CVSS: 5.3EPSS: 1%CPEs: 12EXPL: 0CVE-2019-14861
https://notcve.org/view.php?id=CVE-2019-14861
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authenticated users. This is used for example to allow machines to self-register in DNS. If a DNS record was created that case-insensitively matched the name of the zone, the ldb_qsort() and dns_name_compare() routines could be confused into reading memory prior to the list of DNS entries when responding to DnssrvEnumRecords() or DnssrvEnumRecords2() and so following invalid memory as a pointer. • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.html http://www.openwall.com/lists/oss-security/2024/06/24/3 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14861 https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PJH3ROOFYMOATD2UEPC47P5RPBDTY77E https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNKA4YIPV7AZR7KK3GW6L3HKGHSGJZFE https:/&#x • CWE-276: Incorrect Default Permissions •
CVSS: 9.3EPSS: 0%CPEs: 11EXPL: 0CVE-2019-14889 – libssh: unsanitized location in scp could lead to unwanted command execution
https://notcve.org/view.php?id=CVE-2019-14889
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target. Se detectó un fallo con la función ssh_scp_new() de la API libssh en versiones anteriores a 0.9.3 y anteriores a 0.8.8. Cuando el cliente libssh SCP se conecta a un servidor, el comando scp, que incluye una ruta provista por el usuario, es ejecutado en el lado del servidor. • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00033.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00047.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14889 https://lists.debian.org/debian-lts-announce/2019/12/msg00020.html https://lists.debian.org/debian-lts-announce/2023/05/msg00029.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JJWJTXVWLLJTVHBPGWL7472S5FWXYQR https://lists.fedoraproject.org/archives/li • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.4EPSS: 0%CPEs: 13EXPL: 0CVE-2019-14870
https://notcve.org/view.php?id=CVE-2019-14870
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set. Todas las versiones de Samba 4.xx anteriores a 4.9.17, versiones 4.10.x anteriores a 4.10.11 y versiones 4.11.x anteriores a 4.11.3, presentan un problema, donde el modelo de delegación de Kerberos S4U (MS-SFU) incluye una funcionalidad que permite a un subconjunto de clientes ser excluidos de la delegación restringida de cualquier manera, ya sea S4U2Self o autenticación Kerberos regular, al forzar que todos los tickets para estos clientes no sean reenviables. En AD, esto es implementado mediante un atributo de usuario delegation_not_allowed (también se conoce como no delegado), que se traduce como no permitido-reenviable. • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14870 https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html https://lists.debian.org/debian-lts-announce/2022/11/msg00034.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PJH3ROOFYMOATD2UEPC47P5RPBDTY77E https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNKA4YIPV7AZR7KK3GW6L3HKGHSGJZFE https: • CWE-285: Improper Authorization CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 0%CPEs: 35EXPL: 1CVE-2019-19448
https://notcve.org/view.php?id=CVE-2019-19448
In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure. En el kernel de Linux versiones 5.0.21 y 5.3.11, montando una imagen de sistema de archivos btrfs diseñada, al realizar algunas operaciones y luego haciendo una llamada de sistema syncfs puede conllevar a un uso de la memoria previamente liberada en la función try_merge_free_space en el archivo fs/btrfs/free-space-cache.c porque el puntero en una estructura de datos izquierda puede ser el mismo que el puntero en una estructura de datos derecha. • https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19448 https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html https://security.netapp.com/advisory/ntap-20200103-0001 https://usn.ubuntu.com/4578-1 • CWE-416: Use After Free •
CVSS: 5.9EPSS: 2%CPEs: 1EXPL: 1CVE-2012-2092
https://notcve.org/view.php?id=CVE-2012-2092
A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the GPG signature. Se presenta una vulnerabilidad de Omisión de Seguridad en Ubuntu Cobbler versiones anteriores a 2,2,2 en el script cobbler-ubuntu-import debido a un error cuando se comprueba la firma GPG. • http://www.openwall.com/lists/oss-security/2012/04/10/14 http://www.securityfocus.com/bid/52971 https://exchange.xforce.ibmcloud.com/vulnerabilities/74789 https://security-tracker.debian.org/tracker/CVE-2012-2092 • CWE-347: Improper Verification of Cryptographic Signature •