CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-24763 – Infinite Loop in PJSIP
https://notcve.org/view.php?id=CVE-2022-24763
PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update. There are no known workarounds. PJSIP es una biblioteca de comunicación multimedia gratuita y de código abierto escrita en lenguaje C. • https://github.com/pjsip/pjproject/commit/856f87c2e97a27b256482dbe0d748b1194355a21 https://github.com/pjsip/pjproject/security/advisories/GHSA-5x45-qp78-g4p4 https://lists.debian.org/debian-lts-announce/2022/05/msg00047.html https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html https://security.gentoo.org/glsa/202210-37 https://www.debian.org/security/2022/dsa-5285 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 1CVE-2022-26291
https://notcve.org/view.php?id=CVE-2022-26291
lrzip v0.641 was discovered to contain a multiple concurrency use-after-free between the functions zpaq_decompress_buf() and clear_rulist(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted Irz file. Se ha detectado que lrzip versión v0.641, contiene una concurrencia múltiple de uso de memoria previamente liberada entre las funciones zpaq_decompress_buf() y clear_rulist(). Esta vulnerabilidad permite a atacantes causar una Denegación de Servicio (DoS) por medio de un archivo Irz diseñado • https://github.com/ckolivas/lrzip/issues/206 https://lists.debian.org/debian-lts-announce/2022/04/msg00012.html https://www.debian.org/security/2022/dsa-5145 • CWE-416: Use After Free •
CVSS: 4.9EPSS: 0%CPEs: 9EXPL: 0CVE-2022-0494 – kernel: information leak in scsi_ioctl()
https://notcve.org/view.php?id=CVE-2022-0494
A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality. Se ha identificado un fallo de filtrado de información del kernel en la función scsi_ioctl en el archivo drivers/scsi/scsi_ioctl.c en el kernel de Linux. este fallo permite a un atacante local con un privilegio de usuario especial (CAP_SYS_ADMIN o CAP_SYS_RAWIO) crear problemas de confidencialidad • https://bugzilla.redhat.com/show_bug.cgi?id=2039448 https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html https://lore.kernel.org/all/20220216084038.15635-1-tcs.kernel%40gmail.com https://www.debian.org/security/2022/dsa-5161 https://www.debian.org/security/2022/dsa-5173 https://access.redhat.com/security/cve/CVE-2022-0494 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-908: Use of Uninitialized Resource •
CVSS: 8.2EPSS: 0%CPEs: 71EXPL: 2CVE-2018-25032 – zlib: A flaw found in zlib when compressing (not decompressing) certain inputs
https://notcve.org/view.php?id=CVE-2018-25032
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. zlib versiones anteriores a 1.2.12 permite la corrupción de memoria al desinflar (es decir, al comprimir) si la entrada tiene muchas coincidencias distantes An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating (ex: when compressing) if the input has many distant matches. For some rare inputs with a large number of distant matches (crafted payloads), the buffer into which the compressed or deflated data is written can overwrite the distance symbol table which it overlays. This issue results in corrupted output due to invalid distances, which leads to out-of-bound access, corrupting the memory and potentially crashing the application. • http://seclists.org/fulldisclosure/2022/May/33 http://seclists.org/fulldisclosure/2022/May/35 http://seclists.org/fulldisclosure/2022/May/38 http://www.openwall.com/lists/oss-security/2022/03/25/2 http://www.openwall.com/lists/oss-security/2022/03/26/1 https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531 https://github.com/madler/zlib/compare/v1.2.11...v1.2.12 https://github.com& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 12EXPL: 1CVE-2022-0854 – kernel: swiotlb information leak with DMA_FROM_DEVICE
https://notcve.org/view.php?id=CVE-2022-0854
A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space. Se ha encontrado un fallo de pérdida de memoria en el subsistema DMA del kernel de Linux, en la forma en que un usuario llama a DMA_FROM_DEVICE. Este fallo permite a un usuario local leer memoria aleatoria del espacio del kernel • https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8&id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13 https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html https://www.debian.org/security/2022/dsa-5161 https://www.debian.org/security/2022/dsa-5173 https://access.redhat.com/security/cve/CVE-2022-0854 https://bugzilla.redhat.com/show_bug.cgi?id=2058395 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-401: Missing Release of Memory after Effective Lifetime •