Miggo Logo

CVE-2022-38216: Mapbox is vulnerable to Integer Overflow

7.5

CVSS Score
3.1

Basic Information

EPSS Score
0.26968%
Published
8/17/2022
Updated
2/3/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.mapbox.mapboxsdk:mapbox-android-coremaven< 10.6.110.6.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability exists in Mapbox's closed-source gl-native library, whose source code and commit diffs are not publicly available. While the description indicates the issue occurs when processing large image dimensions during image creation, the lack of accessible code makes it impossible to identify specific function names or file paths with high confidence. The Android SDK's patch notes reference a fix in dependencies (gl-native v10.6.1) but provide no implementation details. Without access to the proprietary library's codebase, we can only infer that functions handling image allocation/validation are involved, but cannot definitively name them.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n int***r ov*r*low *xists in M*p*ox's *los** sour** *l-n*tiv* li*r*ry prior to v*rsion **.*.*, w*i** is *un*l** wit* multipl* M*p*ox pro*u*ts in*lu*in* op*n sour** li*r*ri*s. T** ov*r*low is **us** *y l*r** im*** **i**t *n* wi*t* v*lu*s w**n *r**tin

Reasoning

T** vuln*r**ility *xists in M*p*ox's *los**-sour** *l-n*tiv* li*r*ry, w*os* sour** *o** *n* *ommit *i**s *r* not pu*li*ly *v*il**l*. W*il* t** **s*ription in*i**t*s t** issu* o**urs w**n pro**ssin* l*r** im*** *im*nsions *urin* im*** *r**tion, t** l*