CVSS: 5.0EPSS: 1%CPEs: 29EXPL: 2CVE-2014-6040 – glibc: crash in code page decoding functions (IBM933, IBM935, IBM937, IBM939, IBM1364)
https://notcve.org/view.php?id=CVE-2014-6040
GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of "0xffff" to the iconv function when converting (1) IBM933, (2) IBM935, (3) IBM937, (4) IBM939, or (5) IBM1364 encoded data to UTF-8. GNU C Library (también conocido como glibc) anterior a 2.20 permite a atacantes dependientes de contexto causar una denegación de servicio (lectura fuera de rango y caída) a través de un valor de caracteres de multibytes de '0xffff' en la función iconv cuando convierte datos codificados de (1) IBM933, (2) IBM935, (3) IBM937, (4) IBM939, o (5) IBM1364 a UTF-8. An out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application. • http://linux.oracle.com/errata/ELSA-2015-0016.html http://secunia.com/advisories/62100 http://secunia.com/advisories/62146 http://ubuntu.com/usn/usn-2432-1 http://www.debian.org/security/2015/dsa-3142 http://www.mandriva.com/security/advisories?name=MDVSA-2014:175 http://www.openwall.com/lists/oss-security/2014/08/29/3 http://www.openwall.com/lists/oss-security/2014/09/02/1 http://www.securityfocus.com/bid/69472 https://security.gentoo.org/glsa/201602-02& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 1CVE-2014-5119 – glibc - NUL Byte gconv_translit_find Off-by-One
https://notcve.org/view.php?id=CVE-2014-5119
Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules. Error de superación de límite (off-by-one) en la función __gconv_translit_find en gconv_trans.c en GNU C Library (también conocido como glibc) permite a atacantes dependientes de contexto causar una denegación de servicio (caída) o ejecutar código arbitrario a través de vectores relacionados con la variable del entorno CHARSET y los módulos de transliteración gconv. An off-by-one heap-based buffer overflow flaw was found in glibc's internal __gconv_translit_find() function. An attacker able to make an application call the iconv_open() function with a specially crafted argument could possibly use this flaw to execute arbitrary code with the privileges of that application. • https://www.exploit-db.com/exploits/34421 http://googleprojectzero.blogspot.com/2014/08/the-poisoned-nul-byte-2014-edition.html http://linux.oracle.com/errata/ELSA-2015-0092.html http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00017.html http://rhn.redhat.com/errata/RHSA-2014-1118.html http://seclists.org/fulldisclosure/2014/Aug/69 http://secunia.com/advisories/60345 http://secunia.com/advisories/60358 http://secunia.com/advisories/60441 http://secunia.com/advi • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 1CVE-2014-4043 – Cisco Device Hardcoded Credentials / GNU glibc / BusyBox
https://notcve.org/view.php?id=CVE-2014-4043
The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities. La función posix_spawn_file_actions_addopen en glibc anterior a 2.20 no copia su argumento de ruta de acuerdo con la especificación POSIX, lo que permite a atacantes dependientes de contexto provocar vulnerabilidades de uso después de liberación. Many Cisco devices such as Cisco RV340, Cisco RV340W, Cisco RV345, Cisco RV345P, Cisco RV260, Cisco RV260P, Cisco RV260W, Cisco 160, and Cisco 160W suffer from having hard-coded credentials, known GNU glibc, known BusyBox, and IoT Inspector identified vulnerabilities. • http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00012.html http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html http://seclists.org/fulldisclosure/2019/Jun/18 http://seclists.org/fulldisclosure/2019/Sep/7 http://www.mandriva.com/security/advisories?name=MDVSA-2014:152 http://www.securityfocus.com/bid/68006 https://bugzil • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.8EPSS: 0%CPEs: 29EXPL: 0CVE-2014-0475 – glibc: directory traversal in LC_* locale handling
https://notcve.org/view.php?id=CVE-2014-0475
Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable. Múltiples vulnerabilidades de salto de directorio en GNU C Library (también conocido como glibc or libc6) anterior a 2.20 permiten a atacantes dependientes de contexto evadir las restricciones ForceCommand y posiblemente tener otro impacto no especificado a través de un .. (punto punto) en una variable (1) LC_*, (2) LANG o otra variable del entorno local. A directory traveral flaw was found in the way glibc loaded locale files. • http://linux.oracle.com/errata/ELSA-2015-0092.html http://www.debian.org/security/2014/dsa-2976 http://www.mandriva.com/security/advisories?name=MDVSA-2014:152 http://www.openwall.com/lists/oss-security/2014/07/10/7 http://www.openwall.com/lists/oss-security/2014/07/14/6 http://www.securityfocus.com/bid/68505 http://www.securitytracker.com/id/1030569 https://rhn.redhat.com/errata/RHSA-2014-1110.html https://security.gentoo.org/glsa/201602-02 https://sourcew • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 3%CPEs: 29EXPL: 1CVE-2013-4458 – glibc: Stack (frame) overflow in getaddrinfo() when called with AF_INET6
https://notcve.org/view.php?id=CVE-2013-4458
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914. Desbordamiento de búfer basado en pila en la función getaddrinfo en sysdeps/posix/getaddrinfo.c de GNU C Library (también conocido como glibc o libc6) 2.18 y anteriores versiones permite a atacantes remotos provocar una denegación de servicio (caída) a través de (1) un nombre de host o (2) dirección IP que desencadena un gran número de resultados de dirección AF_INET6. NOTA: esta vulnerabilidad existe por un parche incompleto para CVE-2013-1914. It was found that getaddrinfo() did not limit the amount of stack memory used during name resolution. • http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html http://www.mandriva.com/security/advisories?name=MDVSA-2013:283 http://www.mandriva.com/security/advisories?name=MDVSA-2013:284 https://security.gentoo.org/glsa/201503-04 https://sourceware.org/bugzilla/show_bug.cgi?id=16072 https://sourceware.org/ml/libc-alpha/2013-10/msg00733.html https://access.redhat.com/security/cve/CVE-2013-4458 https://bugzilla.redhat.com/show_bug.cgi?id=1022280 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •