CVSS: 6.0EPSS: 0%CPEs: 3EXPL: 1CVE-2014-3476 – openstack-keystone: privilege escalation through trust chained delegation
https://notcve.org/view.php?id=CVE-2014-3476
OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create a new token with additional roles. OpenStack Identity (Keystone) anterior a 2013.2.4, 2014.1 anterior a 2014.1.2, y Juno anterior a Juno-2 no maneja debidamente la delegación encadenada, lo que permite a usuarios remotos autenticados ganar privilegios mediante el aprovechamiento de un token (1) trust o (2) OAuth con suplantación habilitada para crear un token nuevo con roles adicionales. A flaw was found in keystone's chained delegation. A trustee able to create a delegation from a trust or an OAuth token could misuse identity impersonation to bypass the enforced scope, possibly allowing them to obtain elevated privileges to the trustor's projects and roles. • http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00031.html http://secunia.com/advisories/57886 http://secunia.com/advisories/59547 http://www.openwall.com/lists/oss-security/2014/06/12/3 http://www.securityfocus.com/bid/68026 https://bugs.launchpad.net/keystone/+bug/1324592 https://access.redhat.com/security/cve/CVE-2014-3476 https://bugzilla.redhat.com/show_bug.cgi?id=1104524 • CWE-269: Improper Privilege Management •
CVSS: 10.0EPSS: 3%CPEs: 7EXPL: 0CVE-2014-2978
https://notcve.org/view.php?id=CVE-2014-2978
The Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers an out-of-bounds write. La función Dispatch_Write en proxy/dispatcher/idirectfbsurface_dispatcher.c en DirectFB 1.4.4 permite a atacantes remotos causar una denegación de servicio (caída) y posiblemente ejecutar código arbitrario a través de la interfaz Voodoo, lo que provoca una escritura fuera de rango. • http://advisories.mageia.org/MGASA-2015-0176.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00003.html http://mail.directfb.org/pipermail/directfb-dev/2014-March/006805.html http://secunia.com/advisories/58448 http://www.mandriva.com/security/advisories?name=MDVSA-2015:223 http://www.openwall.com/lists/oss-security/2014/05/15/10 https://security.gentoo.org/glsa/201701-55 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 3%CPEs: 7EXPL: 0CVE-2014-2977
https://notcve.org/view.php?id=CVE-2014-2977
Multiple integer signedness errors in the Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.13 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers a stack-based buffer overflow. Múltiples errores de sino de enteros en la función Dispatch_Write en proxy/dispatcher/idirectfbsurface_dispatcher.c en DirectFB 1.4.13 permiten a atacantes remotos causar una denegación de servicio (caída) y posiblemente ejecutar código arbitrario a través de la interfaz Voodoo, lo que provoca un desbordamiento de buffer basado en pila. • http://advisories.mageia.org/MGASA-2015-0176.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00003.html http://mail.directfb.org/pipermail/directfb-dev/2014-March/006805.html http://secunia.com/advisories/58448 http://www.mandriva.com/security/advisories?name=MDVSA-2015:223 http://www.openwall.com/lists/oss-security/2014/05/15/9 https://security.gentoo.org/glsa/201701-55 • CWE-189: Numeric Errors •
CVSS: 7.8EPSS: 0%CPEs: 18EXPL: 9CVE-2014-3153 – Linux Kernel Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2014-3153
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification. La función futex_requeue en kernel/futex.c en el kernel de Linux hasta 3.14.5 no asegura que las llamadas tengan dos direcciones futex diferentes, lo que permite a usuarios locales ganar privilegios a través de un comando FUTEX_REQUEUE manipulado que facilita la modificación insegura del objeto o función a la espera. A flaw was found in the way the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance (PI) futexes. A local, unprivileged user could use this flaw to escalate their privileges on the system. The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges. • https://www.exploit-db.com/exploits/35370 https://github.com/timwr/CVE-2014-3153 https://github.com/lieanu/CVE-2014-3153 https://github.com/elongl/CVE-2014-3153 https://github.com/zerodavinci/CVE-2014-3153-exploit https://github.com/c3c/CVE-2014-3153 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9c243a5a6de0be8e584c604d353412584b592f8 http://linux.oracle.com/errata/ELSA-2014-0771.html http://linux.oracle.com/errata/ELSA-2014-3037.html •
CVSS: 4.7EPSS: 0%CPEs: 18EXPL: 0CVE-2014-3917 – kernel: DoS with syscall auditing
https://notcve.org/view.php?id=CVE-2014-3917
kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number. kernel/auditsc.c en el kernel de Linux hasta 3.14.5, cuando CONFIG_AUDITSYSCALL está habilitado con ciertas normas syscall, permite a usuarios locales obtener valores de un único bit potencialmente sensibles de la memoria del kernel o causar una denegación de servicio (OOPS) a través de un valor grande de un número syscall. An out-of-bounds memory access flaw was found in the Linux kernel's system call auditing implementation. On a system with existing audit rules defined, a local, unprivileged user could use this flaw to leak kernel memory to user space or, potentially, crash the system. • http://article.gmane.org/gmane.linux.kernel/1713179 http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2014-1143.html http://rhn.redhat.com/errata/RHSA-2014-1281.html http://secunia.com/advisories/59777 http://secunia.com/advisories/60011 http://secunia.com/advisories/60564 http://www.openwall.com/lists/oss-security/2014/05/29/5 http://www.ubuntu.com/usn/USN-2334-1 http://www.ubuntu.com/usn/USN-2335-1& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •