CVE-2020-10188 – telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code
https://notcve.org/view.php?id=CVE-2020-10188
utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions. El archivo utility.c en telnetd en netkit telnet versiones hasta 0.17, permite a atacantes remotos ejecutar código arbitrario por medio de escrituras cortas o datos urgentes, debido a un desbordamiento del búfer que involucra a las funciones netclear y nextitem. A vulnerability was found where incorrect bounds checks in the telnet server’s (telnetd) handling of short writes and urgent data, could lead to information disclosure and corruption of heap data. An unauthenticated remote attacker could exploit these bugs by sending specially crafted telnet packets to achieve arbitrary code execution in the telnet server. • https://appgateresearch.blogspot.com/2020/02/bravestarr-fedora-31-netkit-telnetd_28.html https://github.com/krb5/krb5-appl/blob/d00cd671dfe945791b33d4f1f6a5c57ae1667ef8/telnet/telnetd/utility.c#L205-L216 https://lists.debian.org/debian-lts-announce/2020/05/msg00012.html https://lists.debian.org/debian-lts-announce/2020/08/msg00038.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7FMTRRQTYKWZD2GMXX3GLZV46OLPCLVK https://lists.fedoraproject.org/archives/list/package-announce%40l • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVE-2020-10174
https://notcve.org/view.php?id=CVE-2020-10174
init_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03 unsafely reuses a preexisting temporary directory in the predictable location /tmp/timeshift. It follows symlinks in this location or uses directories owned by unprivileged users. Because Timeshift also executes scripts under this location, an attacker can attempt to win a race condition to replace scripts created by Timeshift with attacker-controlled scripts. Upon success, an attacker-controlled script is executed with full root privileges. This logic is practically always triggered when Timeshift runs regardless of the command-line arguments used. init_tmp en TeeJee.FileSystem.vala en Timeshift versiones anteriores a 20.03, reutiliza de forma no segura un directorio temporal preexistente en la ubicación predecible /tmp/timeshift. • http://www.openwall.com/lists/oss-security/2020/03/06/3 https://bugzilla.suse.com/show_bug.cgi?id=1165802 https://github.com/teejee2008/timeshift/commit/335b3d5398079278b8f7094c77bfd148b315b462 https://github.com/teejee2008/timeshift/releases/tag/v20.03 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAOFXT64CEUMJE3723JDJWTEQWQUCYMD https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SXDEPC52G46U6I7GLQNFLZXVSM7V2HYY https://lists.fedoraproject.or • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVE-2020-10029 – glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions
https://notcve.org/view.php?id=CVE-2020-10029
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. La biblioteca GNU C (también se conoce como glibc o libc6) versiones anteriores a 2.32, podría desbordar un búfer sobre la pila durante una reducción de alcance si una entrada a una función long double de 80 bits contiene un patrón de bits no canónico, como es visto cuando se pasa un valor 0x5d4141414141410000 hacia la función sinl sobre sistemas destino de x86. Esto está relacionado con el archivo sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. A flaw was found in glibc in versions prior to 2.32. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00033.html https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/23N76M3EDP2GIW4GOIQRYTKRE7PPBRB2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTFUD5VH2GU3YOXA2KBQSBIDZRDWNZ3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU5JJGENOK7K4X5RYAA5PL647C6HD22E https://security.gentoo.org • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVE-2020-10018 – webkitgtk: Use-after-free issue in accessibility/AXObjectCache.cpp
https://notcve.org/view.php?id=CVE-2020-10018
WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue has been fixed in 2.28.0 with improved memory handling. WebKitGTK hasta la versión 2.26.4 y WPE WebKit hasta la versión 2.26.4 (que son las versiones anteriores a la versión 2.28.0) contiene un problema de corrupción de memoria (use-after-free) que puede conducir a la ejecución de código arbitrario. Este problema se ha solucionado en 2.28.0 con un manejo mejorado de la memoria. • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00008.html https://bugs.webkit.org/show_bug.cgi?id=204342#c21 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOR5LPL4UASVAR76EIHCL4O2KGDWGC6K https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLERWAS2LL7SX2GHA2DDZ2PL3QC5OHIF https://security.gentoo.org/glsa/202006-08 https://usn.ubuntu.com/4310-1 https://webkitgtk.org/security/WSA-2020-0003.html https://wpewebki • CWE-400: Uncontrolled Resource Consumption CWE-416: Use After Free •
CVE-2020-6802
https://notcve.org/view.php?id=CVE-2020-6802
In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option. En Mozilla Bleach versiones anteriores a 3.11, una mutación de XSS afecta a usuarios que llaman a bleach.clean con noscript y una etiqueta sin procesar en la opción de etiquetas allowed/whitelisted. • https://advisory.checkmarx.net/advisory/CX-2020-4276 https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/72R4VFFHDRSQMNT7IZU3X2755ZP4HGNI https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OCNLM2MGQTOLCIVVYS2Z5S7KOQJR5JC4 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTULPQB7HVPPYWEYVNHJGDTSPVIDHIZX https://www.checkmarx.com/blog/vulnerabilities& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •