CVSS: 8.0EPSS: 0%CPEs: 24EXPL: 0CVE-2018-1087 – Kernel: KVM: error in exception handling leads to wrong debug stack value
https://notcve.org/view.php?id=CVE-2018-1087
kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest. kernel KVM en versiones anteriores al kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 y kernel 4.17-rc3 es vulnerable a un error en la forma en la que el hipervisor KVM del kernel de Linux gestiona las excepciones lanzadas tras una operación de cambio de pila mediante instrucciones Mov SS o Pop SS. Durante la operación de cambio de pila, el procesador no lanzó interrupciones y excepciones, sino que las lanza una vez se ha ejecutado la primera instrucción tras el cambio de pila. Un usuario invitado sin privilegios de KVM podría usar este error para provocar el cierre inesperado del guest o escalar sus privilegios en el guest. • http://www.openwall.com/lists/oss-security/2018/05/08/5 http://www.securityfocus.com/bid/104127 http://www.securitytracker.com/id/1040862 https://access.redhat.com/errata/RHSA-2018:1318 https://access.redhat.com/errata/RHSA-2018:1345 https://access.redhat.com/errata/RHSA-2018:1347 https://access.redhat.com/errata/RHSA-2018:1348 https://access.redhat.com/errata/RHSA-2018:1355 https://access.redhat.com/errata/RHSA-2018:1524 https://access.redhat.com/security/vulnerabili • CWE-250: Execution with Unnecessary Privileges •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 1CVE-2018-10767 – libgxps: Stack-based buffer overflow in calling glib in gxps_images_guess_content_type of gcontenttype.c
https://notcve.org/view.php?id=CVE-2018-10767
There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from a g_input_stream_read call. A crafted input will lead to a remote denial of service attack. Hay una sobrelectura de búfer basada en pila en la llamada a GLib en la función gxps_images_guess_content_type de gxps-images.c en libgxps hasta la versión 0.3.0 debido a que no rechaza los valores de retorno de una llamada g_input_stream_read. Se podría realizar un ataque de denegación de servicio remoto con una entrada especialmente manipulada. • https://access.redhat.com/errata/RHBA-2019:0327 https://access.redhat.com/errata/RHSA-2018:3140 https://access.redhat.com/errata/RHSA-2018:3505 https://bugzilla.redhat.com/show_bug.cgi?id=1575188 https://access.redhat.com/security/cve/CVE-2018-10767 https://bugzilla.redhat.com/show_bug.cgi?id=1576175 • CWE-121: Stack-based Buffer Overflow CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 1%CPEs: 7EXPL: 1CVE-2018-10768 – poppler: NULL pointer dereference in Annot.h:AnnotPath::getCoordsLength() allows for denial of service via crafted PDF
https://notcve.org/view.php?id=CVE-2018-10768
There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5. A crafted input will lead to a remote denial of service attack. Later Ubuntu packages such as for Poppler 0.41.0 are not affected. Hay una desreferencia de puntero NULL en la función AnnotPath::getCoordsLength en Annot.h en un paquete de Ubuntu para Poppler 0.24.5. Se podría realizar un ataque de denegación de servicio remoto con una entrada especialmente manipulada. • https://access.redhat.com/errata/RHBA-2019:0327 https://access.redhat.com/errata/RHSA-2018:3140 https://access.redhat.com/errata/RHSA-2018:3505 https://bugs.freedesktop.org/show_bug.cgi?id=106408 https://lists.debian.org/debian-lts-announce/2018/10/msg00024.html https://usn.ubuntu.com/3647-1 https://access.redhat.com/security/cve/CVE-2018-10768 https://bugzilla.redhat.com/show_bug.cgi?id=1576169 • CWE-476: NULL Pointer Dereference •
CVSS: 7.1EPSS: 7%CPEs: 12EXPL: 2CVE-2018-0494 – GNU wget - Cookie Injection
https://notcve.org/view.php?id=CVE-2018-0494
GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line. GNU Wget en versiones anteriores a la 1.19.5 es propenso a una vulnerabilidad de inyección de cookies en la función resp_new en http.c mediante una secuencia \r\n en una línea de continuación. A cookie injection flaw was found in wget. An attacker can create a malicious website which, when accessed, overrides cookies belonging to arbitrary domains. GNU Wget versions 1.7 through 1.19.4 suffer from a cookie injection vulnerability. • https://www.exploit-db.com/exploits/44601 http://www.securityfocus.com/bid/104129 http://www.securitytracker.com/id/1040838 https://access.redhat.com/errata/RHSA-2018:3052 https://git.savannah.gnu.org/cgit/wget.git/commit/?id=1fc9c95ec144499e69dc8ec76dbe07799d7d82cd https://lists.debian.org/debian-lts-announce/2018/05/msg00006.html https://lists.gnu.org/archive/html/bug-wget/2018-05/msg00020.html https://savannah.gnu.org/bugs/?53763 https://security.gentoo.org/glsa/201806-01 h • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 17EXPL: 1CVE-2018-1060 – python: DOS via regular expression catastrophic backtracking in apop() method in pop3lib
https://notcve.org/view.php?id=CVE-2018-1060
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service. Python antes de las versiones 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 y 3.7.0 es vulnerable a un retroceso catastrófico en el método apop () de pop3lib. Un atacante podría usar este fallo para causar la denegación de servicio. A flaw was found in the way catastrophic backtracking was implemented in python's pop3lib's apop() method. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html http://www.securitytracker.com/id/1042001 https://access.redhat.com/errata/RHBA-2019:0327 https://access.redhat.com/errata/RHSA-2018:3041 https://access.redhat.com/errata/RHSA-2018:3505 https://access.redhat.com/errata/RHSA-2019:1260 https://access.redhat.com/errata/RHSA-2019:3725 https://bugs.python.org/issue32981 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060 https://docs.python.org/ • CWE-20: Improper Input Validation •