CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 1CVE-2022-26495
https://notcve.org/view.php?id=CVE-2022-26495
In nbd-server in nbd before 3.24, there is an integer overflow with a resultant heap-based buffer overflow. A value of 0xffffffff in the name length field will cause a zero-sized buffer to be allocated for the name, resulting in a write to a dangling pointer. This issue exists for the NBD_OPT_INFO, NBD_OPT_GO, and NBD_OPT_EXPORT_NAME messages. En nbd-server en nbd versiones anteriores a 3.24, se presenta un desbordamiento de enteros con un desbordamiento de búfer en la región heap de la memoria resultante. Un valor de 0xffffff en el campo de longitud del nombre causará que se asigne un búfer de tamaño cero para el nombre, resultando en una escritura en un puntero colgante. • https://lists.debian.org/debian-lts-announce/2022/03/msg00014.html https://lists.debian.org/nbd/2022/01/msg00037.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G2UPX62BIWOOHSACGUDB7E3O4URNN37F https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZHR73XMAJTCFGKUZRXVTZKCK2X3IFNA https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU5JFD4PEJED72TZLZ5R2Q2SFXICU5I5 https://security.gentoo.org/glsa/202402-10 • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 1CVE-2022-26496 – Shannon Baseband fmtp SDP Attribute Memory Corruption
https://notcve.org/view.php?id=CVE-2022-26496
In nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a crafted NBD_OPT_INFO or NBD_OPT_GO message with an large value as the length of the name. En nbd-server en nbd versiones anteriores a 3.24, se presenta un desbordamiento del búfer en la región stack de la memoria. Un atacante puede causar un desbordamiento de búfer en el análisis del campo name enviando un mensaje NBD_OPT_INFO o NBD_OPT_GO diseñado con un valor grande como longitud del nombre Shannon Baseband suffers from a memory corruption vulnerability that occurs when the baseband modem processes SDP when setting up a call. When an fmtp attribute is parsed, the integer that represents the payload type is copied into an 8-byte buffer using memcpy with the length of payload type as the length parameter. • http://packetstormsecurity.com/files/172148/Shannon-Baseband-fmtp-SDP-Attribute-Memory-Corruption.html https://lists.debian.org/nbd/2022/01/msg00036.html https://lists.debian.org/nbd/2022/01/msg00037.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G2UPX62BIWOOHSACGUDB7E3O4URNN37F https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZHR73XMAJTCFGKUZRXVTZKCK2X3IFNA https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject • CWE-787: Out-of-bounds Write •