CVE catalog

CVE-2022-39377

sysstat: CVE-2022-39377

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.27% · Oct 25, 2026

sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently checks bounds before arithmetic multiplication, allowing for an overflow in the size allocated for the buffer representing system activities. This issue may lead to Remote Code Execution (RCE). This issue has been patched in version 12.7.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansysstatsid12.7.5-2fixed
Debiansysstatforky12.7.5-2fixed
Debiansysstattrixie12.7.5-2fixed
Debiansysstatbookworm12.6.1-1fixed
Ubuntusysstatpro11.5.7-1ubuntu1vulnerable
Ubuntusysstatpro11.6.0-1ubuntu1vulnerable
Ubuntusysstatpro11.6.0-1ubuntu2vulnerable
Ubuntusysstatpro11.6.1-1vulnerable
Ubuntusysstatpro11.6.1-1ubuntu0.1vulnerable
Ubuntusysstatpro11.6.1-1ubuntu0.2vulnerable
Ubuntusysstatpro11.6.1-1ubuntu0.2+esm1fixed
Ubuntusysstat20.0412.0.6-1vulnerable
Ubuntusysstat20.0412.1.7-1vulnerable
Ubuntusysstat20.0412.2.0-1vulnerable
Ubuntusysstat20.0412.2.0-2vulnerable
Ubuntusysstat20.0412.2.0-2ubuntu0.1vulnerable
Ubuntusysstat20.0412.2.0-2ubuntu0.2vulnerable
Ubuntusysstat20.0412.2.0-2ubuntu0.3fixed
Ubuntusysstat22.0412.5.2-2build1vulnerable
Ubuntusysstat22.0412.5.2-2build2vulnerable
Ubuntusysstat22.0412.5.2-2ubuntu0.1vulnerable
Ubuntusysstat22.0412.5.2-2ubuntu0.2fixed
Ubuntusysstatpro11.1.5-1vulnerable
Ubuntusysstatpro11.1.7-1vulnerable
Ubuntusysstatpro11.1.8-1vulnerable
Ubuntusysstatpro11.2.0-1vulnerable
Ubuntusysstatpro11.2.0-1ubuntu0.1vulnerable
Ubuntusysstatpro11.2.0-1ubuntu0.2vulnerable
Ubuntusysstatpro11.2.0-1ubuntu0.3vulnerable
Ubuntusysstatpro11.2.0-1ubuntu0.3+esm1fixed
Ubuntusysstat18.0411.5.7-1ubuntu1vulnerable
Ubuntusysstat18.0411.6.0-1ubuntu1vulnerable
Ubuntusysstat18.0411.6.0-1ubuntu2vulnerable
Ubuntusysstat18.0411.6.1-1vulnerable
Ubuntusysstat18.0411.6.1-1ubuntu0.1vulnerable
Ubuntusysstat18.0411.6.1-1ubuntu0.2fixed
Ubuntusysstat20.0412.0.6-1vulnerable
Ubuntusysstat20.0412.1.7-1vulnerable
Ubuntusysstat20.0412.2.0-1vulnerable
Ubuntusysstat20.0412.2.0-2vulnerable
Ubuntusysstat20.0412.2.0-2ubuntu0.1vulnerable
Ubuntusysstat20.0412.2.0-2ubuntu0.2fixed
Ubuntusysstat22.0412.5.2-2build1vulnerable
Ubuntusysstat22.0412.5.2-2build2vulnerable
Ubuntusysstat22.0412.5.2-2ubuntu0.1fixed
Ubuntusysstatpro11.1.5-1vulnerable
Ubuntusysstatpro11.1.7-1vulnerable
Ubuntusysstatpro11.1.8-1vulnerable
Ubuntusysstatpro11.2.0-1vulnerable
Ubuntusysstatpro11.2.0-1ubuntu0.1vulnerable
Ubuntusysstatpro11.2.0-1ubuntu0.2vulnerable
Ubuntusysstatpro11.2.0-1ubuntu0.3vulnerable
Ubuntusysstatpro11.2.0-1ubuntu0.3+esm1fixed
Ubuntusysstat18.0411.5.7-1ubuntu1vulnerable
Ubuntusysstat18.0411.6.0-1ubuntu1vulnerable
Ubuntusysstat18.0411.6.0-1ubuntu2vulnerable
Ubuntusysstat18.0411.6.1-1vulnerable
Ubuntusysstat18.0411.6.1-1ubuntu0.1vulnerable
Ubuntusysstat18.0411.6.1-1ubuntu0.2fixed
Ubuntusysstat20.0412.0.6-1vulnerable
Ubuntusysstat20.0412.1.7-1vulnerable
Ubuntusysstat20.0412.2.0-1vulnerable
Ubuntusysstat20.0412.2.0-2vulnerable
Ubuntusysstat20.0412.2.0-2ubuntu0.1vulnerable
Ubuntusysstat20.0412.2.0-2ubuntu0.2fixed
Ubuntusysstat22.0412.5.2-2build1vulnerable
Ubuntusysstat22.0412.5.2-2build2vulnerable
Ubuntusysstat22.0412.5.2-2ubuntu0.1fixed
Susesysstatlinux enterprise micro 5.312.0.2-150000.3.37.1fixed
Susesysstatlinux enterprise micro 5.412.0.2-150000.3.37.1fixed
Susesysstatlinux enterprise micro 5.512.0.2-150000.3.37.1fixed
Susesysstatlinux enterprise module for basesystem 15 sp612.0.2-150000.3.37.1fixed
Susesysstatlinux enterprise module for server applications 15 sp612.0.2-150000.3.37.1fixed
Susesysstatlinux enterprise micro 5.112.0.2-150000.3.37.1fixed
Susesysstatlinux enterprise micro 5.212.0.2-150000.3.37.1fixed
Opensusesysstatleap micro 5.512.0.2-150000.3.37.1fixed
Opensusesysstatleap 15.612.0.2-150000.3.37.1fixed
Susesysstatlinux enterprise server ltss extended security 12 sp512.0.2-20.23.1fixed
Opensusesysstattumbleweed12.6.1-2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansysstatsourcesid12.6.1-1not yet assignedNot reported[1023832]
Debiansysstatsourceforky12.6.1-1not yet assignedNot reported[1023832]
Debiansysstatsourcetrixie12.6.1-1not yet assignedNot reported[1023832]
Debiansysstatsourcebookworm12.6.1-1not yet assignedNot reported[1023832]
Ubuntusysstatdebpro11.6.1-1ubuntu0.2+esm1Not reportedUSN-6145-1Not reported
Ubuntusysstatdeb20.0412.2.0-2ubuntu0.3Not reportedUSN-6145-1Not reported
Ubuntusysstatdeb22.0412.5.2-2ubuntu0.2Not reportedUSN-6145-1Not reported
Ubuntusysstatdebpro11.2.0-1ubuntu0.3+esm1Not reportedUSN-5735-1Not reported
Ubuntusysstatdeb18.0411.6.1-1ubuntu0.2Not reportedUSN-5748-1Not reported
Ubuntusysstatdeb20.0412.2.0-2ubuntu0.2Not reportedUSN-5748-1Not reported
Ubuntusysstatdeb22.0412.5.2-2ubuntu0.1Not reportedUSN-5748-1Not reported
Ubuntusysstatdebpro11.2.0-1ubuntu0.3+esm1Not reportedUBUNTU-CVE-2022-39377Not reported
Ubuntusysstatdeb18.0411.6.1-1ubuntu0.2Not reportedUBUNTU-CVE-2022-39377Not reported
Ubuntusysstatdeb20.0412.2.0-2ubuntu0.2Not reportedUBUNTU-CVE-2022-39377Not reported
Ubuntusysstatdeb22.0412.5.2-2ubuntu0.1Not reportedUBUNTU-CVE-2022-39377Not reported
Susesysstatrpmlinux enterprise micro 5.312.0.2-150000.3.37.1Not reportedSUSE-SU-2025:0019-1Not reported
Susesysstatrpmlinux enterprise micro 5.412.0.2-150000.3.37.1Not reportedSUSE-SU-2025:0019-1Not reported
Susesysstatrpmlinux enterprise micro 5.512.0.2-150000.3.37.1Not reportedSUSE-SU-2025:0019-1Not reported
Susesysstatrpmlinux enterprise module for basesystem 15 sp612.0.2-150000.3.37.1Not reportedSUSE-SU-2025:0019-1Not reported
Susesysstatrpmlinux enterprise module for server applications 15 sp612.0.2-150000.3.37.1Not reportedSUSE-SU-2025:0019-1Not reported
Susesysstatrpmlinux enterprise micro 5.112.0.2-150000.3.37.1Not reportedSUSE-SU-2025:0019-1Not reported
Susesysstatrpmlinux enterprise micro 5.212.0.2-150000.3.37.1Not reportedSUSE-SU-2025:0019-1Not reported
Opensusesysstatrpmleap micro 5.512.0.2-150000.3.37.1Not reportedSUSE-SU-2025:0019-1Not reported
Opensusesysstatrpmleap 15.612.0.2-150000.3.37.1Not reportedSUSE-SU-2025:0019-1Not reported
Susesysstatrpmlinux enterprise server ltss extended security 12 sp512.0.2-20.23.1Not reportedSUSE-SU-2025:0012-1Not reported
Opensusesysstatrpmtumbleweed12.6.1-2.1Not reportedOPENSUSE-SU-2024:12658-1Not reported

[Debian bug #1023832]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [sysstat-isag]Unknown

    Source package: [sysstat]

    Details (1)

    • 12.7.9-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 12.6.1-2.1

      Version impact unknown

      dsa · sysstat · opensuse · tumbleweed

  • [sysstat]Fixed

    Source package: [sysstat]

    Details (1)

    • 12.7.9-1.4 · x86_64 · tumbleweed

      Fixed · Fixed: 12.6.1-2.1

      dsa · sysstat · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [isag]Fixed

    Source package: [sysstat]

    Details (2)

    • 12.6.1-1 · all · bookworm

      Fixed · Fixed: 12.6.1-1

      dsa · sysstat · debian · bookworm

    • 12.6.1-1 · all · bookworm

      Fixed · Fixed: 12.6.1-1

      dsa · sysstat · debian · bookworm

  • [sysstat]Fixed
    Details (2)

    • 12.6.1-1 · amd64 · bookworm

      Fixed · Fixed: 12.6.1-1

      dsa · sysstat · debian · bookworm

    • 12.6.1-1 · arm64 · bookworm

      Fixed · Fixed: 12.6.1-1

      dsa · sysstat · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]