CVSS: 6.8EPSS: 6%CPEs: 53EXPL: 0CVE-2013-6475
https://notcve.org/view.php?id=CVE-2013-6475
Multiple integer overflows in (1) OPVPOutputDev.cxx and (2) oprs/OPVPSplash.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allow remote attackers to execute arbitrary code via a crafted PDF file, which triggers a heap-based buffer overflow. Múltiples desbordamientos de enteros en (1) OPVPOutputDev.cxx y (2) oprs/OPVPSplash.cxx en el filtro pdftoopvp en CUPS y cups-filters anterior a 1.0.47 permiten a atacantes remotos ejecutar código arbitrario a través de un archive de PDF manipulado, lo que provoca un desbordamiento de buffer basado en memoria dinámica. • http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7176 http://www.debian.org/security/2014/dsa-2875 http://www.debian.org/security/2014/dsa-2876 http://www.securityfocus.com/bid/66166 http://www.ubuntu.com/usn/USN-2143-1 http://www.ubuntu.com/usn/USN-2144-1 https://bugzilla.redhat.com/show_bug.cgi?id=1027550 • CWE-189: Numeric Errors •
CVSS: 7.8EPSS: 91%CPEs: 35EXPL: 0CVE-2014-0101 – kernel: net: sctp: null pointer dereference when processing authenticated cookie_echo chunk
https://notcve.org/view.php?id=CVE-2014-0101
The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk. La función sctp_sf_do_5_1D_ce en net/sctp/sm_statefuns.c en el kernel de Linux hasta la versión 3.13.6 no valida ciertos campos auth_enable y auth_capable antes de hacer una llamada sctp_sf_authenticate, lo que permite a atacantes remotos provocar una denegación de servicio (referencia a puntero NULL y caída del sistema) a través de un SCTP handshake con un fragmento INIT modificado y un fragmento AUTH manipulado anterior a un fragmento COOKIE_ECHO. A flaw was found in the way the Linux kernel processed an authenticated COOKIE_ECHO chunk during the initialization of an SCTP connection. A remote attacker could use this flaw to crash the system by initiating a specially crafted SCTP handshake in order to trigger a NULL pointer dereference on the system. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ec0223ec48a90cb605244b45f7c62de856403729 http://rhn.redhat.com/errata/RHSA-2014-0328.html http://rhn.redhat.com/errata/RHSA-2014-0419.html http://rhn.redhat.com/errata/RHSA-2014-0432.html http://secunia.com/advisories/59216 http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15317.html http://www.openwall.com/lists/oss-security/2014/03/04/6 http://www.securityfocus.com/bid/65943 h • CWE-476: NULL Pointer Dereference •
CVSS: 4.9EPSS: 0%CPEs: 6EXPL: 0CVE-2014-1874 – Kernel: SELinux: local denial-of-service
https://notcve.org/view.php?id=CVE-2014-1874
The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context. La función security_context_to_sid_core en security/selinux/ss/services.c en el kernel de Linux anterior a 3.13.4 permite a usuarios locales causar una denegación de servicio (caída del sistema) mediante el aprovechamiento de la funcionalidad CAP_MAC_ADMIN para configurar un contexto de seguridad de longitud cero. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2172fa709ab32ca60e86179dc67d0857be8e2c98 http://linux.oracle.com/errata/ELSA-2014-0771.html http://linux.oracle.com/errata/ELSA-2014-3043.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html http://secunia.com/advisories/59262 http://secunia.com/advisories/59309 http://secunia.com/advisories/59406 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.4 http://www.o • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 0%CPEs: 24EXPL: 0CVE-2013-7327
https://notcve.org/view.php?id=CVE-2013-7327
The gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check return values, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via invalid imagecrop arguments that lead to use of a NULL pointer as a return value, a different vulnerability than CVE-2013-7226. La función gdImageCrop en ext/gd/gd.c en PHP 5.5.x anterior a 5.5.9 no comprueba los valores de retorno, lo que permite a atacantes remotos causar una denegación de servicio (caída de aplicación) o posiblemente tener otro impacto no especificado a través de argumentos imagecrop no válidos que conducen al uso de un puntero nulo como valor de retorno, una vulnerabilidad diferente a CVE-2013-7226. • http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=8f4a5373bb71590352fd934028d6dde5bc18530b http://www.ubuntu.com/usn/USN-2126-1 https://bugs.php.net/bug.php?id=66356 https://bugzilla.redhat.com/show_bug.cgi?id=1065108 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 4%CPEs: 9EXPL: 0CVE-2014-1943 – file: unrestricted recursion in handling of indirect type rules
https://notcve.org/view.php?id=CVE-2014-1943
Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file. Fine Free File anterior a 5.17 permite a atacantes dependientes de contexto causar una denegación de servicio (recursión infinita, consumo de CPU y caída) a través de un valor manipulado de desplazamiento indirecto en el "magic" de un archivo. A denial of service flaw was found in the way the File Information (fileinfo) extension handled indirect rules. A remote attacker could use this flaw to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU. • http://lists.opensuse.org/opensuse-updates/2014-03/msg00034.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00037.html http://mx.gw.com/pipermail/file/2014/001327.html http://mx.gw.com/pipermail/file/2014/001330.html http://mx.gw.com/pipermail/file/2014/001334.html http://mx.gw.com/pipermail/file/2014/001337.html http://rhn.redhat.com/errata/RHSA-2014-1765.html http://support.apple.com/kb/HT6443 http://www.debian.org/security/2014/dsa-2861 http:& • CWE-755: Improper Handling of Exceptional Conditions CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •