Publish Time: 2023-03-30 16:37:45 UTC+8
Last Updated: 2023-03-30 16:37:45 UTC+8
- Not affected
None of Synology's products are affected by CVE-2022-43634.
|Product||Severity||Fixed Release Availability|
|DSM 7.1||Not affected||N/A|
|DSM 7.0||Not affected||N/A|
|DSM 6.2||Not affected||N/A|
|SRM 1.3||Not affected||N/A|
|SRM 1.2||Not affected||N/A|
|VS Firmware 3.0||Not affected||N/A|
- Severity: Not affected
- CVSS3 Base Score: 0.0
- CVSS3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dsi_writeinit function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17646.
|1||2023-03-30||Initial public release.|