{
  "threat_severity" : "Moderate",
  "public_date" : "2021-12-22T00:00:00Z",
  "bugzilla" : {
    "description" : "fribidi: Stack based buffer overflow",
    "id" : "2047890",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2047890"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-121",
  "details" : [ "A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory leak or a denial of service.", "A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory leak or a denial of service." ],
  "statement" : "Red Hat Product Security has rated this issue as having a Moderate security impact, and since Red Hat Enterprise Linux 7 is Out-of-Support-Scope, the issue is not currently planned to be addressed in future updates. Only Important and Critical severity flaws will be addressed at this time.\nFor additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/ and Red Hat Enterprise Linux Life Cycle & Updates Policy: https://access.redhat.com/support/policy/updates/errata/.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2022-11-08T00:00:00Z",
    "advisory" : "RHSA-2022:7514",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "fribidi-0:1.0.4-9.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2022-11-15T00:00:00Z",
    "advisory" : "RHSA-2022:8011",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "fribidi-0:1.0.10-6.el9.2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "fribidi",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2022-25308\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-25308" ],
  "name" : "CVE-2022-25308",
  "csaw" : false
}