CVSS: 7.8EPSS: 11%CPEs: 21EXPL: 0CVE-2023-2828 – named's configured cache size limit can be significantly exceeded
https://notcve.org/view.php?id=CVE-2023-2828
21 Jun 2023 — Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used ... • http://www.openwall.com/lists/oss-security/2023/06/21/6 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 24EXPL: 2CVE-2023-35788 – kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt()
https://notcve.org/view.php?id=CVE-2023-35788
16 Jun 2023 — An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation. Se descubrió un problema en fl_set_geneve_opt en net/sched/cls_flower.c en el kernel de Linux antes de 6.3.7. Permite una escritura fuera de los límites en el código flower classifier a través de paquetes TCA_FLOWER_KEY_ENC_OPTS_GENEVE. • http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 18EXPL: 0CVE-2023-3111 – Debian Security Advisory 5480-1
https://notcve.org/view.php?id=CVE-2023-3111
05 Jun 2023 — A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). It was discovered that the netlink implementation in the Linux kernel did not properly validate policies when parsing attributes in some situations. An attacker could use this to cause a denial of service. Billy Jheng Bing Jhong discovered that the CIFS network file system implementatio... • https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html • CWE-416: Use After Free •
CVSS: 7.8EPSS: 3%CPEs: 19EXPL: 0CVE-2023-2953 – openldap: null pointer dereference in ber_memalloc_x function
https://notcve.org/view.php?id=CVE-2023-2953
30 May 2023 — A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function. A vulnerability was found in OpenLDAP, in ber_memalloc_x() function, leading to a null pointer dereference. This flaw can result in reduced system memory and cause LDAP authentication failures. The impact is primarily a disruption in authentication processes, which may hinder user access or service operations relying on LDAP for authentication. • http://seclists.org/fulldisclosure/2023/Jul/47 • CWE-476: NULL Pointer Dereference •
CVSS: 4.7EPSS: 0%CPEs: 14EXPL: 0CVE-2023-2898 – Ubuntu Security Notice USN-6339-3
https://notcve.org/view.php?id=CVE-2023-2898
26 May 2023 — There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem. It was discovered that the NTFS file system implementation in the Linux kernel did not properly check buffer indexes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to expose sensitive information. Stonejiajia, Shir Tamari and Sagi Tzadik discovered that the Ove... • https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-476: NULL Pointer Dereference •
CVSS: 9.1EPSS: 1%CPEs: 14EXPL: 1CVE-2023-28319 – curl: use after free in SSH sha256 fingerprint check
https://notcve.org/view.php?id=CVE-2023-28319
26 May 2023 — A use after free vulnerability exists in curl
CVSS: 9.1EPSS: 8%CPEs: 14EXPL: 1CVE-2023-28320 – Apple Security Advisory 2023-07-24-6
https://notcve.org/view.php?id=CVE-2023-28320
26 May 2023 — A denial of service vulnerability exists in curl
CVSS: 9.1EPSS: 0%CPEs: 17EXPL: 1CVE-2023-28321 – curl: IDN wildcard match may lead to Improper Cerificate Validation
https://notcve.org/view.php?id=CVE-2023-28321
26 May 2023 — An improper certificate validation vulnerability exists in curl
CVSS: 3.7EPSS: 0%CPEs: 16EXPL: 1CVE-2023-28322 – curl: more POST-after-PUT confusion
https://notcve.org/view.php?id=CVE-2023-28322
26 May 2023 — An information disclosure vulnerability exists in curl
CVSS: 4.4EPSS: 0%CPEs: 9EXPL: 0CVE-2023-33250
https://notcve.org/view.php?id=CVE-2023-33250
21 May 2023 — The Linux kernel 6.3 has a use-after-free in iopt_unmap_iova_range in drivers/iommu/iommufd/io_pagetable.c. • https://bugzilla.suse.com/show_bug.cgi?id=1211597 • CWE-416: Use After Free •