CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2018-17101 – libtiff: Two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c
https://notcve.org/view.php?id=CVE-2018-17101
An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file. Se ha descubierto un problema en LibTIFF 4.0.9. Hay dos escrituras fuera de límites en cpTags en tools tiff2bw.c y tools pal2rgb.c que pueden provocar una denegación de servicio (cierre inesperado de la aplicación) o, posiblemente, otro tipo de impacto sin especificar mediante un archivo de imagen manipulado. • http://bugzilla.maptools.org/show_bug.cgi?id=2807 http://www.securityfocus.com/bid/105370 https://access.redhat.com/errata/RHSA-2019:2053 https://gitlab.com/libtiff/libtiff/merge_requests/33/diffs?commit_id=f1b94e8a3ba49febdd3361c0214a1d1149251577 https://lists.debian.org/debian-lts-announce/2018/10/msg00019.html https://usn.ubuntu.com/3864-1 https://usn.ubuntu.com/3906-2 https://www.debian.org/security/2018/dsa-4349 https://access.redhat.com/security/cve/CVE-2018-17101 https:&#x • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 1CVE-2018-17000
https://notcve.org/view.php?id=CVE-2018-17000
A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp. Una desreferencia de puntero NULL en la función _TIFFmemcmp en tif_unix.c (llamado desde TIFFWriteDirectoryTagTransferfunction) en LibTIFF 4.0.9 permite que un atacante provoque una denegación de servicio (DoS) mediante un archivo TIFF manipulado. La vulnerabilidad puede ser desencadenada por el ejecutable tiffcp. • http://bugzilla.maptools.org/show_bug.cgi?id=2811 http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.html http://www.securityfocus.com/bid/105342 https://lists.debian.org/debian-lts-announce/2019/02/msg00026.html https://usn.ubuntu.com/3906-1 https://www.debian.org/security/2020/dsa-4670 • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 0CVE-2018-16802 – ghostscript: Incorrect "restoration of privilege" checking when running out of stack during exception handling
https://notcve.org/view.php?id=CVE-2018-16802
An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509. Se ha descubierto un problema en versiones anteriores a la 9.25 de Artifex Ghostscript. La comprobación incorrecta de "restoration of privilege" al quedarse sin pila durante el manejo de excepciones podría ser empleada por atacantes que sean capaces de proporcionar PostScript manipulado para ejecutar código mediante la instrucción "pipe". • http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=3e5d316b72e3965b7968bb1d96baa137cd063ac6 http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=643b24dbd002fb9c131313253c307cf3951b3d47 https://access.redhat.com/errata/RHSA-2018:3834 https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=5812b1b78fc4d36fdc293b7859de69241140d590 https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html https://seclists.org/oss-sec/2018/q3/228 https://seclists.org/oss-sec/2018/q3/229 https://security • CWE-20: Improper Input Validation •
CVSS: 7.0EPSS: 0%CPEs: 6EXPL: 0CVE-2018-14625 – kernel: use-after-free Read in vhost_transport_send_pkt
https://notcve.org/view.php?id=CVE-2018-14625
A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt AF_VSOCK messages destined to other clients. Se ha detectado un error en el kernel de Linux en el que un atacante podría ser capaz de tener una lectura no controlada de la memoria del kernel desde dentro de una máquina virtual invitada. Una condición de carrera entre las funciones connect() y close() podría permitir que un atacante que emplee el protocolo AF_VSOCK reúna una filtración de información de 4 bytes o, posiblemente, intercepte o corrompa mensajes AF_VSOCK destinados a otros clientes A flaw was found where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly impersonate AF_VSOCK messages destined to other clients or leak kernel memory. • https://access.redhat.com/errata/RHSA-2019:2029 https://access.redhat.com/errata/RHSA-2019:2043 https://access.redhat.com/errata/RHSA-2019:4154 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14625 https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html https://syzkaller.appspot.com/bug?extid=bd391451452fb0b93039 https://usn.ubuntu.com/3871-1 https://usn.ubuntu.com/3871-3 https://usn.ubuntu.com/3871-4 https://usn.ubuntu.com/3871-5 https://usn • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 1CVE-2018-16750 – ImageMagick: Memory leak in the formatIPTCfromBuffer function in coders/meta.c
https://notcve.org/view.php?id=CVE-2018-16750
In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c was found. En ImageMagick 7.0.7-29 y anteriores, se ha encontrado una fuga de memoria en la función formatIPTCfromBuffer en coders/meta.c. • http://www.securityfocus.com/bid/108492 https://github.com/ImageMagick/ImageMagick/issues/1118 https://usn.ubuntu.com/3785-1 https://access.redhat.com/security/cve/CVE-2018-16750 https://bugzilla.redhat.com/show_bug.cgi?id=1627917 • CWE-400: Uncontrolled Resource Consumption CWE-772: Missing Release of Resource after Effective Lifetime •