CVSS: 3.7EPSS: 0%CPEs: 5EXPL: 3CVE-2014-0476 – Chkrootkit - Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2014-0476
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option. La función slapper en chkrootkit anterior a 0.50 no cita debidamente las rutas de los ficheros de citas, lo que permite a usuarios locales ejecutar código arbitrario a través de un troyano ejecutable. NOTA: esto solamente es una vulnerabilidad cuando /tmp no está montado con la opción noexec. Chkrootkit before 0.50 will run any executable file named /tmp/update as root, allowing a trivial privsec. • https://www.exploit-db.com/exploits/38775 https://www.exploit-db.com/exploits/33899 http://osvdb.org/show/osvdb/107710 http://packetstormsecurity.com/files/134484/Chkrootkit-Local-Privilege-Escalation.html http://www.chkrootkit.org http://www.debian.org/security/2014/dsa-2945 http://www.openwall.com/lists/oss-security/2014/06/04/9 http://www.ubuntu.com/usn/USN-2230-1 https://security.gentoo.org/glsa/201709-05 https://seclists.org/oss-sec/2014/q2/430 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 43EXPL: 0CVE-2014-3730
https://notcve.org/view.php?id=CVE-2014-3730
The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com." La función django.util.http.is_safe_url en Django 1.4 anterior a 1.4.13, 1.5 anterior a 1.5.8, 1.6 anterior a 1.6.5 y 1.7 anterior a 1.7b4 no valida debidamente URLs, lo que permite a atacantes remotos realizar ataques de redirección abierta a través de una URL malformada, tal y como fue demostrado por 'http:\\\djangoproject.com.' • http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html http://secunia.com/advisories/61281 http://ubuntu.com/usn/usn-2212-1 http://www.debian.org/security/2014/dsa-2934 http://www.openwall.com/lists/oss-security/2014/05/14/10 http://www.openwall.com/lists/oss-security/2014/05/15/3 http://www.securityfocus.com/bid/67410 https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued • CWE-20: Improper Input Validation •
CVSS: 6.4EPSS: 0%CPEs: 39EXPL: 0CVE-2014-1418
https://notcve.org/view.php?id=CVE-2014-1418
Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers. Django 1.4 anterior a 1.4.13, 1.5 anterior a 1.5.8, 1.6 anterior a 1.6.5 y 1.7 anterior a 1.7b4 no incluye debidamente la cabecera (1) Vary: Cookie o (2) Cache-Control en respuestas, lo que permite a atacantes remotos obtener información sensible o envenenar la caché a través de una solicitud de ciertos navegadores. • http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html http://secunia.com/advisories/61281 http://ubuntu.com/usn/usn-2212-1 http://www.debian.org/security/2014/dsa-2934 http://www.openwall.com/lists/oss-security/2014/05/14/10 http://www.openwall.com/lists/oss-security/2014/05/15/3 https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued •
CVSS: 6.9EPSS: 0%CPEs: 26EXPL: 0CVE-2014-0209 – libXfont: integer overflow of allocations in font metadata file parsing
https://notcve.org/view.php?id=CVE-2014-0209
Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata. Múltiples desbordamientos de enteros en las funciones (1) FontFileAddEntry y (2) lexAlias en X.Org libXfont anterior a 1.4.8 y 1.4.9x anterior a 1.4.99.901 podrían permitir a usuarios locales ganar privilegios mediante la adición de un directorio con un archivo fonts.dir o fonts.alias largo a la ruta de la fuente, lo que provoca un desbordamiento de buffer basado en memoria dinámica, relacionado con metadatos. A use-after-free flaw was found in the way libXfont processed certain font files when attempting to add a new directory to the font path. A malicious, local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server. • http://advisories.mageia.org/MGASA-2014-0278.html http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html http://lists.x.org/archives/xorg-announce/2014-May/002431.html http://rhn.redhat.com/errata/RHSA-2014-1893.html http://seclists.org/fulldisclosure/2014/Dec/23 http://secunia.com/advisories/59154 http://www.debian.org/security/2014/dsa-2927 http://www.mandriva.com/security/advisories?name=MDVSA-2015:145 http://www.oracle.com/technetwork/topics/security/cpujul2014-1 • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 2%CPEs: 26EXPL: 0CVE-2014-0211 – libXfont: integer overflows calculating memory needs for xfs replies
https://notcve.org/view.php?id=CVE-2014-0211
Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow. Múltiples desbordamientos de enteros en las funciones (1) fs_get_reply, (2) fs_alloc_glyphs y (3) fs_read_extent_info en X.Org libXfont anterior a 1.4.8 y 1.4.9x anterior a 1.4.99.901 permiten a servidores remotos de fuentes ejecutar código arbitrario a través de una respuesta xfs manipulada, lo que provoca un desbordamiento de buffer. Multiple out-of-bounds write flaws were found in the way libXfont parsed replies received from an X.org font server. A malicious X.org server could cause an X client to crash or, possibly, execute arbitrary code with the privileges of the X.Org server. • http://advisories.mageia.org/MGASA-2014-0278.html http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html http://lists.x.org/archives/xorg-announce/2014-May/002431.html http://rhn.redhat.com/errata/RHSA-2014-1893.html http://seclists.org/fulldisclosure/2014/Dec/23 http://secunia.com/advisories/59154 http://www.debian.org/security/2014/dsa-2927 http://www.mandriva.com/security/advisories?name=MDVSA-2015:145 http://www.oracle.com/technetwork/topics/security/cpujul2014-1 • CWE-189: Numeric Errors CWE-787: Out-of-bounds Write •