CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0687
https://notcve.org/view.php?id=CVE-2023-0687
A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. • https://patchwork.sourceware.org/project/glibc/patch/20230204114138.5436-1-leo%40yuriev.ru https://sourceware.org/bugzilla/show_bug.cgi?id=29444 https://vuldb.com/?ctiid.220246 https://vuldb.com/?id.220246 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-25139
https://notcve.org/view.php?id=CVE-2023-25139
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes. • http://www.openwall.com/lists/oss-security/2023/02/10/1 https://security.netapp.com/advisory/ntap-20230302-0010 https://sourceware.org/bugzilla/show_bug.cgi?id=30068 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2022-48303 – tar: heap buffer overflow at from_header() in list.c via specially crafted checksum
https://notcve.org/view.php?id=CVE-2022-48303
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. A flaw was found in the Tar package. When attempting to read files with old V7 tar format with a specially crafted checksum, an invalid memory read may occur. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4 https://savannah.gnu.org/bugs/?62387 https://savannah.gnu.org/patch/?10307 https://access.redhat.com/security/cve/CVE-2022-48303 https://bugzilla.redhat.com/show_bug.cgi?id=2149722 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 2CVE-2022-4285 – binutils: NULL pointer dereference in _bfd_elf_get_symbol_version_string leads to segfault
https://notcve.org/view.php?id=CVE-2022-4285
An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599. Se encontró una falla de acceso ilegal a la memoria en el paquete binutils. El parseo de un archivo ELF que contiene información de versión de símbolo corrupta puede resultar en una denegación de servicio. • https://bugzilla.redhat.com/show_bug.cgi?id=2150768 https://security.gentoo.org/glsa/202309-15 https://sourceware.org/bugzilla/show_bug.cgi?id=29699 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=5c831a3c7f3ca98d6aba1200353311e1a1f84c70 https://access.redhat.com/security/cve/CVE-2022-4285 • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-3715 – bash: a heap-buffer-overflow in valid_parameter_transform
https://notcve.org/view.php?id=CVE-2022-3715
A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems. Se encontró una falla en el paquete bash, donde puede ocurrir un desbordamiento del búfer de almacenamiento dinámico en el parámetro_transform válido. Este problema puede provocar problemas de memoria. A flaw was found in the bash package, where a heap-buffer overflow can occur in valid_parameter_transform. • https://bugzilla.redhat.com/show_bug.cgi?id=2126720 https://access.redhat.com/security/cve/CVE-2022-3715 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •