CVE catalog

CVE-2022-0194

UBUNTU-

[CVE catalog]

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ad_addcomment function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15876. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ad_addcomment function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
4.45% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Ubuntu22.04netatalk3.1.12~ds-9ubuntu0.22.04.1Fixed[UBUNTU-CVE-2022-0194]
Ubuntu20.04netatalk3.1.12~ds-4ubuntu0.20.04.1Fixed[UBUNTU-CVE-2022-0194]

Showing 2 fix observations. All 25 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Ubuntu20.04netatalk3.1.12~ds-3Affected[UBUNTU-CVE-2022-0194]
Ubuntu20.04netatalk3.1.12~ds-4Affected[UBUNTU-CVE-2022-0194]
Ubuntu20.04netatalk3.1.12~ds-4ubuntu0.20.04.1Fixed[UBUNTU-CVE-2022-0194]
Ubuntu22.04netatalk3.1.12~ds-9Affected[UBUNTU-CVE-2022-0194]
Ubuntu22.04netatalk3.1.12~ds-9build1Affected[UBUNTU-CVE-2022-0194]
Ubuntu22.04netatalk3.1.12~ds-9ubuntu0.22.04.1Fixed[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.2-1ubuntu1Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.2-1ubuntu2Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.2-1ubuntu2.2Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.2-1ubuntu2.2+esm1Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.2-1ubuntu2.2+esm2Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.2-1ubuntu2.2+esm3Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.2-1ubuntu2.2+esm4Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.5-1Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.5-1ubuntu0.2Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.5-1ubuntu0.2+esm1Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.5-1ubuntu0.2+esm2Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.5-1ubuntu0.2+esm3Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.5-1ubuntu0.2+esm4Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.6-1Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.6-1ubuntu0.18.04.2Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.6-1ubuntu0.18.04.2+esm1Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.6-1ubuntu0.18.04.2+esm2Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.6-1ubuntu0.18.04.2+esm3Affected[UBUNTU-CVE-2022-0194]
Ubuntupronetatalk2.2.6-1ubuntu0.18.04.2+esm4Affected[UBUNTU-CVE-2022-0194]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "netatalk",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "2.2.2-1ubuntu1",
        "2.2.2-1ubuntu2",
        "2.2.2-1ubuntu2.2",
        "2.2.2-1ubuntu2.2+esm1",
        "2.2.2-1ubuntu2.2+esm2",
        "2.2.2-1ubuntu2.2+esm3",
        "2.2.2-1ubuntu2.2+esm4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-0194",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-0194",
      "provider_updated_at": "2026-06-22T09:30:07.621343946Z"
    },
    {
      "name": "netatalk",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "2.2.5-1",
        "2.2.5-1ubuntu0.2",
        "2.2.5-1ubuntu0.2+esm1",
        "2.2.5-1ubuntu0.2+esm2",
        "2.2.5-1ubuntu0.2+esm3",
        "2.2.5-1ubuntu0.2+esm4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-0194",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-0194",
      "provider_updated_at": "2026-06-22T09:30:07.621343946Z"
    },
    {
      "name": "netatalk",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "2.2.6-1",
        "2.2.6-1ubuntu0.18.04.2",
        "2.2.6-1ubuntu0.18.04.2+esm1",
        "2.2.6-1ubuntu0.18.04.2+esm2",
        "2.2.6-1ubuntu0.18.04.2+esm3",
        "2.2.6-1ubuntu0.18.04.2+esm4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-0194",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-0194",
      "provider_updated_at": "2026-06-22T09:30:07.621343946Z"
    },
    {
      "name": "netatalk",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.12~ds-4ubuntu0.20.04.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "3.1.12~ds-3",
        "3.1.12~ds-4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-0194",
      "fixed_version": "3.1.12~ds-4ubuntu0.20.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-0194",
      "provider_updated_at": "2026-06-22T09:30:07.621343946Z"
    },
    {
      "name": "netatalk",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.12~ds-9ubuntu0.22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "3.1.12~ds-9",
        "3.1.12~ds-9build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-0194",
      "fixed_version": "3.1.12~ds-9ubuntu0.22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-0194",
      "provider_updated_at": "2026-06-22T09:30:07.621343946Z"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]