CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 2CVE-2019-9169 – glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-read
https://notcve.org/view.php?id=CVE-2019-9169
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match. En la biblioteca GNU C (también conocida como glibc o libc6), hasta la versión 2.29, proceed_next_node en posix/regexec.c tiene una sobrelectura de búfer basada en memoria dinámica (heap) mediante un intento de coincidencia de expresiones regulares que no distinguen entre mayúsculas y minúsculas. • http://www.securityfocus.com/bid/107160 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142 https://kc.mcafee.com/corporate/index?page=content&id=SB10278 https://security.gentoo.org/glsa/202006-04 https://security.netapp.com/advisory/ntap-20190315-0002 https://sourceware.org/bugzilla/show_bug.cgi?id=24114 https://sourceware.org/git/gitweb.cgi? • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 2CVE-2019-9070
https://notcve.org/view.php?id=CVE-2019-9070
An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a heap-based buffer over-read in d_expression_1 in cp-demangle.c after many recursive calls. Se ha descubierto una vulnerabilidad en GNU libiberty, tal y como se distribuye en GNU Binutils 2.32. Es una sobrelectura de búfer basada en memoria dinámica (heap) en d_expression_1 en cp-demangle.c tras numerosas llamadas recursivas. • http://www.securityfocus.com/bid/107147 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=89395 https://security.gentoo.org/glsa/202107-24 https://security.netapp.com/advisory/ntap-20190314-0003 https://sourceware.org/bugzilla/show_bug.cgi?id=24229 https://support.f5.com/csp/article/K13534168 https://usn.ubuntu.com/4326-1 https://usn.ubuntu.com/4336-1 • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 1%CPEs: 9EXPL: 0CVE-2018-20784 – kernel: infinite loop in update_blocked_averages() in kernel/sched/fair.c leading to denial of service
https://notcve.org/view.php?id=CVE-2018-20784
In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other impact by inducing a high load. En el kernel de Linux, en versiones anteriores a la 4.20.2, kernel/sched/fair.c gestiona leaf cfs_rq de manera incorrecta, lo que permite que los atacantes provoquen una denegación de servicio (bucle infinito en update_blocked_averages) o, posiblemente, otro impacto sin especificar induciendo una carga alta. The CFS Linux kernel scheduler mishandles handling of leaf cfs_rq's in the kernel/sched/fair.c code, which allows a local unprivileged attacker to cause a denial of service (DoS) by entering an infinite loop in update_blocked_averages() function by inducing a high load on a system. Due to the nature of the flaw, a remote network attack (by initiating a magnitude of remote requests) cannot be fully ruled out. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c40f7d74c741a907cfaeb73a7697081881c497d0 https://access.redhat.com/errata/RHSA-2019:1959 https://access.redhat.com/errata/RHSA-2019:1971 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.2 https://github.com/torvalds/linux/commit/c40f7d74c741a907cfaeb73a7697081881c497d0 https://usn.ubuntu.com/4115-1 https://usn.ubuntu.com/4118-1 https://usn.ubuntu.com/4211-1 https://usn.ubuntu.com/4211-2 https: • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.8EPSS: 2%CPEs: 12EXPL: 0CVE-2019-8980 – kernel: memory leak in the kernel_read_file function in fs/exec.c allows to cause a denial of service
https://notcve.org/view.php?id=CVE-2019-8980
A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures. Una fuga de memoria en la función kernel_read_file en fs/exec.c en el kernel de Linux, hasta la versión 4.20.11, permite que los atacantes provoquen una denegación de servicio (consumo de memoria) desencadenando errores en vfs_read. A kernel memory leak was found in the kernel_read_file() function in the fs/exec.c file in the Linux kernel. An attacker could use this flaw to cause a memory leak and thus a denial of service (DoS). • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00052.html http://www.securityfocus.com/bid/107120 https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html https://support.f5.com/csp/article/K56480726 https://usn.ubuntu.com/3930-1 https://usn.ubuntu.com/3930-2 https://usn.ubuntu.com/3931-1 https://usn.ubuntu.com/3931-2 https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1935698.html https://www.mail-archive.com/linux-kernel%40vg • CWE-400: Uncontrolled Resource Consumption CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.0EPSS: 0%CPEs: 55EXPL: 1CVE-2019-6454 – systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash
https://notcve.org/view.php?id=CVE-2019-6454
An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic). Se ha descubierto un problema en sd-bus en systemd 239. bus_process_object() en libsystemd/sd-bus/bus-objects.c asigna un búfer de pila de longitud variable para almacenar temporalmente la ruta de objeto de los mensajes D-Bus entrantes. Un usuario local sin privilegios puede explotar esto enviando un mensaje especialmente manipulado a PID1, provocando que el puntero de la pila salte por las páginas guard de la pila hasta una región de memoria no mapeada y desencadene una denegación de servicio (cierre inesperado del PID1 en systemd y pánico del kernel). It was discovered that systemd allocates a buffer large enough to store the path field of a dbus message without performing enough checks. • http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00070.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html http://www.openwall.com/lists/oss-security/2019/02/18/3 http://www.openwall.com/lists/oss-security/2019/02/19/1 http://www.openwall.com/lists/oss-security/2021/07/20/2 http://www.securityfocus.com/bid/107081 https://access.redhat.com/errata/RHSA-2019:0368 https://access.redhat.com/errata/RHSA-2019:0990 https://access • CWE-20: Improper Input Validation CWE-787: Out-of-bounds Write •