{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/vex/2022/cve-2022-25310-els_os-cloudlinux7els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-25T04:27:27Z",
      "generator": {
        "date": "2026-10-25T04:27:27Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2022-25310-ELS_OS-CLOUDLINUX7ELS",
      "initial_release_date": "2022-09-06T18:15:00Z",
      "revision_history": [
        {
          "date": "2022-09-06T18:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-25T04:27:27Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2022-25310"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CloudLinux 7",
                "product": {
                  "name": "CloudLinux 7",
                  "product_id": "CloudLinux-7",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "CloudLinux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "fribidi-devel-0:1.0.2-1.el7_7.1.i686",
                "product": {
                  "name": "fribidi-devel-0:1.0.2-1.el7_7.1.i686",
                  "product_id": "fribidi-devel-0:1.0.2-1.el7_7.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi-devel@1.0.2-1.el7_7.1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "fribidi-0:1.0.2-1.el7_7.1.i686",
                "product": {
                  "name": "fribidi-0:1.0.2-1.el7_7.1.i686",
                  "product_id": "fribidi-0:1.0.2-1.el7_7.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi@1.0.2-1.el7_7.1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "fribidi-devel-0:1.0.2-1.el7_7.1.x86_64",
                "product": {
                  "name": "fribidi-devel-0:1.0.2-1.el7_7.1.x86_64",
                  "product_id": "fribidi-devel-0:1.0.2-1.el7_7.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi-devel@1.0.2-1.el7_7.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "fribidi-0:1.0.2-1.el7_7.1.x86_64",
                "product": {
                  "name": "fribidi-0:1.0.2-1.el7_7.1.x86_64",
                  "product_id": "fribidi-0:1.0.2-1.el7_7.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi@1.0.2-1.el7_7.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Cloud Linux Software, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
                "product": {
                  "name": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
                  "product_id": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi-devel@1.0.2-1.el7_7.1.tuxcare.els1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
                "product": {
                  "name": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
                  "product_id": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi@1.0.2-1.el7_7.1.tuxcare.els1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
                "product": {
                  "name": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
                  "product_id": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi-devel@1.0.2-1.el7_7.1.tuxcare.els1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
                "product": {
                  "name": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
                  "product_id": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/fribidi@1.0.2-1.el7_7.1.tuxcare.els1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686"
        },
        "product_reference": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-devel-0:1.0.2-1.el7_7.1.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.i686"
        },
        "product_reference": "fribidi-devel-0:1.0.2-1.el7_7.1.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64"
        },
        "product_reference": "fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-devel-0:1.0.2-1.el7_7.1.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.x86_64"
        },
        "product_reference": "fribidi-devel-0:1.0.2-1.el7_7.1.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686"
        },
        "product_reference": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-0:1.0.2-1.el7_7.1.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.i686"
        },
        "product_reference": "fribidi-0:1.0.2-1.el7_7.1.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64"
        },
        "product_reference": "fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "fribidi-0:1.0.2-1.el7_7.1.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.x86_64"
        },
        "product_reference": "fribidi-0:1.0.2-1.el7_7.1.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-25310",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "description",
          "text": "A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw allows an attacker to pass a specially crafted file to Fribidi, leading to a crash and causing a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.i686",
          "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
          "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
          "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.x86_64",
          "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.i686",
          "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
          "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
          "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2022-25310"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2022-25310",
          "url": "https://access.redhat.com/security/cve/CVE-2022-25310"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2047923",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2047923"
        },
        {
          "category": "external",
          "summary": "https://github.com/fribidi/fribidi/issues/183",
          "url": "https://github.com/fribidi/fribidi/issues/183"
        },
        {
          "category": "external",
          "summary": "https://github.com/fribidi/fribidi/pull/186",
          "url": "https://github.com/fribidi/fribidi/pull/186"
        }
      ],
      "release_date": "2022-09-06T18:15:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-15T12:44:47.941099Z",
          "details": "This vulnerability is a local, user‑interaction‑dependent denial‑of‑service in libfribidi’s fribidi_remove_bidi_marks() that only causes a process crash, with no confidentiality or integrity impact. Exploitation requires delivering crafted text to an application that actually invokes this function—generally in text‑rendering code paths rather than exposed or privileged services—so in typical server/VM deployments the effect is confined to the crashing process and does not affect system or tenant isolation, making it reasonable to deprioritize.",
          "product_ids": [
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.i686",
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.x86_64",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.i686",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.i686",
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
            "CloudLinux-7:fribidi-0:1.0.2-1.el7_7.1.x86_64",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.i686",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.i686",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.tuxcare.els1.x86_64",
            "CloudLinux-7:fribidi-devel-0:1.0.2-1.el7_7.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}