CVE-2022-3715 @ Bullseye

"CVE-2022-3715"
"bash-5.1-2+deb11u1"
"bash-completion-1:2.11-2"
"Am I vulnerable?"

Status

new

Priority

1.17

Match score

4.0

Risk

MemCorrupt priv:user

CVSS

7.8 HIGH

Reason

cpe: bash; pkgs: bash; version: in-range: bash-5.1-2+deb11u1; debian:bullseye bash open; risk:memory_corruption

Created

2026-10-15T10:20:32Z

Updated

2026-10-20T10:18:42Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

Package	Commands
bash-5.1-2+deb11u1
bash-completion-1:2.11-2

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: bash

System	Matches	Ticket for CVE-2022-3715
Bullseye	bash 5.1-2+deb11u1; bash-completion 1:2.11-2	new open
Helios	bash 5.1-2+deb11u1; bash-completion 1:2.11-2	new open
Archive	bash 5.0-4; bash-completion 1:2.8-6	none
Janus	bash 5.0-4; bash-completion 1:2.8-6	none
Library	bash 4.4-5; bash-completion 1:2.1-4.3	none
Matrix	bash 5.2.15-2+b13; bash-completion 1:2.11-6	none
Saiph	bash 5.0-4; bash-completion 1:2.8-6	none
Silk	bash 5.2.15-2+b13; bash-completion 1:2.11-6	none
morris	bash 4.2.46	none
mufasa	bash 4.2.46; bash-completion 2.1	none

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

Debian GNU/Linux 11 (bullseye) (11) · debian

Arch

x86_64

kernel_release

uname -r → 5.10.0-45-amd64

kernel_version

uname -v → #1 SMP Debian 5.10.259-1 (2026-07-02)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
Helios	new	1.17	2026-10-20T10:18:42Z	Open

Description

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.

Update status

Add note only

References

NVD: CVE-2022-3715