{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/vex/2022/cve-2022-25309-els_os-cloudlinux7els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-25T04:27:27Z",
      "generator": {
        "date": "2026-10-25T04:27:27Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2022-25309-ELS_OS-CLOUDLINUX7ELS",
      "initial_release_date": "2022-09-06T18:15:00Z",
      "revision_history": [
        {
          "date": "2022-09-06T18:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-25T04:27:27Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2022-25309"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CloudLinux 7",
                "product": {
                  "name": "CloudLinux 7",
                  "product_id": "CloudLinux-7",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "CloudLinux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "fribidi-devel-0:1.0.2-1.el7_7.1.i686",
                "product": {
                  "name": "fribidi-devel-0:1.0.2-1.el7_7.1.i686",
                  "product_id": "fribidi-devel-0:1.0.2-1.el7_7.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi-devel@1.0.2-1.el7_7.1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "fribidi-0:1.0.2-1.el7_7.1.i686",
                "product": {
                  "name": "fribidi-0:1.0.2-1.el7_7.1.i686",
                  "product_id": "fribidi-0:1.0.2-1.el7_7.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi@1.0.2-1.el7_7.1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "fribidi-devel-0:1.0.2-1.el7_7.1.x86_64",
                "product": {
                  "name": "fribidi-devel-0:1.0.2-1.el7_7.1.x86_64",
                  "product_id": "fribidi-devel-0:1.0.2-1.el7_7.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi-devel@1.0.2-1.el7_7.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "fribidi-0:1.0.2-1.el7_7.1.x86_64",
                "product": {
                  "name": "fribidi-0:1.0.2-1.el7_7.1.x86_64",
                  "product_id": "fribidi-0:1.0.2-1.el7_7.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi@1.0.2-1.el7_7.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Cloud Linux Software, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
                "product": {
                  "name": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
                  "product_id": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi-devel@1.0.2-1.el7_7.1.tuxcare.els1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
                "product": {
                  "name": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
                  "product_id": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi@1.0.2-1.el7_7.1.tuxcare.els1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
                "product": {
                  "name": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
                  "product_id": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi-devel@1.0.2-1.el7_7.1.tuxcare.els1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
                "product": {
                  "name": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
                  "product_id": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi@1.0.2-1.el7_7.1.tuxcare.els1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686"
        },
        "product_reference": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-devel-0:1.0.2-1.el7_7.1.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.i686"
        },
        "product_reference": "fribidi-devel-0:1.0.2-1.el7_7.1.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64"
        },
        "product_reference": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-devel-0:1.0.2-1.el7_7.1.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.x86_64"
        },
        "product_reference": "fribidi-devel-0:1.0.2-1.el7_7.1.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686"
        },
        "product_reference": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-0:1.0.2-1.el7_7.1.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.i686"
        },
        "product_reference": "fribidi-0:1.0.2-1.el7_7.1.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64"
        },
        "product_reference": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-0:1.0.2-1.el7_7.1.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.x86_64"
        },
        "product_reference": "fribidi-0:1.0.2-1.el7_7.1.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-25309",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.i686",
          "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
          "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
          "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.x86_64",
          "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.i686",
          "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
          "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
          "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2022-25309"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2022-25309",
          "url": "https://access.redhat.com/security/cve/CVE-2022-25309"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2047896",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2047896"
        },
        {
          "category": "external",
          "summary": "https://github.com/fribidi/fribidi/commit/f22593b82b5d1668d1997dbccd10a9c31ffea3b3",
          "url": "https://github.com/fribidi/fribidi/commit/f22593b82b5d1668d1997dbccd10a9c31ffea3b3"
        },
        {
          "category": "external",
          "summary": "https://github.com/fribidi/fribidi/issues/182",
          "url": "https://github.com/fribidi/fribidi/issues/182"
        }
      ],
      "release_date": "2022-09-06T18:15:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-15T12:44:49.879530Z",
          "details": "This vulnerability is only reachable through the fribidi command-line utility when a user explicitly invokes the non-default --caprtl (CapRTL charset) option on attacker‑supplied input, and its effect is limited to crashing that process (availability only). It offers no remote vector, no privilege escalation, and no confidentiality or integrity impact. Because server and VM workloads do not normally expose this CLI path to remote users or run it unattended on untrusted files, its practical exploitability and operational risk are minimal, so it can be safely deprioritized.",
          "product_ids": [
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.i686",
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.x86_64",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.i686",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.i686",
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.x86_64",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.i686",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}