CVSS: 10.0EPSS: 1%CPEs: 7EXPL: 1CVE-2023-3961 – Samba: smbd allows client access to unix domain sockets on the file system as root
https://notcve.org/view.php?id=CVE-2023-3961
12 Oct 2023 — A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connect... • https://access.redhat.com/errata/RHSA-2023:6209 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2023-39325 – HTTP/2 rapid reset can cause excessive work in net/http
https://notcve.org/view.php?id=CVE-2023-39325
11 Oct 2023 — A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). N... • https://go.dev/cl/534215 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2023-5535 – Use After Free in vim/vim
https://notcve.org/view.php?id=CVE-2023-5535
11 Oct 2023 — Use After Free in GitHub repository vim/vim prior to v9.0.2010. Use After Free en el repositorio de GitHub vim/vim anterior a la versión 9.0.2010. • https://github.com/vim/vim/commit/41e6f7d6ba67b61d911f9b1d76325cd79224753d • CWE-416: Use After Free •
CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2023-4091 – Samba: smb clients can truncate files with read-only permissions
https://notcve.org/view.php?id=CVE-2023-4091
11 Oct 2023 — A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions che... • https://access.redhat.com/errata/RHSA-2023:6209 • CWE-276: Incorrect Default Permissions •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-42670 – Samba: ad dc busy rpc multiple listener dos
https://notcve.org/view.php?id=CVE-2023-42670
11 Oct 2023 — A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation "classic DCs") can erroneously start and compete for the same unix domain sockets. This issue leads to partial query responses from the AD DC, causing issues such as "The procedure number is out of range" when... • https://access.redhat.com/security/cve/CVE-2023-42670 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 10.0EPSS: 79%CPEs: 7EXPL: 3CVE-2023-43641 – libcue vulnerable to out-of-bounds array access
https://notcve.org/view.php?id=CVE-2023-43641
09 Oct 2023 — libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. • https://packetstorm.news/files/id/176128 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-43615 – Gentoo Linux Security Advisory 202409-14
https://notcve.org/view.php?id=CVE-2023-43615
07 Oct 2023 — Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow. Mbed TLS 2.x anterior a 2.28.5 y 3.x anterior a 3.5.0 tiene un desbordamiento de búfer. Multiple vulnerabilities have been discovered in Mbed TLS, the worst of which could lead to information disclosure or denial of service. Versions greater than or equal to 2.28.7 are affected. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BDSHAANRULB57GVS5B3DZHXL5KCC7OWQ • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 10.0EPSS: 34%CPEs: 2EXPL: 2CVE-2023-45239 – Gentoo Linux Security Advisory 202402-13
https://notcve.org/view.php?id=CVE-2023-45239
06 Oct 2023 — A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent to tac_plus to inject shell commands and gain remote code execution on the tac_plus server. Existe una falta de validación de entrada en tac_plus antes del commit 4fdf178 que, cuando los comandos de autenticación previa o posterior están habilitados, permite a un atacante que puede controlar el nombre de usuari... • https://github.com/takeshixx/tac_plus-pre-auth-rce • CWE-790: Improper Filtering of Special Elements •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-43788 – Libxpm: out of bounds read in xpmcreatexpmimagefrombuffer()
https://notcve.org/view.php?id=CVE-2023-43788
06 Oct 2023 — A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system. Se encontró una vulnerabilidad en libXpm debido a una condición de los límite dentro de la función XpmCreateXpmImageFromBuffer(). Esta falla permite que un local active un error de lectura fuera de los límites y lea el contenido de la memoria del sistema. Multiple vulnerabilit... • https://access.redhat.com/errata/RHSA-2024:2146 • CWE-125: Out-of-bounds Read •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2023-39323 – Arbitrary code execution during build via line directives in cmd/go
https://notcve.org/view.php?id=CVE-2023-39323
05 Oct 2023 — Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex. Las directivas de línea ("//line") se pueden utilizar para evitar las restricciones de las directivas "//go:cg... • https://go.dev/cl/533215 •