CVSS: 4.9EPSS: 0%CPEs: 99EXPL: 0CVE-2014-0150 – qemu: virtio-net: buffer overflow in virtio_net_handle_mac() function
https://notcve.org/view.php?id=CVE-2014-0150
Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow. Desbordamiento de eneteros en la función virtio_net_handle_mac en hw/net/virtio-net.c en QEMU 2.0 y anteriores permite a usuarios locales invitados ejecutar código arbitrario a través de una solicitud de actualización de tabla de direcciones MAC, lo que provoca un desbordamiento de buffer basado en memoria dinámica. • http://article.gmane.org/gmane.comp.emulators.qemu/266768 http://secunia.com/advisories/57878 http://secunia.com/advisories/58191 http://thread.gmane.org/gmane.comp.emulators.qemu/266713 http://www.debian.org/security/2014/dsa-2909 http://www.debian.org/security/2014/dsa-2910 http://www.ubuntu.com/usn/USN-2182-1 https://bugzilla.redhat.com/show_bug.cgi?id=1078846 https://access.redhat.com/security/cve/CVE-2014-0150 • CWE-189: Numeric Errors •
CVSS: 7.5EPSS: 97%CPEs: 54EXPL: 16CVE-2014-0160 – OpenSSL Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2014-0160
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. Las implementaciones de (1) TLS y (2) DTLS en OpenSSL 1.0.1 en versiones anteriores a 1.0.1g no manejan adecuadamente paquetes Heartbeat Extension, lo que permite a atacantes remotos obtener información sensible desde la memoria de proceso a través de paquetes manipulados que desencadenan una sobrelectura del buffer, según lo demostrado mediante la lectura de claves privadas, relacionado con d1_both.c y t1_lib.c, también conocido como bug Heartbleed. An information disclosure flaw was found in the way OpenSSL handled TLS and DTLS Heartbeat Extension packets. A malicious TLS or DTLS client or server could send a specially crafted TLS or DTLS Heartbeat packet to disclose a limited portion of memory per request from a connected client or server. Note that the disclosed portions of memory could potentially include sensitive information such as private keys. • https://www.exploit-db.com/exploits/32764 https://www.exploit-db.com/exploits/32791 https://www.exploit-db.com/exploits/32998 https://www.exploit-db.com/exploits/32745 https://github.com/0x90/CVE-2014-0160 https://github.com/jdauphant/patch-openssl-CVE-2014-0160 https://github.com/caiqiqi/OpenSSL-HeartBleed-CVE-2014-0160-PoC https://github.com/obayesshelton/CVE-2014-0160-Scanner https://github.com/MrE-Fog/CVE-2014-0160-Chrome-Plugin https://github.com/Xyl2k/CVE-2014&# • CWE-125: Out-of-bounds Read CWE-201: Insertion of Sensitive Information Into Sent Data •
CVSS: 4.0EPSS: 0%CPEs: 10EXPL: 0CVE-2013-4566 – mod_nss: incorrect handling of NSSVerifyClient in directory context
https://notcve.org/view.php?id=CVE-2013-4566
mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions. mod_nss 1.0.8 y anteriores versiones, cuando se establece NSSVerifyClient en none para el contexto del server/vhost, no aplica la opción de NSSVerifyClient en el contexto de directorio, lo que permite a atacantes remotos evadir restricciones de acceso intencionadas. • http://lists.opensuse.org/opensuse-updates/2013-12/msg00118.html http://rhn.redhat.com/errata/RHSA-2013-1779.html https://bugzilla.redhat.com/show_bug.cgi?id=1016832 https://access.redhat.com/security/cve/CVE-2013-4566 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 94%CPEs: 109EXPL: 0CVE-2013-4854 – ISC BIND rdata Denial Of Service Vulnerability
https://notcve.org/view.php?id=CVE-2013-4854
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013. La implementación RFC en rdata.c en ISC BIND 9.7.x y 9.8.x anterior a 9.8.5-P2, 9.8.6b1, 9.9.x anterior a 9.9.3-P2, y 9.9.4b1, y DNSco BIND 9.9.3-S1 anterior a 9.9.3-S1-P1 y 9.9.4-S1b1, permite a atacantes remotos provocar una denegación de servicio (fallo de aserción y salida de demonio) a través de una petición con una sección RDATA manipulada que se maneja adecuadamente durante la contrucción de mensaje de log. Ha sido explotada "in the wild" en Julio de 2013. This vulnerability allows remote attackers to cause a denial of service condition on vulnerable installations of ISC BIND. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of an rdata section with a length that is less than four. • http://archives.neohapsis.com/archives/bugtraq/2013-08/0030.html http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html http://linux.oracle.com/errata/ELSA-2014-1244 http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113108.html http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113251.html http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00018.html http://rhn. •
CVSS: 1.9EPSS: 0%CPEs: 22EXPL: 0CVE-2013-0200 – hplip: insecure temporary file handling flaws
https://notcve.org/view.php?id=CVE-2013-0200
HP Linux Imaging and Printing (HPLIP) through 3.12.4 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/hpcupsfilterc_#.bmp, (2) /tmp/hpcupsfilterk_#.bmp, (3) /tmp/hpcups_job#.out, (4) /tmp/hpijs_#####.out, or (5) /tmp/hpps_job#.out temporary file, a different vulnerability than CVE-2011-2722. Linux HP Imagen e Impresión (HPLIP) hasta v3.12.4 permite a usuarios locales sobreescribir ficheros arbitrarios mediante un ataque de enlaces simbólicos en el (1)/tmp/hpcupsfilterc_#.Bmp, (2)/tmp/hpcupsfilterk_#bmp., (3)/tmp/hpcups_job#.out, (4)/tmp/hpijs_#####.out, o (5) /tmp/hpps_job#.out ficheros temporales, una vulnerabilidad diferente a CVE-2011-2722. • ftp://ftp.scientificlinux.org/linux/scientific/6x/SRPMS/vendor/hplip-3.12.4-4.el6.src.rpm http://hplipopensource.com/hplip-web/release_notes.html http://secunia.com/advisories/55083 http://www.debian.org/security/2013/dsa-2829 http://www.mandriva.com/security/advisories?name=MDVSA-2013:088 http://www.ubuntu.com/usn/USN-1981-1 https://bugzilla.redhat.com/show_bug.cgi?id=902163 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0072 https://access.redhat.com/secu • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-377: Insecure Temporary File •