CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2019-8460
https://notcve.org/view.php?id=CVE-2019-8460
OpenBSD kernel version <= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service. La versión del núcleo de OpenBSD anterior o igual a la versión 6.5 se puede forzar a crear largas cadenas de agujeros TCP SACK que provocan llamadas muy costosas a tcp_sack_option () para cada paquete SACK entrante que puede conducir a una denegación de servicio. • https://ftp.openbsd.org/pub/OpenBSD/patches/6.5/common/006_tcpsack.patch.sig https://github.com/openbsd/src/commit/ed8fdce754a5d8d14c09e989d8877707bd43906f https://research.checkpoint.com/tcp-sack-security-issue-in-openbsd-cve-2019-8460 https://security.netapp.com/advisory/ntap-20190905-0001 https://us-cert.cisa.gov/ics/advisories/icsa-19-253-03 • CWE-1049: Excessive Data Query Operations in a Large Data Table •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000372
https://notcve.org/view.php?id=CVE-2017-1000372
A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions. Existe un error en la implementación de OpenBSD de la página stack guard que permite que los atacantes la omitan, lo que resulta en la ejecución de código arbitrario mediante el uso de binarios setuid como /usr/bin/at. Esto afecta a OpenBSD 6.1 y posiblemente a versiones anteriores. • http://www.securityfocus.com/bid/99172 https://ftp.openbsd.org/pub/OpenBSD/patches/6.1/common/008_exec_subr.patch.sig https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt •
CVSS: 6.5EPSS: 1%CPEs: 1EXPL: 1CVE-2017-1000373 – OpenBSD - 'at Stack Clash' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-1000373
The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times. This allows attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks. This affects OpenBSD 6.1 and possibly earlier versions. La función qsort() de OpenBSD es recursiva y no aleatorizada, por lo que un atacante puede construir un array de entrada patológica de elementos N que provoca que qsort() se repita inevitablemente N/4 veces. Esto permite que los atacantes consuman cantidades de memoria de pila arbitrarias y manipulen la memoria de pila para ayudar en los ataques de ejecución de código arbitrario. • https://www.exploit-db.com/exploits/42271 http://www.securityfocus.com/bid/99177 http://www.securitytracker.com/id/1039427 https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libc/stdlib/qsort.c?rev=1.15&content-type=text/x-cvsweb-markup https://support.apple.com/HT208112 https://support.apple.com/HT208113 https://support.apple.com/HT208115 https://support.apple.com/HT208144 https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.0EPSS: 0%CPEs: 29EXPL: 0CVE-2011-2168
https://notcve.org/view.php?id=CVE-2011-2168
Multiple integer overflows in the glob implementation in libc in OpenBSD before 4.9 might allow context-dependent attackers to have an unspecified impact via a crafted string, related to the GLOB_APPEND and GLOB_DOOFFS flags, a different issue than CVE-2011-0418. Múltiples desbordamientos de entero en la implementación de glob en libc en OpenBSD anterior a v4.9 podría permitir a atacantes dependientes de contexto tener un impacto no especificado a través de una cadena manipulada, relacionado con el GLOB_APPEND y banderas GLOB_DOOFFS, una fallo diferente de CVE-2011-0418. • http://securityreason.com/achievement_securityalert/97 http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gen/glob.c#rev1.35 http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gen/glob.c.diff?r1=1.34%3Br2=1.35%3Bf=h http://www.securityfocus.com/bid/48004 • CWE-189: Numeric Errors •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2011-1013 – kernel: drm_modeset_ctl signedness issue
https://notcve.org/view.php?id=CVE-2011-1013
Integer signedness error in the drm_modeset_ctl function in (1) drivers/gpu/drm/drm_irq.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.38 and (2) sys/dev/pci/drm/drm_irq.c in the kernel in OpenBSD before 4.9 allows local users to trigger out-of-bounds write operations, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via a crafted num_crtcs (aka vb_num) structure member in an ioctl argument. Error de enteros sin signo en Función drm_modeset_ctl en(1) drivers /gpu/drm/drm_irq.c del subsistema Direct Rendering Manager del kernel de Linux con anterioridad a v2.6.38 y (2) sys/dev/pci/drm/drm_irq.c en el kernel de OpenBSD con anterioridad a v4.9 permite a los usuarios locales provocar una salida de los limites en las operaciones de escritura, y por lo tanto provocar una denegación de servicio ( caída del sistema ) o, posiblemente,tener un impacto no especificado, a través de un miembro de la estructura num_crtcs ( vb_num alias ) manipulado en un argumento ioctl. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1922756124ddd53846877416d92ba4a802bc658f http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.38 http://www.openbsd.org/cgi-bin/cvsweb/src/sys/dev/pci/drm/drm_irq.c http://www.openbsd.org/cgi-bin/cvsweb/src/sys/dev/pci/drm/drm_irq.c.diff?r1=1.41%3Br2=1.42%3Bf=h http://www.securityfocus.com/bid/47639 https://bugzilla.redhat.com/show_bug.cgi?id=679925 https://exchange. • CWE-787: Out-of-bounds Write •