CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-3204 – NRDelegation Attack
https://notcve.org/view.php?id=CVE-2022-3204
A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. • https://lists.debian.org/debian-lts-announce/2023/03/msg00024.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35QGS5FBQTG3DBSK7QV67PA64P24ABHY https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3G2HS6CYPSIGAKO6QLEZPG3RD6AMPB7B https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4EU6DMJXQFMAIE6SLAH4H5RNRU6VQL https://security.gentoo.org/glsa/202212-02 https://www.nlnetlabs.nl/downloads/unbound/CVE-2022-3204 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 2CVE-2022-21797 – Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2022-21797
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement. El paquete joblib versiones a partir de 0 anteriores a 1.2.0, son vulnerables a una Ejecución de Código Arbitraria por medio del flag pre_dispatch en la clase Parallel() debido a la sentencia eval(). • https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059 https://github.com/joblib/joblib/issues/1128 https://github.com/joblib/joblib/pull/1321 https://lists.debian.org/debian-lts-announce/2022/11/msg00020.html https://lists.debian.org/debian-lts-announce/2023/03/msg00027.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 1%CPEs: 2EXPL: 0CVE-2022-3199 – Chrome blink::LocalFrameView::PerformLayout Use-After-Free
https://notcve.org/view.php?id=CVE-2022-3199
Use after free in Frames in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Un uso de memoria previamente liberada en Frames en Google Chrome antes de la versión 105.0.5195.125 permitía a un atacante remoto explotar potencialmente la corrupción de heap a través de una página HTML manipulada. (Gravedad de seguridad de Chromium: Alta) Chrome suffers from a heap use-after-free vulnerability in blink::LocalFrameView::PerformLayout due to an incomplete fix for CVE-2022-3199. • http://packetstormsecurity.com/files/170012/Chrome-blink-LocalFrameView-PerformLayout-Use-After-Free.html https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html https://crbug.com/1355237 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE https://security.gentoo.org/glsa/202209-23 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-3198
https://notcve.org/view.php?id=CVE-2022-3198
Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High) Un uso de memoria previamente liberada en PDF en Google Chrome versiones anteriores a 105.0.5195.125, permitía a un atacante remoto explotar potencialmente una corrupción de pila por medio de un archivo PDF diseñado. (Gravedad de seguridad de Chromium: Alta) • https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html https://crbug.com/1355682 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE https://security.gentoo.org/glsa/202209-23 • CWE-416: Use After Free •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2022-3201
https://notcve.org/view.php?id=CVE-2022-3201
Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High) La validación insuficiente de las entradas no fiables en DevTools en Google Chrome en el sistema operativo Chrome anterior a la versión 105.0.5195.125 permitía a un atacante que convenciera a un usuario de instalar una extensión maliciosa saltarse las restricciones de navegación a través de una página HTML manipulada. (Gravedad de seguridad de Chromium: Alta) • https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html https://crbug.com/1343104 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE https://security.gentoo.org/glsa/202209-23 https://security.gentoo.org/glsa/202210-16 https://security.gentoo.org/glsa/202311-11 https://www.debian.org/security/2022/dsa-5244 • CWE-20: Improper Input Validation •