CVSS: 9.1EPSS: 1%CPEs: 6EXPL: 0CVE-2019-3858 – libssh2: Zero-byte allocation with a specially crafted SFTP packed leading to an out-of-bounds read
https://notcve.org/view.php?id=CVE-2019-3858
An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory. Se ha descubierto un error de lectura fuera de límites en libssh2, en versiones anteriores a la 1.8.1, cuando un paquete SFTP especialmente manipulado se recibe desde el servidor. Un atacante remoto que comprometa un servidor SSH podría ser capaz de provocar una denegación de servicio o una lectura de datos en la memoria del cliente. An out of bounds read flaw was discovered in libssh2 when a specially crafted SFTP packet is received from the server. • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html http://www.openwall.com/lists/oss-security/2019/03/18/3 http://www.securityfocus.com/bid/107485 https://access.redhat.com/errata/RHSA-2019:2136 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3858 https://lists.debian.org/debian-lts-announce/2019 • CWE-125: Out-of-bounds Read •
CVSS: 5.9EPSS: 1%CPEs: 180EXPL: 0CVE-2019-1559 – 0-byte record padding oracle
https://notcve.org/view.php?id=CVE-2019-1559
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html http://www.securityfocus.com/bid/107174 https://access. • CWE-203: Observable Discrepancy CWE-325: Missing Cryptographic Step •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 2CVE-2018-20796
https://notcve.org/view.php?id=CVE-2018-20796
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep. En la biblioteca GNU C (también conocida como glibc o libc6), hasta la versión 2.29, check_dst_limits_calc_pos_1 en posix/regexec.c tiene una recursión no controlada, tal y como queda demostrado con "(\227|)(\\1\\1|t1|\\\2537)+" en grep. • http://www.securityfocus.com/bid/107160 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141 https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html https://security.netapp.com/advisory/ntap-20190315-0002 https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS • CWE-674: Uncontrolled Recursion •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 4CVE-2009-5155
https://notcve.org/view.php?id=CVE-2009-5155
In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match. En la biblioteca GNU C (también conocida como glibc o libc6), en versiones anteriores a la 2.28, parse_reg_exp en posix/regcomp.c analiza erróneamente las alternativas, lo que permite que los atacantes provoquen una denegación de servicio (fallo de aserción y salida de la aplicación) o desencadenen un resultado incorrecto intentando realizar una coincidencia de expresiones regulares. • http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238 https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E https://security.netapp.com& • CWE-19: Data Processing Errors •
CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 2CVE-2019-9169 – glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-read
https://notcve.org/view.php?id=CVE-2019-9169
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match. En la biblioteca GNU C (también conocida como glibc o libc6), hasta la versión 2.29, proceed_next_node en posix/regexec.c tiene una sobrelectura de búfer basada en memoria dinámica (heap) mediante un intento de coincidencia de expresiones regulares que no distinguen entre mayúsculas y minúsculas. • http://www.securityfocus.com/bid/107160 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142 https://kc.mcafee.com/corporate/index?page=content&id=SB10278 https://security.gentoo.org/glsa/202006-04 https://security.netapp.com/advisory/ntap-20190315-0002 https://sourceware.org/bugzilla/show_bug.cgi?id=24114 https://sourceware.org/git/gitweb.cgi? • CWE-125: Out-of-bounds Read •