GNU Fribidi vulnerabilities

4 CVEs affecting GNU Fribidi, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-25310, published 2022-09-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-18397, published 2019-11-13. High severity, CVSS 7.8. EPSS: 2.2% chance of exploitation in the next 30 days. A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute…
CVE-2022-25308, published 2022-09-06. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory leak or…
CVE-2022-25309, published 2022-09-06. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass…
CVE-2022-25310, published 2022-09-06. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw allows an attacker to pass a specially…