CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-20001
https://notcve.org/view.php?id=CVE-2021-20001
It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure permissions for the user web shares (~/public_html), which could result in privilege escalation. Se ha detectado que debian-edu-config, un conjunto de archivos de configuración usados para la mezcla de Debian Edu, versiones anteriores a 2.12.16, configuraba permisos no seguros para los recursos compartidos de la web del usuario (~/public_html), lo que podría resultar en una escalada de privilegios • https://lists.debian.org/debian-lts-announce/2022/02/msg00012.html https://lists.debian.org/debian-security-announce/2022/msg00039.html https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/4d39a5888d193567704238f8c035f8d17cfe34e5 https://www.debian.org/security/2022/dsa-5072 • CWE-276: Incorrect Default Permissions •
CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 0CVE-2022-24958
https://notcve.org/view.php?id=CVE-2022-24958
drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release. el archivo drivers/usb/gadget/legacy/inode.c en el kernel de Linux versiones hasta 5.16.8 maneja inapropiadamente la liberación dev-) buf • https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=89f3594d0de58e8a57d92d497dea9fee3d4b9cda https://github.com/torvalds/linux/commit/501e38a5531efbd77d5c73c0ba838a889bfc1d74 https://github.com/torvalds/linux/commit/89f3594d0de58e8a57d92d497dea9fee3d4b9cda https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUVZA2YVOQJBJTDIDQ5HF5TAU2C6WP6H https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject& • CWE-763: Release of Invalid Pointer or Reference •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-24959
https://notcve.org/view.php?id=CVE-2022-24959
An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c. Se ha detectado un problema en el kernel de Linux versiones anteriores a 5.16.5. Se presenta una pérdida de memoria en la función yam_siocdevprivate en el archivo drivers/net/hamradio/yam.c • https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5 https://github.com/torvalds/linux/commit/29eb31542787e1019208a2e1047bb7c76c069536 https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html https://www.debian.org/security/2022/dsa-5092 https://www.debian.org/security/2022/dsa-5096 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2022-23772 – golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString
https://notcve.org/view.php?id=CVE-2022-23772
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. Rat.SetString en el archivo math/big en Go versiones anteriores a 1.16.14 y versiones 1.17.x anteriores a 1.17.7, presenta un desbordamiento que puede conllevar a un Consumo de Memoria no Controlado A flaw was found in the big package of the math library in golang. The Rat.SetString could cause an overflow, and if left unhandled, it could lead to excessive memory use. This issue could allow a remote attacker to impact the availability of the system. • https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ https://lists.debian.org/debian-lts-announce/2022/04/msg00017.html https://lists.debian.org/debian-lts-announce/2022/04/msg00018.html https://security.gentoo.org/glsa/202208-02 https://security.netapp.com/advisory/ntap-20220225-0006 https://www.oracle.com/security-alerts/cpujul2022.html https://access.redhat.com/security/cve/CVE-2022-23772 https://bugzilla.redhat.com/show_bug.cgi?id=2053532 • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 1CVE-2022-0561 – libtiff: Denial of Service via crafted TIFF file
https://notcve.org/view.php?id=CVE-2022-0561
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712. Un puntero fuente null pasado como argumento a la función memcpy() dentro de TIFFFetchStripThing() en el archivo tif_dirread.c en libtiff versiones 3.9.0 a 4.3.0, podía conllevar a una denegación de servicio por medio de un archivo TIFF diseñado. Para usuarios que compilan libtiff desde las fuentes, la corrección está disponible con el commit eecb0712 A flaw was found in libtiff where a NULL source pointer passed as an argument to the memcpy() function within the TIFFFetchStripThing() in tif_dirread.c. This flaw allows an attacker with a crafted TIFF file to exploit this flaw, causing a crash and leading to a denial of service. • https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0561.json https://gitlab.com/libtiff/libtiff/-/issues/362 https://lists.debian.org/debian-lts-announce/2022/03/msg00001.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZEHZ35XVO2VBZ4HHCMM6J6TQIDSBQOM https://security.gentoo.org/glsa/202210-10 https://security.netapp.com/advis • CWE-476: NULL Pointer Dereference •