CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2013-1055 – Potential DoS through abuse of rate limit in libunity-webapps for Firefox
https://notcve.org/view.php?id=CVE-2013-1055
The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with new callbacks until the libunity-webapps rate limit was hit. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 of unity-firefox-extension and in all versions of libunity-webapps by shipping an empty unity-firefox-extension package, thus disabling the extension entirely and invalidating the attack against the libunity-webapps package. El paquete unity-firefox-extension podría ser engañado para que dejara caer una devolución de llamada C que todavía estaba en uso, que luego Firefox liberaría, causando un bloqueo en Firefox. Esto podría ser alcanzado al agregar una acción al iniciar y actualizar con nuevas devoluciones de llamada hasta que se alcance el límite de frecuencia de libunity-webapps. • https://launchpad.net/bugs/1175691 https://ubuntu.com/USN-2743-3 • CWE-404: Improper Resource Shutdown or Release •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2013-1054 – Possible remote DOS in WebApps
https://notcve.org/view.php?id=CVE-2013-1054
The unity-firefox-extension package could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 by shipping an empty package, thus disabling the extension entirely. El paquete unity-firefox-extension podría ser engañado para destruir el contexto de las aplicaciones web de Unity, haciendo que Firefox se bloquee. Esto se puede lograr girando el bucle de eventos dentro de la devolución de llamada de inicialización de la aplicación web. • https://launchpad.net/bugs/1175661 https://ubuntu.com/USN-2743-3 • CWE-404: Improper Resource Shutdown or Release •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2021-3444 – Linux kernel bpf verifier incorrect mod32 truncation
https://notcve.org/view.php?id=CVE-2021-3444
The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 ("bpf: Fix truncation handling for mod32 dst reg wrt zero") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101. El comprobador bpf en el kernel de Linux no manejó apropiadamente el truncamiento del registro de destino mod32 cuando se sabía que el registro de origen era 0. Un atacante local con la habilidad de cargar programas bpf podría usar esta ganancia para lecturas fuera de límites en la memoria del kernel que conllevan a una divulgación de información (memoria del kernel) y, posiblemente, escrituras fuera de límites que podrían conllevar a una ejecución de código. • http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html http://packetstormsecurity.com/files/164950/Kernel-Live-Patch-Security-Notice-LSN-0082-1.html http://www.openwall.com/lists/oss-security/2021/03/23/2 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9b00f1b78809 https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html https://security.netapp.com/advisory/ntap-20210416-0006 https://www.openwall.com/lists&# • CWE-125: Out-of-bounds Read CWE-681: Incorrect Conversion between Numeric Types •
CVSS: 6.0EPSS: 0%CPEs: 9EXPL: 0CVE-2020-27171
https://notcve.org/view.php?id=CVE-2020-27171
An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-10d2bb2e6b1d. Se detectó un problema en el kernel de Linux versiones anteriores a 5.11.8. El archivo kernel/bpf/verifier.c presenta un error por un paso (con un subdesbordamiento de enteros resultante) afectando la especulación fuera de límites en la aritmética de punteros, conllevando a ataques de canal lateral que anulan las mitigaciones de Spectre y consiguen información confidencial de la memoria del kernel , también se conoce como CID-10d2bb2e6b1d • http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html http://www.openwall.com/lists/oss-security/2021/03/24/5 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8 https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch/?id=10d2bb2e6b1d8c4576c56a748f697dbeb8388899 https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FB6LUXPEIRLZH • CWE-193: Off-by-one Error •
CVSS: 4.7EPSS: 0%CPEs: 9EXPL: 0CVE-2020-27170 – kernel: Speculation on pointer arithmetic against bpf_context pointer
https://notcve.org/view.php?id=CVE-2020-27170
An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects pointer types that do not define a ptr_limit. Se detectó un problema en el kernel de Linux versiones anteriores a 5.11.8. El archivo kernel/bpf/verifier.c lleva a cabo especulaciones no deseadas fuera de límites en aritmética de punteros, conllevando a ataques de canal lateral que anulan las mitigaciones de Spectre y consiguen información confidencial de la memoria del kernel, también se conoce como CID-f232326f6966. Esto afecta a los tipos de punteros que no definen un ptr_limit A flaw was found in the Linux kernels eBPF verification code. • http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html http://www.openwall.com/lists/oss-security/2021/03/24/4 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f232326f6966cf2a1d1db7bc917a4ce5f9f55f76 https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FB6LU • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •