CVE catalog

CVE-2022-4603

ppp: CVE-2022-4603

[CVE catalog]

Severity
Medium · CVSS 4.3CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.89% · Oct 25, 2026

A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpppsid2.5.2-1+2fixed
Debianpppforky2.5.2-1+2fixed
Debianppptrixie2.5.2-1+1fixed
Debianpppbookworm2.4.9-1+1.1vulnerable
Suseppplinux enterprise software development kit 12 sp52.4.7-4.6.1fixed
Suseppplinux enterprise server 12 sp52.4.7-4.6.1fixed
Suseppplinux enterprise server for sap applications 12 sp52.4.7-4.6.1fixed
Opensuseppptumbleweed2.5.0-1.1fixed
Suseppplinux enterprise micro 5.52.4.7-150000.5.13.1fixed
Suseppplinux enterprise micro 5.32.4.7-150000.5.13.1fixed
Suseppplinux enterprise micro 5.42.4.7-150000.5.13.1fixed
Suseppplinux enterprise micro 5.52.4.7-150000.5.13.1fixed
Suseppplinux enterprise module for desktop applications 15 sp52.4.7-150000.5.13.1fixed
Suseppplinux enterprise real time 15 sp42.4.7-150000.5.13.1fixed
Opensusepppleap micro 5.32.4.7-150000.5.13.1fixed
Opensusepppleap micro 5.42.4.7-150000.5.13.1fixed
Opensusepppleap 15.42.4.7-150000.5.13.1fixed
Opensusepppleap 15.52.4.7-150000.5.13.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpppsourcesid2.5.0-1+2unimportantNot reportedNot reported
Debianpppsourceforky2.5.0-1+2unimportantNot reportedNot reported
Debianpppsourcetrixie2.5.0-1+2unimportantNot reportedNot reported
Debianpppsourcebookworm(unfixed)unimportantNot reportedNot reported
Suseppprpmlinux enterprise software development kit 12 sp52.4.7-4.6.1Not reportedSUSE-SU-2023:4961-1Not reported
Suseppprpmlinux enterprise server 12 sp52.4.7-4.6.1Not reportedSUSE-SU-2023:4961-1Not reported
Suseppprpmlinux enterprise server for sap applications 12 sp52.4.7-4.6.1Not reportedSUSE-SU-2023:4961-1Not reported
Opensuseppprpmtumbleweed2.5.0-1.1Not reportedOPENSUSE-SU-2024:13529-1Not reported
Suseppprpmlinux enterprise micro 5.52.4.7-150000.5.13.1Not reportedSUSE-SU-2024:2380-1Not reported
Suseppprpmlinux enterprise micro 5.32.4.7-150000.5.13.1Not reportedSUSE-SU-2023:4965-1Not reported
Suseppprpmlinux enterprise micro 5.42.4.7-150000.5.13.1Not reportedSUSE-SU-2023:4965-1Not reported
Suseppprpmlinux enterprise micro 5.52.4.7-150000.5.13.1Not reportedSUSE-SU-2023:4965-1Not reported
Suseppprpmlinux enterprise module for desktop applications 15 sp52.4.7-150000.5.13.1Not reportedSUSE-SU-2023:4965-1Not reported
Suseppprpmlinux enterprise real time 15 sp42.4.7-150000.5.13.1Not reportedSUSE-SU-2023:4965-1Not reported
Opensuseppprpmleap micro 5.32.4.7-150000.5.13.1Not reportedSUSE-SU-2023:4965-1Not reported
Opensuseppprpmleap micro 5.42.4.7-150000.5.13.1Not reportedSUSE-SU-2023:4965-1Not reported
Opensuseppprpmleap 15.42.4.7-150000.5.13.1Not reportedSUSE-SU-2023:4965-1Not reported
Opensuseppprpmleap 15.52.4.7-150000.5.13.1Not reportedSUSE-SU-2023:4965-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ppp]Affected

    Source package: [ppp]

    Details (2)

    • 2.4.9-1+1.1+b1 · amd64 · bookworm

      Affected

      dsa · ppp · debian · bookworm

    • 2.4.9-1+1.1+b1 · arm64 · bookworm

      Affected

      dsa · ppp · debian · bookworm

  • [ppp-dev]Affected

    Source package: [ppp]

    Details (2)

    • 2.4.9-1+1.1 · all · bookworm

      Affected

      dsa · ppp · debian · bookworm

    • 2.4.9-1+1.1 · all · bookworm

      Affected

      dsa · ppp · debian · bookworm

[openSUSE Tumbleweed]

  • [ppp-devel]Unknown

    Source package: [ppp]

    Details (1)

    • 2.5.2-3.5 · x86_64 · tumbleweed

      Unknown · Fixed: 2.5.0-1.1

      Version impact unknown

      dsa · ppp · opensuse · tumbleweed

  • [ppp-modem]Unknown

    Source package: [ppp]

    Details (1)

    • 2.5.2-3.5 · noarch · tumbleweed

      Unknown · Fixed: 2.5.0-1.1

      Version impact unknown

      dsa · ppp · opensuse · tumbleweed

  • [ppp]Fixed

    Source package: [ppp]

    Details (1)

    • 2.5.2-3.5 · x86_64 · tumbleweed

      Fixed · Fixed: 2.5.0-1.1

      dsa · ppp · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]