CVSS: 2.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-27645 – glibc: Use-after-free in addgetnetgrentX function in netgroupcache.c
https://notcve.org/view.php?id=CVE-2021-27645
The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c. El demonio de almacenamiento en caché nameserver (nscd) en el GNU C Library (también se conoce como glibc o libc6) versiones 2.29 hasta 2.33, cuando se procesa una petición de búsqueda de netgroup, puede cometer un fallo debido a una doble liberación, potencialmente resultando en un servicio degradado o denegación de servicio en el sistema local. Esto está relacionado con el archivo netgroupcache.c The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6), when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. • https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LZNT6KTMCCWPWXEOGSHD3YLYZKUGMH5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7TS26LIZSOBLGJEZMJX4PXT5BQDE2WS https://security.gentoo.org/glsa/202107-07 https://sourceware.org/bugzilla/show_bug.cgi?id=27462 https://access.redhat.com/security/cve/CVE-2021-27645 https://bugzilla.redhat.com/show_bug.cgi?id=193258 • CWE-415: Double Free CWE-416: Use After Free •
CVSS: 7.5EPSS: 1%CPEs: 33EXPL: 0CVE-2021-3326 – glibc: Assertion failure in ISO-2022-JP-3 gconv module related to combining characters
https://notcve.org/view.php?id=CVE-2021-3326
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. La función iconv en la biblioteca GNU C (también se conoce como glibc o libc6) versiones 2.32 y anteriores, cuando procesa secuencias de entrada no válidas en la codificación ISO-2022-JP-3, se produce un fallo una aserción en la ruta del código y aborta el programa, potencialmente resultando en una denegación de servicio A flaw was found in glibc's iconv() functionality. This flaw allows an attacker capable of supplying a crafted sequence of characters to an application using iconv() to convert from ISO-2022-JP-3 to cause an assertion failure. The highest threat from this vulnerability is to system availability. • http://www.openwall.com/lists/oss-security/2021/01/28/2 https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html https://security.gentoo.org/glsa/202107-07 https://security.netapp.com/advisory/ntap-20210304-0007 https://sourceware.org/bugzilla/show_bug.cgi?id=27256 https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=7d88c6142c6efc160c0ee5e4f85cde382c072888 https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujan2022.html https:/ • CWE-617: Reachable Assertion •
CVSS: 7.1EPSS: 2%CPEs: 11EXPL: 0CVE-2019-25013 – glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding
https://notcve.org/view.php?id=CVE-2019-25013
The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. La funcionalidad iconv en la biblioteca GNU C (también se conoce como glibc o libc6) versiones hasta 2.32, cuando se procesan secuencias de entrada multibyte no válidas en la codificación EUC-KR, puede tener una lectura excesiva del búfer. A flaw was found in glibc. When processing input in the EUC-KR encoding, an invalid input sequence could cause glibc to read beyond the end of a buffer, resulting in a segmentation fault. The highest threat from this vulnerability is to system availability. • https://lists.apache.org/thread.html/r32d767ac804e9b8aad4355bb85960a6a1385eab7afff549a5e98660f%40%3Cjira.kafka.apache.org%3E https://lists.apache.org/thread.html/r448bb851cc8e6e3f93f3c28c70032b37062625d81214744474ac49e7%40%3Cdev.kafka.apache.org%3E https://lists.apache.org/thread.html/r4806a391091e082bdea17266452ca656ebc176e51bb3932733b3a0a2%40%3Cjira.kafka.apache.org%3E https://lists.apache.org/thread.html/r499e4f96d0b5109ef083f2feccd33c51650c1b7d7068aa3bd47efca9%40%3Cjira.kafka.apache.org%3E https://lists.apache.org/thread.html/r5af4430421bb6f9973294691a7904bbd260937e9eef96b20556f43ff%40%3Cj • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 4.8EPSS: 0%CPEs: 3EXPL: 1CVE-2020-29562
https://notcve.org/view.php?id=CVE-2020-29562
The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. La función iconv en la GNU C Library (también se conoce como glibc o libc6) versiones 2.30 hasta 2.32, al convertir texto UCS4 que contiene un carácter irreversible, se comete un fallo en una aserción en la ruta del código y aborta el programa, lo que potencialmente resulta en una denegación de servicio • https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TVCUNLQ3HXGS4VPUQKWTJGRAW2KTFGXS https://security.gentoo.org/glsa/202101-20 https://security.netapp.com/advisory/ntap-20210122-0004 https://sourceware.org/bugzilla/show_bug.cgi?id=26923 • CWE-617: Reachable Assertion •
CVSS: 7.0EPSS: 0%CPEs: 11EXPL: 0CVE-2020-1752 – glibc: use-after-free in glob() function when expanding ~user
https://notcve.org/view.php?id=CVE-2020-1752
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32. Una vulnerabilidad de uso de la memoria previamente liberada introducida en glibc versiones anteriores a la versión 2.14, se descubrió en la manera en que se llevó a cabo la expansión de tilde. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1752 https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html https://security.gentoo.org/glsa/202101-20 https://security.netapp.com/advisory/ntap-20200511-0005 https://sourceware.org/bugzilla/show_bug.cgi?id • CWE-416: Use After Free •