CVE-2022-35020

Vulnerability

Advancecomp version 2.3 is affected by a heap buffer overflow vulnerability. The flaw resides in the __interceptor_memcpy function within /sanitizer_common/sanitizer_common_interceptors.inc. When processing specially crafted compressed files, the program may copy data beyond the bounds of a heap buffer, leading to memory corruption. No specific preconditions beyond opening a malicious file are described in the available references [1], [2], [3].

Exploitation

The attacker must supply a crafted compressed file that, when processed by advancecomp v2.3, triggers an exploitable heap buffer overflow in the __interceptor_memcpy interceptor. Exact attack steps have not been detailed in the public references [1], [2], [3]; however, exploitation typically involves sending the malicious file to the target user or system for processing.

Impact

Successful exploitation could allow an attacker to corrupt adjacent heap memory, potentially leading to information disclosure, application crashes, or arbitrary code execution with the privileges of the user running advancecomp. The specific impact depends on the attacker's ability to control the overflow size and content [1], [2], [3].

Mitigation

No patched version has been announced in the available references [1], [2], [3]. Users are advised to watch for updates to Advancecomp and apply the fix when available. Fedora package announcements referencing this CVE indicate that the flaw is known, but no fix is publicly released yet [1], [2], [3]. As a workaround, avoid processing untrusted compressed files with advancecomp v2.3.