CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 1CVE-2022-23218 – glibc: Stack-based buffer overflow in svcunix_create via long pathnames
https://notcve.org/view.php?id=CVE-2022-23218
14 Jan 2022 — The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution. La función de compatibilidad obsoleta svcunix_create en el módulo sunrpc de la Biblioteca C de GNU (también conocida como glibc) hasta la versión ... • https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 1CVE-2022-23219 – glibc: Stack-based buffer overflow in sunrpc clnt_create via a long pathname
https://notcve.org/view.php?id=CVE-2022-23219
14 Jan 2022 — The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution. La función de compatibilidad obsoleta clnt_create en el módulo sunrpc de la Biblioteca C de GNU (también se conoce como glibc) versiones hasta 2.... • https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 1CVE-2021-38604 – Gentoo Linux Security Advisory 202208-24
https://notcve.org/view.php?id=CVE-2021-38604
12 Aug 2021 — In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix. En librt en la Biblioteca C de GNU (también se conoce como glibc) versiones hasta 2.34, el archivo sysdeps/unix/sysv/linux/mq_notify.c, maneja inapropiadamente determinados datos NOTIFY_REMOVED, conllevando una desreferencia de puntero NULL. NOTA: esta vuln... • https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc • CWE-476: NULL Pointer Dereference •
CVSS: 9.1EPSS: 1%CPEs: 7EXPL: 0CVE-2021-35942 – glibc: Arbitrary read in wordexp()
https://notcve.org/view.php?id=CVE-2021-35942
22 Jul 2021 — The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations. La función wordexp de la biblioteca GNU C (también se conoce como glibc) versiones hasta 2.33, puede bloquearse o leer memoria arbitraria en la función... • https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 0%CPEs: 22EXPL: 1CVE-2021-33574 – glibc: mq_notify does not handle separately allocated thread attributes
https://notcve.org/view.php?id=CVE-2021-33574
25 May 2021 — The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact. La función mq_notify de la Biblioteca C de GNU (también conocida como glibc) versiones 2.32 y 2.33 tiene un use-after-free. Puede utilizar el objeto de atributos del hilo de notificac... • https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 24EXPL: 1CVE-2020-27618 – glibc: iconv when processing invalid multi-byte input sequences fails to advance the input state, which could result in an infinite loop
https://notcve.org/view.php?id=CVE-2020-27618
26 Feb 2021 — The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228. La función iconv en la biblioteca GNU C (también se conoce como glibc o libc6) versiones 2.32 y anteriores, cuando se procesa secuencias de entrada de ... • https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 2.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-27645 – glibc: Use-after-free in addgetnetgrentX function in netgroupcache.c
https://notcve.org/view.php?id=CVE-2021-27645
24 Feb 2021 — The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c. El demonio de almacenamiento en caché nameserver (nscd) en el GNU C Library (también se conoce como glibc o libc6) versiones 2.29 hasta 2.33, cuando se procesa una petición de búsqueda de netgroup, puede cometer un ... • https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html • CWE-415: Double Free CWE-416: Use After Free •
CVSS: 7.5EPSS: 2%CPEs: 33EXPL: 0CVE-2021-3326 – glibc: Assertion failure in ISO-2022-JP-3 gconv module related to combining characters
https://notcve.org/view.php?id=CVE-2021-3326
27 Jan 2021 — The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. La función iconv en la biblioteca GNU C (también se conoce como glibc o libc6) versiones 2.32 y anteriores, cuando procesa secuencias de entrada no válidas en la codificación ISO-2022-JP-3, se produce un fallo una aserción en la ruta del código y aborta el... • http://www.openwall.com/lists/oss-security/2021/01/28/2 • CWE-617: Reachable Assertion •
CVSS: 7.1EPSS: 0%CPEs: 11EXPL: 0CVE-2019-25013 – glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding
https://notcve.org/view.php?id=CVE-2019-25013
04 Jan 2021 — The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. La funcionalidad iconv en la biblioteca GNU C (también se conoce como glibc o libc6) versiones hasta 2.32, cuando se procesan secuencias de entrada multibyte no válidas en la codificación EUC-KR, puede tener una lectura excesiva del búfer. A flaw was found in glibc. When processing input in the EUC-KR encoding, an invalid input sequ... • https://lists.apache.org/thread.html/r32d767ac804e9b8aad4355bb85960a6a1385eab7afff549a5e98660f%40%3Cjira.kafka.apache.org%3E • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 4.8EPSS: 0%CPEs: 3EXPL: 1CVE-2020-29562 – Ubuntu Security Notice USN-5310-1
https://notcve.org/view.php?id=CVE-2020-29562
04 Dec 2020 — The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. La función iconv en la GNU C Library (también se conoce como glibc o libc6) versiones 2.30 hasta 2.32, al convertir texto UCS4 que contiene un carácter irreversible, se comete un fallo en una aserción en la ruta del código y aborta el programa, lo que potencialmente ... • https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E • CWE-617: Reachable Assertion •