CVSS: 5.3EPSS: 0%CPEs: 56EXPL: 0CVE-2018-20685 – openssh: scp client improper directory name validation
https://notcve.org/view.php?id=CVE-2018-20685
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. En OpenSSH 7.9, scp.c en el cliente scp permite que los servidores SSH omitan las restricciones de acceso planeadas mediante un nombre de archivo "." o un nombre de archivo vacío. El impacto consiste en modificar los permisos del directorio objetivo en el lado del cliente. • http://www.securityfocus.com/bid/106531 https://access.redhat.com/errata/RHSA-2019:3702 https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197&r2=1.198&f=h https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2 https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html https://security.gentoo.org/glsa/201903-16 https://security.gentoo.org/glsa/202007- • CWE-20: Improper Input Validation CWE-863: Incorrect Authorization •
CVSS: 4.3EPSS: 0%CPEs: 27EXPL: 1CVE-2018-16866 – systemd: out-of-bounds read when parsing a crafted syslog message
https://notcve.org/view.php?id=CVE-2018-16866
An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable. Se ha descubierto una lectura fuera de límites en systemd-journald en la forma en la que analiza mensajes de registro que terminan con dos puntos ":". Un atacante local puede emplear este error para divulgar datos de la memoria del proceso. • http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.html http://seclists.org/fulldisclosure/2019/May/21 http://www.openwall.com/lists/oss-security/2019/05/10/4 http://www.securityfocus.com/bid/106527 https://access.redhat.com/errata/RHSA-2019:2091 https://access.redhat.com/errata/RHSA-2019:3222 https://access.redhat.com/errata/RHSA-2020:0593 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16866 https://seclists.org/bugtraq/2019/May/25&# • CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 23EXPL: 1CVE-2018-16864 – systemd: stack overflow when calling syslog from a command with long cmdline
https://notcve.org/view.php?id=CVE-2018-16864
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable. Se ha descubierto una asignación de memoria sin límites, que podría resultar en que la pila choque con otra región de memoria, en systemd-journald, cuando un programa con argumentos largos de la línea de comandos llama a syslog. Un atacante local podría emplear este error para provocar el cierre inesperado de systemd-journald o escalar sus privilegios. • http://www.openwall.com/lists/oss-security/2021/07/20/2 http://www.securityfocus.com/bid/106523 https://access.redhat.com/errata/RHBA-2019:0327 https://access.redhat.com/errata/RHSA-2019:0049 https://access.redhat.com/errata/RHSA-2019:0204 https://access.redhat.com/errata/RHSA-2019:0271 https://access.redhat.com/errata/RHSA-2019:0342 https://access.redhat.com/errata/RHSA-2019:0361 https://access.redhat.com/errata/RHSA-2019:2402 https://bugzilla.redhat.com/show_ • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 1CVE-2018-16865 – systemd: stack overflow when receiving many journald entries
https://notcve.org/view.php?id=CVE-2018-16865
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable. Se ha descubierto una asignación de memoria sin límites que podría resultar en que la pila choque con otra región de memoria, en systemd-journald, cuando se envían muchas entradas al socket de journal. Un atacante local, o uno remoto si se emplea systemd-journal-remote, podría emplear este error para provocar el cierre inesperado de systemd-journald o ejecutar código con privilegios de journald. • http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.html http://seclists.org/fulldisclosure/2019/May/21 http://www.openwall.com/lists/oss-security/2019/05/10/4 http://www.openwall.com/lists/oss-security/2021/07/20/2 http://www.securityfocus.com/bid/106525 https://access.redhat.com/errata/RHBA-2019:0327 https://access.redhat.com/errata/RHSA-2019:0049 https://access.redhat.com/errata/RHSA-2019:0204 https://access.redhat.com/errata/RHSA-2019 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-16885 – kernel: out-of-bound read in memcpy_fromiovecend()
https://notcve.org/view.php?id=CVE-2018-16885
A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and buffer length which causes the read beyond the buffer boundaries, in certain cases causing a memory access fault and a system halt by accessing invalid memory address. This issue only affects kernel version 3.10.x as shipped with Red Hat Enterprise Linux 7. Se ha detectado un fallo en el kernel de Linux que permite al espacio de usuario llamar a memcpy_fromiovecend() y funciones similares con un offset de 0 y un tamaño de búfer que causa la lectura fuera de los límites de dicho búfer. En algunos casos, esto provoca un fallo de acceso a la memoria y la detención del sistema, accediendo a direcciones de memoria inválidas. Este problema solo afecta a las versiones 3.10.x del kernel, incluidas por defecto en Red Hat Enterprise Linux 7. • http://www.securityfocus.com/bid/106296 https://access.redhat.com/errata/RHSA-2019:2029 https://access.redhat.com/errata/RHSA-2019:2043 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16885 https://access.redhat.com/security/cve/CVE-2018-16885 https://bugzilla.redhat.com/show_bug.cgi?id=1661503 • CWE-125: Out-of-bounds Read •