CVSS: 7.5EPSS: 1%CPEs: 8EXPL: 3CVE-2014-8504 – binutils: stack overflow in the SREC parser
https://notcve.org/view.php?id=CVE-2014-8504
Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted file. Desbordamiento de buffer basado en pila en la función srec_scan en bfd/srec.c en GNU binutils 2.24 y anteriores permite a atacantes remotos causar una denegación de servicio (caída) y posiblemente tener orto impacto no especificado a través de un fichero manipulado. A stack-based buffer overflow flaw was found in the SREC parser of the libbfd library. A specially crafted file could cause an application using the libbfd library to crash or, potentially, execute arbitrary code with the privileges of the user running that application. • http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145262.html http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145328.html http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145742.html http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147346.html http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147354.html http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148427.html http://secunia.com/advisorie • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 4.6EPSS: 0%CPEs: 8EXPL: 0CVE-2014-7817 – glibc: command execution in wordexp() with WRDE_NOCMD specified
https://notcve.org/view.php?id=CVE-2014-7817
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))". La función wordexp en GNU C Library (también conocido como glibc) 2.21 no fuerza el indicador WRDE_NOCMD, lo que permite a atacantes dependientes de contexto ejecutar comandos arbitrarios, tal y como fue demostrado por entradas que contienen '$((`...`))'. It was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application. • http://linux.oracle.com/errata/ELSA-2015-0016.html http://linux.oracle.com/errata/ELSA-2015-0092.html http://lists.opensuse.org/opensuse-updates/2015-02/msg00089.html http://rhn.redhat.com/errata/RHSA-2014-2023.html http://seclists.org/oss-sec/2014/q4/730 http://secunia.com/advisories/62100 http://secunia.com/advisories/62146 http://www.debian.org/security/2015/dsa-3142 http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html http://www.oracle.com&#x • CWE-20: Improper Input Validation CWE-440: Expected Behavior Violation •
CVSS: 5.0EPSS: 8%CPEs: 15EXPL: 4CVE-2014-8768 – tcpdump 4.6.2 - Geonet Decoder Denial of Service
https://notcve.org/view.php?id=CVE-2014-8768
Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow remote attackers to cause a denial of service (segmentation fault and crash) via a crafted length value in a Geonet frame. Múltiples subdesbordamientos de enteros en la función geonet_print en tcpdump 4.5.0 hasta 4.6.2, cuando se utiliza el modo verbose, permite a atacantes remotos causar una denegación de servicio (fallo de segmentación y caída) a través de un valor de longitud manipulado en un Frame Geonet. tcpdump versions 4.5.0 through 4.6.2 suffers from a denial of service vulnerability when handling a malformed Geonet payload. • https://www.exploit-db.com/exploits/35359 http://lists.opensuse.org/opensuse-updates/2015-02/msg00062.html http://packetstormsecurity.com/files/129156/tcpdump-4.6.2-Geonet-Denial-Of-Service.html http://seclists.org/fulldisclosure/2014/Nov/48 http://www.exploit-db.com/exploits/35359 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.securityfocus.com/archive/1/534010/100/0/threaded http://www.securityfocus.com/bid/71155 http://www.ubuntu.com/ • CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 4.6EPSS: 0%CPEs: 5EXPL: 0CVE-2014-5388
https://notcve.org/view.php?id=CVE-2014-5388
Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sensitive information and have other unspecified impact related to a crafted PCI device that triggers memory corruption. Error de superación de límite (off-by-one) en la función pci_read en ACPI PCI interfaz hotplug (hw/acpi/pcihp.c) en QEMU permite a usuarios locales invitados obtener información sensible y tener otro impacto no especificado relacionado con un dispositivo PCI manipulado que provoca daños en la memoria. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fa365d7cd11185237471823a5a33d36765454e16 http://seclists.org/oss-sec/2014/q3/438 http://seclists.org/oss-sec/2014/q3/440 http://www.ubuntu.com/usn/USN-2409-1 https://bugzilla.redhat.com/show_bug.cgi?id=1132956 https://lists.gnu.org/archive/html/qemu-devel/2014-08/msg03338.html • CWE-193: Off-by-one Error •
CVSS: 4.3EPSS: 0%CPEs: 57EXPL: 0CVE-2014-3707 – curl: incorrect handle duplication after COPYPOSTFIELDS
https://notcve.org/view.php?id=CVE-2014-3707
The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information. La función curl_easy_duphandle en libcurl 7.17.1 hasta 7.38.0, cuando se ejecuta con la opción CURLOPT_COPYPOSTFIELDS, no copia debidamente datos HTTP POST para un manejo sencillo, lo que provoca una lectura fuera de rango que permite a servidores web remotos leer información sensible de la memoria. A flaw was found in the way the libcurl library performed the duplication of connection handles. If an application set the CURLOPT_COPYPOSTFIELDS option for a handle, using the handle's duplicate could cause the application to crash or disclose a portion of its memory. • http://curl.haxx.se/docs/adv_20141105.html http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743 http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html http://lists.opensuse.org/opensuse-updates/2015-02/msg00040.html http://rhn.redhat.com/errata/RHSA-2015-1254.html http://www.debian.org/security/2014/dsa-3069 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html htt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-416: Use After Free •