CVSS: 7.0EPSS: 0%CPEs: 10EXPL: 1CVE-2016-9591 – jasper: use-after-free / double-free in JPC encoder
https://notcve.org/view.php?id=CVE-2016-9591
JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application using JasPer. JasPer, en versiones anteriores a la 2.0.12, es vulnerable a un uso de memoria previamente liberada en la forma en la que descifra ciertos archivos de imagen JPEG 2000. Esto resulta en un cierre inesperado de la aplicación que esté usando JasPer. A use-after-free flaw was found in the way JasPer, before version 2.0.12, decode certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. • http://www.securityfocus.com/bid/94952 https://access.redhat.com/errata/RHSA-2017:1208 https://bugzilla.redhat.com/show_bug.cgi?id=1406405 https://security.gentoo.org/glsa/201707-07 https://www.debian.org/security/2017/dsa-3827 https://access.redhat.com/security/cve/CVE-2016-9591 • CWE-416: Use After Free •
CVSS: 9.3EPSS: 0%CPEs: 10EXPL: 1CVE-2017-16997 – glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries
https://notcve.org/view.php?id=CVE-2017-16997
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution. elf/dl-load.c en la biblioteca GNU C (también llamada glibc o libc6) desde la versión 2.19 hasta la 2.26 manipula incorrectamente RPATH y RUNPATH que contienen $ORIGIN para un programa privilegiado (setuid o AT_SECURE), lo que permite que los usuarios locales obtengan privilegios mediante una librería con malware troyano en el directorio actual. Esto está relacionado con las funciones fillin_rpath y decompose_rpath. Esto se asocia con la interpretación incorrecta de un token RPATH/RUNPATH vacío como el directorio "./". • https://github.com/Xiami2012/CVE-2017-16997-poc http://www.securityfocus.com/bid/102228 https://access.redhat.com/errata/RHBA-2019:0327 https://access.redhat.com/errata/RHSA-2018:3092 https://bugs.debian.org/884615 https://sourceware.org/bugzilla/show_bug.cgi?id=22625 https://sourceware.org/ml/libc-alpha/2017-12/msg00528.html https://access.redhat.com/security/cve/CVE-2017-16997 https://bugzilla.redhat.com/show_bug.cgi?id=1526865 • CWE-426: Untrusted Search Path CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') •
CVSS: 9.8EPSS: 0%CPEs: 20EXPL: 0CVE-2018-6485 – glibc: Integer overflow in posix_memalign in memalign functions
https://notcve.org/view.php?id=CVE-2018-6485
An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption. Un desbordamiento de enteros en la implementación de posix_memalign en las funciones memalign en GNU C Library (también conocido como glibc o libc6) en versiones 2.26 y anteriores podría provocar que estas funciones devuelvan un puntero a un área de la memoria dinámica (heap) demasiado pequeña, pudiendo corromper el heap. • http://bugs.debian.org/878159 http://www.securityfocus.com/bid/102912 https://access.redhat.com/errata/RHBA-2019:0327 https://access.redhat.com/errata/RHSA-2018:3092 https://security.netapp.com/advisory/ntap-20190404-0003 https://sourceware.org/bugzilla/show_bug.cgi?id=22343 https://usn.ubuntu.com/4218-1 https://usn.ubuntu.com/4416-1 https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html https://access.redhat.com/security/cve/CVE-2018-6485 https:/ • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 4CVE-2018-1000001 – glibc - 'realpath()' Privilege Escalation
https://notcve.org/view.php?id=CVE-2018-1000001
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution. En glibc 2.26 y anteriores existe una confusión en el uso de getcwd() por realpath(), que puede emplearse para escribir antes del búfer de destino. Esto conduce a un subdesbordamiento de búfer y a una potencial ejecución de código. glibc suffers from a getcwd() local privilege escalation vulnerability. • https://www.exploit-db.com/exploits/44889 https://www.exploit-db.com/exploits/43775 https://github.com/0x00-0x00/CVE-2018-1000001 https://github.com/usernameid0/tools-for-CVE-2018-1000001 http://seclists.org/oss-sec/2018/q1/38 http://www.securityfocus.com/bid/102525 http://www.securitytracker.com/id/1040162 https://access.redhat.com/errata/RHSA-2018:0805 https://security.netapp.com/advisory/ntap-20190404-0003 https://usn.ubuntu.com/3534-1 https://usn.ubuntu.com • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.7EPSS: 0%CPEs: 13EXPL: 0CVE-2018-1000026 – kernel: Improper validation in bnx2x network card driver can allow for denial of service attacks via crafted packet
https://notcve.org/view.php?id=CVE-2018-1000026
Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM.. El kernel de Linux, al menos desde la versión v4.8, contiene una vulnerabilidad de validación de entradas insuficiente en el controlador de la tarjeta de red bnx2x que puede resultar en un DoS: la aserción del firmware de la tarjeta de red toma la tarjeta offline. Parece que el ataque puede ser explotado mediante un atacante que deba pasar un paquete muy grande, especialmente manipulado a la tarjeta bnx2x. • http://lists.openwall.net/netdev/2018/01/16/40 http://lists.openwall.net/netdev/2018/01/18/96 https://access.redhat.com/errata/RHSA-2018:2948 https://access.redhat.com/errata/RHSA-2018:3083 https://access.redhat.com/errata/RHSA-2018:3096 https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html https://patchwork.ozlabs.org/patch/859410 https://usn.ubuntu.com/3617-1 https://usn.ubuntu.com/3617-2 https://usn.ubuntu.com/3617-3 https://usn. • CWE-20: Improper Input Validation •