CVE-2022-38216: Integer Overflow or Wraparound

August 17, 2022 (updated November 22, 2022)

An integer overflow exists in Mapbox’s closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox products including open source libraries. The overflow is caused by large image height and width values when creating a new Image and allows for out-of-bounds writes, potentially crashing the Mapbox process.

References

github.com/advisories/GHSA-4696-g7jj-xg2h
github.com/mapbox/mapbox-maps-android/releases/tag/android-v10.6.1
nvd.nist.gov/vuln/detail/CVE-2022-38216

Code Behaviors & Features

Detect and mitigate CVE-2022-38216 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →