CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 2CVE-2022-22844 – libtiff: out-of-bounds read in _TIFFmemcpy() in tif_unix.c
https://notcve.org/view.php?id=CVE-2022-22844
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field. LibTIFF versión 4.3.0, presenta una lectura fuera de límites en la función _TIFFmemcpy en el archivo tif_unix.c en determinadas situaciones que implican una etiqueta personalizada y 0x0200 como la segunda palabra del campo DE A buffer overflow vulnerability was found in libtiff. This flaw allows an attacker with network access to pass specially crafted files, causing an application to halt or crash. The root cause of this issue was from the memcpy function in tif_unix.c. • https://gitlab.com/libtiff/libtiff/-/issues/355 https://gitlab.com/libtiff/libtiff/-/merge_requests/287 https://lists.debian.org/debian-lts-announce/2022/03/msg00001.html https://security.gentoo.org/glsa/202210-10 https://security.netapp.com/advisory/ntap-20220311-0002 https://www.debian.org/security/2022/dsa-5108 https://access.redhat.com/security/cve/CVE-2022-22844 https://bugzilla.redhat.com/show_bug.cgi?id=2042603 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 1CVE-2021-45078
https://notcve.org/view.php?id=CVE-2021-45078
stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699. La función stab_xcoff_builtin_type en el archivo stabs.c en GNU Binutils versiones hasta 2.37, permite a atacantes causar una denegación de servicio (desbordamiento de búfer basado en la pila) o posiblemente tener otro impacto no especificado, como lo demuestra una escritura fuera de límites. NOTA: este problema se presenta debido a una corrección incorrecta de CVE-2018-12699 • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQBH244M5PV6S6UMHUTCVCWFZDX7Y4M6 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUHLDDT3HH7YEY6TX7IJRGPJUTNNVEL3 https://security.gentoo.org/glsa/202208-30 https://security.netapp.com/advisory/ntap-20220107-0002 https://sourceware.org/bugzilla/show_bug.cgi?id=28694 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=161e87d12167b1e36193385485c1f6ce92f74f02 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 28EXPL: 0CVE-2021-4044 – Invalid handling of X509_verify_cert() internal errors in libssl
https://notcve.org/view.php?id=CVE-2021-4044
Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned by OpenSSL if the application has previously called SSL_CTX_set_cert_verify_callback(). Since most applications do not do this the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be totally unexpected and applications may not behave correctly as a result. • https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=758754966791c537ea95241438454aa86f91f256 https://security.netapp.com/advisory/ntap-20211229-0003 https://www.openssl.org/news/secadv/20211214.txt • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2021-3671
https://notcve.org/view.php?id=CVE-2021-3671
A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server. Se ha encontrado una desreferencia de puntero null en la forma en que el servidor kerberos de Samba manejaba el sname faltante en TGS-REQ (Ticket Granting Server - Request). Un usuario autenticado podría usar este fallo para bloquear el servidor samba • https://bugzilla.redhat.com/show_bug.cgi?id=2013080%2C https://bugzilla.samba.org/show_bug.cgi?id=14770%2C https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a https://lists.debian.org/debian-lts-announce/2022/11/msg00034.html https://security.netapp.com/advisory/ntap-20221215-0002 https://security.netapp.com/advisory/ntap-20230216-0008 https://www.debian.org/security/2022/dsa-5287 • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-3667 – libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API
https://notcve.org/view.php?id=CVE-2021-3667
An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. Se ha encontrado un problema de bloqueo inapropiado en la API virStoragePoolLookupByTargetPath de libvirt. • https://bugzilla.redhat.com/show_bug.cgi?id=1986094 https://gitlab.com/libvirt/libvirt/-/commit/447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87 https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87 https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html https://security.gentoo.org/glsa/202210-06 https://security.netapp.com/advisory/ntap-20220331-0005 https://access.redhat.com/security/cve/CVE-2021-3667 • CWE-667: Improper Locking •