed_in":["2.4.9-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"ppp","fixed_in":["2.4.9-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"ppp","fixed_in":["2.4.7-4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ppp","fixed_in":["2.4.7-4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ppp","fixed_in":["2.4.7-4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"ppp","fixed_in":["2.4.7-150000.5.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"ppp","fixed_in":["2.4.7-150000.5.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"ppp","fixed_in":["2.4.7-150000.5.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"ppp","fixed_in":["2.4.7-150000.5.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP4","package":"ppp","fixed_in":["2.4.7-150000.5.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"ppp","fixed_in":["2.4.7-150000.5.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.4","package":"ppp","fixed_in":["2.4.7-150000.5.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"ppp","fixed_in":["2.4.7-150000.5.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"ppp","fixed_in":["2.4.7-150000.5.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ppp","fixed_in":["2.5.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r6"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4.7-36"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"network-scripts-ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-5.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-5.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ppp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-5.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"network-scripts-ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-5.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-5.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ppp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-5.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.9-1+1.1","2.5.0-1+1","2.5.0-1+2","2.5.1-1+1","2.5.1-1+1~exp1","2.5.2-1+1","2.5.2-1+1.1","2.5.2-1+1.2","2.5.2-1+1~exp1","2.5.2-1+2"]},{"source":"osv","ecosystem":"Debian:13","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1+2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1+2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-4.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-4.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-150000.5.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-150000.5.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-150000.5.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-150000.5.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP4","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-150000.5.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-150000.5.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-150000.5.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-150000.5.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-150000.5.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-150000.5.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ppp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.1"}]}]}],"products":[{"vendor":"samba","product":"ppp"},{"vendor":"unspecified","product":"ppp"}],"references":[{"url":"https://github.com/ppp-project/ppp/commit/a75fb7b198eed50d769c80c36629f38346882cbf","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://vuldb.com/?id.216198","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J43NP7ABHOCIWOFHWCH6ZCZOYKZH6723/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J43NP7ABHOCIWOFHWCH6ZCZOYKZH6723/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4603","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J43NP7ABHOCIWOFHWCH6ZCZOYKZH6723"},{"url":"https://github.com/advisories/GHSA-82mr-xx64-4rjv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-4603","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-4603","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1785768873.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1786622639.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4603.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-4603","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1015","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234961-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218251","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4603","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234965-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242380-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-4603","title":"ppp pppdump pppdump.c dumpppp array index","description":"A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.","status":"disputed","published":"2022-12-18T00:00:00Z","modified":"2024-08-03T01:41:45.809Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:34:37.932195Z"}],"euvd":[{"id":"EUVD-2022-51935","description":"A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.","status":"published","published":"2022-12-18T00:00:00Z","modified":"2024-08-03T01:41:45Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T03:25:56.529973Z"}],"ghsa":[{"id":"GHSA-82mr-xx64-4rjv","title":"** DISPUTED ** A vulnerability classified as problematic has been found in ppp. Affected is the...","description":"** DISPUTED ** A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.","status":"published","published":"2022-12-18T12:30:20Z","modified":"2024-03-30T05:01:46Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:55:45.190481Z"}],"nvd":[{"id":"CVE-2022-4603","description":"A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.","status":"disputed","published":"2022-12-18T11:15:11.077Z","modified":"2026-06-17T05:21:19.543Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:07:34.031641Z"}],"osv":[{"id":"ALPINE-CVE-2022-4603","description":"A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.","status":"published","published":"2022-12-18T11:15:11.077Z","modified":"2026-11-03T07:18:33.77446962Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"AZL-11860","title":"CVE-2022-4603 affecting package ppp 2.4.7-36","description":"A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.","status":"published","published":"2022-12-18T11:15:11Z","modified":"2026-04-21T04:22:22.450851Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"AZL-36979","title":"CVE-2022-4603 affecting package ppp for versions less than 2.5.0-1","description":"A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.","status":"published","published":"2022-12-18T11:15:11Z","modified":"2026-04-21T04:33:46.936171Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"BELL-CVE-2022-4603","title":"CVE-2022-4603 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:50.332352Z","modified":"2026-01-26T09:49:24.875812Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-4603","title":"ppp pppdump pppdump.c dumpppp array index","description":"A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.","status":"published","published":"2022-12-18T00:00:00Z","modified":"2026-10-28T10:31:07.681350053Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"DEBIAN-CVE-2022-4603","description":"A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.","status":"published","published":"2022-12-18T11:15:11.077Z","modified":"2026-11-03T08:04:12.03198788Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"OESA-2023-1015","title":"ppp security update","description":"The Point-to-Point Protocol (PPP) provides a standard way to establish a network connection over a serial link.  At present, this package supports IP and IPV6 and the protocols layered above them, such as TCP and UDP.  The Linux port of this package also has support for IPX.\r\n\r\nSecurity Fix(es):\r\n\r\n** DISPUTED ** A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.(CVE-2022-4603)","status":"published","published":"2023-01-06T11:05:29Z","modified":"2026-08-18T01:17:29.658628827Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"CLSA-2026-1785768873","title":"ppp: Fix of CVE-2022-4603","description":"- CVE-2022-4603: prevent out-of-range access to pppdump packet buffers","status":"published","published":"2026-08-03T14:54:44Z","modified":"2026-10-26T09:30:30.708954165Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786622639","title":"ppp: Fix of CVE-2022-4603","description":"- CVE-2022-4603: prevent out-of-range access to pppdump packet buffers","status":"published","published":"2026-08-13T12:04:15Z","modified":"2026-10-26T09:31:26.330387266Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"openSUSE-SU-2024:13529-1","title":"ppp-2.5.0-1.1 on GA media","description":"These are all security issues fixed in the ppp-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:17:01.148645Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:4961-1","title":"Security update for ppp","description":"This update for ppp fixes the following issues:\n\n- CVE-2022-4603: Fixed improper validation of array index of the component pppdump (bsc#1218251).\n","status":"published","published":"2023-12-22T10:03:43Z","modified":"2026-02-04T03:21:24.340722Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4965-1","title":"Security update for ppp","description":"This update for ppp fixes the following issues:\n\n- CVE-2022-4603: Fixed improper validation of array index of the component pppdump (bsc#1218251).\n","status":"published","published":"2023-12-22T15:33:47Z","modified":"2026-02-04T02:45:44.2903Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2024:2380-1","title":"Security update for ppp","description":"This update for ppp fixes the following issues:\n\n- CVE-2022-4603: Fixed improper validation of array index of the component pppdump (bsc#1218251).\n","status":"published","published":"2024-07-09T17:29:11Z","modified":"2026-02-04T02:51:44.661335Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}