CVSS: 7.8EPSS: 0%CPEs: 21EXPL: 0CVE-2024-26461 – krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c
https://notcve.org/view.php?id=CVE-2024-26461
26 Feb 2024 — Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. Kerberos 5 (también conocido como krb5) 1.21.2 contiene una vulnerabilidad de pérdida de memoria en /krb5/src/lib/gssapi/krb5/k5sealv3.c. A memory leak flaw was found in krb5 in /krb5/src/lib/gssapi/krb5/k5sealv3.c. This issue can lead to a denial of service through memory exhaustion. • https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md • CWE-401: Missing Release of Memory after Effective Lifetime CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2024-26462 – krb5: Memory leak at /krb5/src/kdc/ndr.c
https://notcve.org/view.php?id=CVE-2024-26462
26 Feb 2024 — Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c. Kerberos 5 (también conocido como krb5) 1.21.2 contiene una vulnerabilidad de pérdida de memoria en /krb5/src/kdc/ndr.c. A memory leak flaw was found in krb5 in /krb5/src/kdc/ndr.c. This issue can lead to a denial of service through memory exhaustion. • https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_3.md • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.8EPSS: 0%CPEs: 17EXPL: 0CVE-2023-3966 – Openvswsitch: ovs-vswitch fails to recover after malformed geneve metadata packet
https://notcve.org/view.php?id=CVE-2023-3966
22 Feb 2024 — A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled. Se encontró una falla en Open vSwitch donde varias versiones son vulnerables a paquetes Geneve manipulados, lo que puede resultar en una denegación de servicio y accesos a memoria no válidos. Para desencadenar este problema es necesario que la descarga de... • https://access.redhat.com/security/cve/CVE-2023-3966 • CWE-248: Uncaught Exception •
CVSS: 7.5EPSS: 0%CPEs: 33EXPL: 0CVE-2023-42843 – webkit: visiting a malicious website may lead to address bar spoofing
https://notcve.org/view.php?id=CVE-2023-42843
21 Feb 2024 — An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, Safari 17.1, macOS Sonoma 14.1. Visiting a malicious website may lead to address bar spoofing. Se solucionó un problema de interfaz de usuario inconsistente con una gestión de estado mejorada. Este problema se solucionó en iOS 16.7.2 y iPadOS 16.7.2, iOS 17.1 y iPadOS 17.1, Safari 17.1, macOS Sonoma 14.1. • http://www.openwall.com/lists/oss-security/2024/03/26/1 • CWE-290: Authentication Bypass by Spoofing •
CVSS: 7.8EPSS: 0%CPEs: 16EXPL: 0CVE-2024-24476
https://notcve.org/view.php?id=CVE-2024-24476
21 Feb 2024 — A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr_resolv.c, and ws_manuf_lookup_str(), size components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected. Vulnerabilidad de desbordamiento de búfer en el equipo Wireshark Wireshark anterior a v.4.2.0 permite que un atacante remoto provoque una denegación de servicio a través de los componentes de tamaño pan/addr_resolv.c y ws_manuf_lookup_str()... • https://gist.github.com/1047524396/369ba0ccffe255cf8142208b6142be2b • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.1EPSS: 0%CPEs: 36EXPL: 0CVE-2024-1553 – Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8
https://notcve.org/view.php?id=CVE-2024-1553
20 Feb 2024 — Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Errores de seguridad de la memoria presentes en Firefox 122, Firefox ESR 115.7 y Thunderbird 115.7. Algunos de estos errores mostraron evidencia de corrupción de memoria y suponemos... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1855686%2C1867982%2C1871498%2C1872296%2C1873521%2C1873577%2C1873597%2C1873866%2C1874080%2C1874740%2C1875795%2C1875906%2C1876425%2C1878211%2C1878286 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.4EPSS: 0%CPEs: 35EXPL: 0CVE-2024-1552 – Mozilla: Incorrect code generation on 32-bit ARM devices
https://notcve.org/view.php?id=CVE-2024-1552
20 Feb 2024 — Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. La generación incorrecta de código podría haber provocado conversiones numéricas inesperadas y un posible comportamiento indefinido.*Nota:* Este problema solo afecta a los dispositivos ARM de 32 bits. • https://bugzilla.mozilla.org/show_bug.cgi?id=1874502 • CWE-681: Incorrect Conversion between Numeric Types •
CVSS: 6.4EPSS: 0%CPEs: 36EXPL: 0CVE-2024-1551 – Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts
https://notcve.org/view.php?id=CVE-2024-1551
20 Feb 2024 — Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, they could inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Los encabezados de respuesta Set-Cookie se respetaban incorrectamente en las respuestas HTTP de varias partes. Si un atacante pudiera co... • https://bugzilla.mozilla.org/show_bug.cgi?id=1864385 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 6.4EPSS: 0%CPEs: 36EXPL: 0CVE-2024-1550 – Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants
https://notcve.org/view.php?id=CVE-2024-1550
20 Feb 2024 — A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Un sitio web malicioso podría haber utilizado una combinación de salir del modo de pantalla completa y `requestPointerLock` para provocar que el mouse del... • https://bugzilla.mozilla.org/show_bug.cgi?id=1860065 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 6.4EPSS: 0%CPEs: 36EXPL: 0CVE-2024-1549 – Mozilla: Custom cursor could obscure the permission dialog
https://notcve.org/view.php?id=CVE-2024-1549
20 Feb 2024 — If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in user confusion and unexpected granted permissions. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Si un sitio web configura un cursor personalizado grande, partes del cursor podrían haberse superpuesto con el cuadro de diálogo de permisos, lo que podría generar confusión en el usuario y permisos concedidos inesperados. Esta vulnera... • https://bugzilla.mozilla.org/show_bug.cgi?id=1833814 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •