CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 0CVE-2018-10902 – Linux Kernel MIDI Race Condition Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2018-10902
It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation. Se ha detectado que el controlador del kernel midi raw no protege contra el acceso concurrente, lo que conduce a un doble realloc (doble liberación) en snd_rawmidi_input_params() y snd_rawmidi_output_status(), que son parte del manipulador snd_rawmidi_ioctl() en el archivo rawmidi.c. Un atacante local malicioso podría utilizarlo para escalar privilegios. This vulnerability allows local attackers to escalate privileges on vulnerable installations of Linux Kernel. • http://www.securityfocus.com/bid/105119 http://www.securitytracker.com/id/1041529 https://access.redhat.com/errata/RHSA-2018:3083 https://access.redhat.com/errata/RHSA-2018:3096 https://access.redhat.com/errata/RHSA-2019:0415 https://access.redhat.com/errata/RHSA-2019:0641 https://access.redhat.com/errata/RHSA-2019:3217 https://access.redhat.com/errata/RHSA-2019:3967 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10902 https://git.kernel.org/pub/scm/linux/k • CWE-415: Double Free CWE-416: Use After Free •
CVSS: 9.8EPSS: 5%CPEs: 6EXPL: 0CVE-2018-14600 – libX11: Out of Bounds write in XListExtensions in ListExt.c
https://notcve.org/view.php?id=CVE-2018-14600
An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution. Se ha descubierto un problema en libX11 hasta su versión 1.6.5. La función XListExtensions en ListExt.c interpreta una variable como firmada en lugar de no firmada, lo que resulta en una escritura fuera de límites (de hasta 128 bytes), lo que conduce a una denegación de servicio (DoS) o a la ejecución remota de código. An out of bounds write, limited to NULL bytes, was discovered in libX11 in functions XListExtensions() and XGetFontPath(). • http://www.openwall.com/lists/oss-security/2018/08/21/6 http://www.securityfocus.com/bid/105177 http://www.securitytracker.com/id/1041543 https://access.redhat.com/errata/RHSA-2019:2079 https://bugzilla.suse.com/show_bug.cgi?id=1102068 https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=dbf72805fd9d7b1846fe9a11b46f3994bfc27fea https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html https://lists.x.org/archives/xorg-announce/2018-August/002916.html https://security. • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2018-14598 – libX11: Crash on invalid reply in XListExtensions in ListExt.c
https://notcve.org/view.php?id=CVE-2018-14598
An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault). Se ha descubierto un problema en XListExtensions en ListExt.c en libX11 hasta la versión 1.6.5. Un servidor malicioso puede enviar una respuesta en la cual la primera cadena se desborda, provocando que una variable se establezca como NULL y se libere posteriormente, lo que conduce a una denegación de servicio (fallo de segmentación). It was discovered that libX11 does not properly validate input coming from the server, causing XListExtensions() and XGetFontPath() functions to produce an invalid list of elements that in turn make XFreeExtensionsList() and XFreeFontPath() access invalid memory. • http://www.openwall.com/lists/oss-security/2018/08/21/6 http://www.securityfocus.com/bid/105177 http://www.securitytracker.com/id/1041543 https://access.redhat.com/errata/RHSA-2019:2079 https://bugzilla.suse.com/show_bug.cgi?id=1102073 https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=e83722768fd5c467ef61fa159e8c6278770b45c2 https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 1%CPEs: 10EXPL: 0CVE-2018-14599 – libX11: Off-by-one error in XListExtensions in ListExt.c
https://notcve.org/view.php?id=CVE-2018-14599
An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact. Se ha descubierto un problema en libX11 hasta su versión 1.6.5. La función XListExtensions en ListExt.c es vulnerable a un error por un paso provocado por respuestas maliciosas del servidor, lo que conduce a una denegación de servicio (DoS) o a otro tipo de impacto sin especificar. An off-by-one error has been discovered in libX11 in functions XGetFontPath(), XListExtensions(), and XListFonts(). • http://www.openwall.com/lists/oss-security/2018/08/21/6 http://www.securityfocus.com/bid/105177 http://www.securitytracker.com/id/1041543 https://access.redhat.com/errata/RHSA-2019:2079 https://bugzilla.suse.com/show_bug.cgi?id=1102062 https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=b469da1430cdcee06e31c6251b83aede072a1ff0 https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ • CWE-193: Off-by-one Error CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 2%CPEs: 5EXPL: 0CVE-2018-1000222
https://notcve.org/view.php?id=CVE-2018-1000222
Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5. Libgd 2.2.5 contiene una vulnerabilidad de doble liberación (double free) en la función gdImageBmpPtr que puede resultar en la ejecución remota de código. Este ataque parece ser explotable mediante una imagen JPEG especialmente manipulada que desencadene una doble liberación (double free). • https://github.com/libgd/libgd/issues/447 https://lists.debian.org/debian-lts-announce/2019/01/msg00028.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6 https://security.gentoo.org/glsa/201903-18 https://usn.ubuntu.com/3755-1 • CWE-415: Double Free •