CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-32545 – Ubuntu Security Notice USN-6200-1
https://notcve.org/view.php?id=CVE-2022-32545
16 Jun 2022 — A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior. Se ha encontrado una vulnerabilidad en ImageMagick, que causa un fallo fuera del rango de valores representables del tipo "unsigned char" en el archivo coders/psd.c, cuando se procesa una entrada diseñada o no confiable. ... • https://bugzilla.redhat.com/show_bug.cgi?id=2091811 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-32546 – Gentoo Linux Security Advisory 202405-02
https://notcve.org/view.php?id=CVE-2022-32546
16 Jun 2022 — A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior. Se ha encontrado una vulnerabilidad en ImageMagick, que causa una salida del rango de valores representables del tipo "unsigned long" en el archivo coders/pcl.c, cuando es procesada una entrada diseñada o no confiable. Es... • https://bugzilla.redhat.com/show_bug.cgi?id=2091812 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-32547 – Ubuntu Security Notice USN-5736-1
https://notcve.org/view.php?id=CVE-2022-32547
16 Jun 2022 — In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte alignment at MagickCore/property.c. Whenever crafted or untrusted input is processed by ImageMagick, this causes a negative impact to application availability or other problems related to undefined behavior. En ImageMagick, se presenta una carga de dirección alineada inapropiadamente para el tipo "double", que requiere una alineación de 8 bytes, y para el tipo "f... • https://bugzilla.redhat.com/show_bug.cgi?id=2091813 • CWE-704: Incorrect Type Conversion or Cast •
CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 1CVE-2022-1708 – cri-o: memory exhaustion on the node when access to the kube api
https://notcve.org/view.php?id=CVE-2022-1708
07 Jun 2022 — A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the ... • https://bugzilla.redhat.com/show_bug.cgi?id=2085361 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2021-3839 – DPDK: out-of-bounds read/write in vhost_user_set_inflight_fd() may lead to crash
https://notcve.org/view.php?id=CVE-2021-3839
04 May 2022 — A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability. Se ha encontrado un fallo en la biblioteca vhost de DPDK. La función vhost_user_set_inflight_fd() no comprueba "msg-)payload.inflight.num_queues", causando posiblemente una lectura/escritura de memoria fuera de límites. • https://access.redhat.com/security/cve/CVE-2021-3839 • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2022-0984
https://notcve.org/view.php?id=CVE-2022-0984
29 Apr 2022 — Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges. Los usuarios con capacidad para configurar los criterios de las insignias (profesores y administradores por defecto) podían configurar las insignias del curso con los criterios del campo de perfil, que sólo deberían estar disponibles para las insignias del sitio • https://bugzilla.redhat.com/show_bug.cgi?id=2064118 • CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 32%CPEs: 20EXPL: 3CVE-2022-1227 – psgo: Privilege escalation in 'podman top'
https://notcve.org/view.php?id=CVE-2022-1227
29 Apr 2022 — A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service. Se ha encontrado un fallo de escalada de privilegios en Podman. • https://github.com/iridium-soda/CVE-2022-1227_Exploit • CWE-269: Improper Privilege Management CWE-281: Improper Preservation of Permissions •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 3CVE-2022-0852 – convert2rhel: Red Hat account password passed via command line by code
https://notcve.org/view.php?id=CVE-2022-0852
27 Apr 2022 — There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via e.g. htop or ps. The specific impact varies upon the privileges of the Red Hat account in question, but it could affect the integrity, availability, and/or data confidentiality of other systems that are administered by that account. This occurs regardless of how the pas... • https://access.redhat.com/security/cve/CVE-2022-0852 • CWE-359: Exposure of Private Personal Information to an Unauthorized Actor CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-42778 – Gentoo Linux Security Advisory 202209-03
https://notcve.org/view.php?id=CVE-2021-42778
18 Apr 2022 — A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo. Se ha encontrado un problema de doble liberación de la pila en Opensc versiones anteriores a 0.22.0, en la función sc_pkcs15_free_tokeninfo Multiple vulnerabilities have been discovered in OpenSC, the worst of which could result in the execution of arbitrary code. Versions less than 0.22.0 are affected. • https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28185 • CWE-415: Double Free CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-1304 – e2fsprogs: out-of-bounds read/write via crafted filesystem
https://notcve.org/view.php?id=CVE-2022-1304
14 Apr 2022 — An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem. Se ha encontrado una vulnerabilidad de lectura/escritura fuera de límites en e2fsprogs versión 1.46.5. Este problema conlleva a un fallo de segmentación y posiblemente una ejecución de código arbitrario por medio de un sistema de archivos especialmente diseñado An out-of-bounds read/write vulnerability was found in e2fspro... • https://bugzilla.redhat.com/show_bug.cgi?id=2069726 • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •