CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2022-28739 – ruby: Buffer overrun in String-to-Float conversion
https://notcve.org/view.php?id=CVE-2022-28739
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f. Se presenta una lectura excesiva del búfer en Ruby versiones anteriores a 2.6.10, 2.7.x versiones anteriores a 2.7.6, 3.x versiones anteriores a 3.0.4 y 3.1.x versiones anteriores a 3.1.2. Es producida en la conversión String-to-Float, incluyendo Kernel#Float y String#to_f A buffer overrun vulnerability was found in Ruby. The issue occurs in a conversion algorithm from a String to a Float that causes process termination due to a segmentation fault, but under limited circumstances. • http://seclists.org/fulldisclosure/2022/Oct/28 http://seclists.org/fulldisclosure/2022/Oct/29 http://seclists.org/fulldisclosure/2022/Oct/30 http://seclists.org/fulldisclosure/2022/Oct/41 http://seclists.org/fulldisclosure/2022/Oct/42 https://hackerone.com/reports/1248108 https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html https://security-tracker.debian.org/tracker/CVE-2022-28739 https://security.gentoo.org/glsa/202401-27 https://security.netapp.com/advisory/n • CWE-125: Out-of-bounds Read •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 1CVE-2018-25033
https://notcve.org/view.php?id=CVE-2018-25033
ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a. ADMesh versiones hasta 0.98.4, presenta una lectura excesiva de búfer en la región heap de la memoria en stl_update_connects_remove_1 (llamado desde stl_remove_degenerate) en el archivo connect.c en libadmesh.a • https://github.com/admesh/admesh/issues/28 https://lists.debian.org/debian-lts-announce/2022/05/msg00029.html • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 1%CPEs: 9EXPL: 1CVE-2022-1619 – Heap-based Buffer Overflow in function cmdline_erase_chars in vim/vim
https://notcve.org/view.php?id=CVE-2022-1619
Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution Desbordamiento de búfer basado en Heap en la función cmdline_erase_chars en el repositorio de GitHub vim/vim anterior a 8.2.4899. Esta vulnerabilidad es capaz de colapsar el software, modificar la memoria, y la posible ejecución remota • http://seclists.org/fulldisclosure/2022/Oct/28 http://seclists.org/fulldisclosure/2022/Oct/41 https://github.com/vim/vim/commit/ef02f16609ff0a26ffc6e20263523424980898fe https://huntr.dev/bounties/b3200483-624e-4c76-a070-e246f62a7450 https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A6BY5P7ERZS7KXSBCGFCOXLMLGWUUJIH https://lists.fedoraproject& • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-28463
https://notcve.org/view.php?id=CVE-2022-28463
ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow. ImageMagick versión 7.1.0-27, es vulnerable a un desbordamiento del búfer • https://github.com/ImageMagick/ImageMagick/commit/ca3654ebf7a439dc736f56f083c9aa98e4464b7f https://github.com/ImageMagick/ImageMagick/issues/4988 https://github.com/ImageMagick/ImageMagick6/commit/e6ea5876e0228165ee3abc6e959aa174cee06680 https://lists.debian.org/debian-lts-announce/2022/05/msg00018.html https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 1CVE-2022-1616 – Use after free in append_command in vim/vim
https://notcve.org/view.php?id=CVE-2022-1616
Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution Un uso de memoria previamente liberada en append_command en el repositorio de GitHub vim/vim versiones anteriores a 8.2.4895. Esta vulnerabilidad es capaz de bloquear el software, omitir el mecanismo de protección, modificar la memoria y una posible ejecución remota • http://seclists.org/fulldisclosure/2022/Oct/28 http://seclists.org/fulldisclosure/2022/Oct/41 https://github.com/vim/vim/commit/d88934406c5375d88f8f1b65331c9f0cab68cc6c https://huntr.dev/bounties/40f1d75f-fb2f-4281-b585-a41017f217e2 https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A6BY5P7ERZS7KXSBCGFCOXLMLGWUUJIH https://lists.fedoraproject& • CWE-416: Use After Free •