CVSS: 7.5EPSS: 1%CPEs: 12EXPL: 2CVE-2023-38039 – curl: out of heap memory issue due to missing limit on header quantity
https://notcve.org/view.php?id=CVE-2023-38039
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory. Cuando curl recupera una respuesta HTTP, almacena los encabezados entrantes para que se pueda acceder a ellos más tarde a través de la API de encabezados libcurl. Sin embargo, curl no tenía un límite en cuanto a la cantidad o el tamaño de encabezados que aceptaría en una respuesta, lo que permitía que un servidor malicioso transmitiera una serie interminable de encabezados y, finalmente, provocara que curl se quedara sin memoria dinámica. A flaw was found in the Curl package. Curl allows a malicious server to stream an endless series of headers to a client due to missing limit on header quantity, eventually causing curl to run out of heap memory, which may lead to a crash. • https://github.com/Smartkeyss/CVE-2023-38039 http://seclists.org/fulldisclosure/2023/Oct/17 http://seclists.org/fulldisclosure/2024/Jan/34 http://seclists.org/fulldisclosure/2024/Jan/37 http://seclists.org/fulldisclosure/2024/Jan/38 https://hackerone.com/reports/2072338 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 28EXPL: 0CVE-2023-36788 – .NET Framework Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-36788
.NET Framework Remote Code Execution Vulnerability Vulnerabilidad de Ejecución Remota de Código de .NET Framework • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36788 •
CVSS: 7.8EPSS: 0%CPEs: 47EXPL: 0CVE-2023-36792 – Visual Studio Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-36792
Visual Studio Remote Code Execution Vulnerability Vulnerabilidad de Ejecución Remota de Códigode Visual Studio • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36792 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.8EPSS: 0%CPEs: 48EXPL: 0CVE-2023-36793 – Visual Studio Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-36793
Visual Studio Remote Code Execution Vulnerability Vulnerabilidad de Ejecución Remota de Código de Visual Studio • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36793 • CWE-122: Heap-based Buffer Overflow •
CVSS: 7.8EPSS: 0%CPEs: 48EXPL: 0CVE-2023-36794 – Visual Studio Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-36794
Visual Studio Remote Code Execution Vulnerability Vulnerabilidad de Ejecución Remota de Código de Visual Studio • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36794 • CWE-191: Integer Underflow (Wrap or Wraparound) •