{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2022-4291", "assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e", "state": "PUBLISHED", "assignerShortName": "NLOK", "requesterUserId": "a89eadfe-7713-4641-b4d7-9b7a3717e63f", "dateReserved": "2022-12-05T17:33:48.757Z", "datePublished": "2022-12-07T23:45:04.707Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "modules": ["Script Shield"], "platforms": ["Windows"], "product": "Avast Antivirus", "vendor": "NortonLifelock", "versions": [{"lessThanOrEqual": "18.0.1473.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "datePublic": "2022-12-07T23:25:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an attacker to bypass the sandbox of the application it was loaded into, if applicable. This issue was fixed in version 18.0.1478 of the Script Shield Component.</span><br>"}], "value": "The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an attacker to bypass the sandbox of the application it was loaded into, if applicable. This issue was fixed in version 18.0.1478 of the Script Shield Component.\n"}], "impacts": [{"descriptions": [{"lang": "en", "value": "Heap Corruption"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e", "shortName": "NLOK", "dateUpdated": "2022-12-07T23:45:04.707Z"}, "references": [{"url": "https://support.norton.com/sp/static/external/tools/security-advisories.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Aswjsflt.dll in Avast Antivirus windows caused a crash of the Mozilla Firefox browser due to heap corruption", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:avast:script_shield:*:*:*:*:*:*:*:*", "matchCriteriaId": "093806BF-B9ED-459C-A7E4-4148FBE01296", "versionEndIncluding": "18.0.1473.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an attacker to bypass the sandbox of the application it was loaded into, if applicable. This issue was fixed in version 18.0.1478 of the Script Shield Component.\n"}, {"lang": "es", "value": "La librer\u00eda aswjsflt.dll de las ventanas de Avast Antivirus conten\u00eda una vulnerabilidad de corrupci\u00f3n de mont\u00f3n potencialmente explotable que podr\u00eda permitir a un atacante omitir la sandbox de la aplicaci\u00f3n en la que se carg\u00f3, si corresponde. Este problema se solucion\u00f3 en la versi\u00f3n 18.0.1478 del componente Script Shield."}], "id": "CVE-2022-4291", "lastModified": "2023-11-07T03:57:26.393", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.1, "impactScore": 6.0, "source": "security@nortonlifelock.com", "type": "Secondary"}]}, "published": "2022-12-08T00:15:10.610", "references": [{"source": "security@nortonlifelock.com", "tags": ["Vendor Advisory"], "url": "https://support.norton.com/sp/static/external/tools/security-advisories.html"}], "sourceIdentifier": "security@nortonlifelock.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-119"}], "source": "security@nortonlifelock.com", "type": "Secondary"}]}

{}