CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2023-34256
https://notcve.org/view.php?id=CVE-2023-34256
An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access. Se ha descubierto un problema en el kernel de Linux en las versiones anteriores a 6.3.3. Hay una lectura fuera de límites en crc16 en "lib/crc16.c" cuando se llama dese "fs/ext4/super.c" porque "ext4_group_desc_csum" no comprueba correctamente un desplazamiento. • https://bugzilla.suse.com/show_bug.cgi?id=1211895 https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.3 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f04351888a83e595571de672e0a4a8b74f4fb31 https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html https://syzkaller.appspot.com/bug?extid=8785e41224a3afd04321 • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 1CVE-2023-2952 – wireshark: XRA dissector infinite loop
https://notcve.org/view.php?id=CVE-2023-2952
XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file El bucle infinito del disector XRA en Wireshark 4.0.0 a 4.0.5 y 3.6.0 a 3.6.13 permite la denegación de servicio mediante la inyección de paquetes o un archivo de captura manipulado A flaw was found in the XRA dissector of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing an infinite loop, resulting in a denial of service. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2952.json https://gitlab.com/wireshark/wireshark/-/issues/19100 https://lists.debian.org/debian-lts-announce/2023/06/msg00004.html https://security.gentoo.org/glsa/202309-02 https://www.debian.org/security/2023/dsa-5429 https://www.wireshark.org/security/wnpa-sec-2023-20.html https://access.redhat.com/security/cve/CVE-2023-2952 https://bugzilla.redhat.com/show_bug.cgi?id=2211406 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2023-2879
https://notcve.org/view.php?id=CVE-2023-2879
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file GDSDB bucle infinito en Wireshark 4.0.0 a 4.0.5 y 3.6.0 a 3.6.13 permite la denegación de servicio a través de inyección de paquetes o archivo de captura manipulado • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2879.json https://gitlab.com/wireshark/wireshark/-/issues/19068 https://lists.debian.org/debian-lts-announce/2023/06/msg00004.html https://security.gentoo.org/glsa/202309-02 https://www.debian.org/security/2023/dsa-5429 https://www.wireshark.org/security/wnpa-sec-2023-14.html • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 4.7EPSS: 0%CPEs: 14EXPL: 0CVE-2023-2898
https://notcve.org/view.php?id=CVE-2023-2898
There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem. • https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html https://lore.kernel.org/linux-f2fs-devel/20230522124203.3838360-1-chao%40kernel.org https://security.netapp.com/advisory/ntap-20230929-0002 https://www.debian.org/security/2023/dsa-5480 https://www.debian.org/security/2023/dsa-5492 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2023-2855 – wireshark: Candump log file parser crash
https://notcve.org/view.php?id=CVE-2023-2855
Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file La falla del analizador de registros de Candump en Wireshark 4.0.0 a 4.0.5 y 3.6.0 a 3.6.13 permite la denegación de servicio a través de un archivo de captura manipulado A flaw was found in the Candump log file parser of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing a buffer overflow, resulting in a denial of service. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2855.json https://gitlab.com/wireshark/wireshark/-/issues/19062 https://security.gentoo.org/glsa/202309-02 https://www.debian.org/security/2023/dsa-5429 https://www.wireshark.org/security/wnpa-sec-2023-12.html https://access.redhat.com/security/cve/CVE-2023-2855 https://bugzilla.redhat.com/show_bug.cgi?id=2210822 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •