CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-1000085
https://notcve.org/view.php?id=CVE-2018-1000085
ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of memory, may help in developing exploit chains.. This attack appear to be exploitable via The victim must scan a crafted XAR file. This vulnerability appears to have been fixed in after commit d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6. ClamAV, versión 0.99.3, contiene una vulnerabilidad de lectura de memoria dinámica (heap) fuera de límites en el analizador XAR, en la función xar_hash_check() que puede resultar en un filtrado de memoria y ayudar a desarrollar cadenas de exploits. El ataque parece ser explotable si una víctima escanea un archivo XAR malicioso. • http://www.openwall.com/lists/oss-security/2017/09/29/4 https://github.com/Cisco-Talos/clamav-devel/commit/d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6 https://lists.debian.org/debian-lts-announce/2018/03/msg00011.html https://security.gentoo.org/glsa/201804-16 https://usn.ubuntu.com/3592-1 https://usn.ubuntu.com/3592-2 • CWE-125: Out-of-bounds Read •
CVSS: 5.9EPSS: 0%CPEs: 6EXPL: 1CVE-2018-7755 – kernel: Information exposure in fd_locked_ioctl function in drivers/block/floppy.c
https://notcve.org/view.php?id=CVE-2018-7755
An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR. Se descubrió un fallo de seguridad en la función fd_locked_ioct en drivers/block/floppy.c en el kernel de Linux hasta la versión 4.15.7. La unidad de disquete copiará un puntero kernel a la memoria del usuario en respuesta a la llamada IOCTL FDGETPRM. • https://access.redhat.com/errata/RHSA-2019:2029 https://access.redhat.com/errata/RHSA-2019:2043 https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html https://lkml.org/lkml/2018/3/7/1116 https://usn.ubuntu.com/3695-1 https://usn.ubuntu.com/3695-2 https://usn.ubuntu.com/3696-1 https://usn.ubuntu.com/3696-2 https://usn.ubuntu.com/3697-1 https://usn.ubuntu.com/3697-2 https://usn.ubuntu.com/3698-1 https://usn.ubuntu.com/369 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-1066 – kernel: Null pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() when empty TargetInfo is returned in NTLMSSP setup negotiation response allowing to crash client's kernel
https://notcve.org/view.php?id=CVE-2018-1066
The Linux kernel before version 4.11 is vulnerable to a NULL pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allows an attacker controlling a CIFS server to kernel panic a client that has this server mounted, because an empty TargetInfo field in an NTLMSSP setup negotiation response is mishandled during session recovery. El kernel de Linux, en versiones anteriores a la 4.11, es vulnerable a una desreferencia de puntero NULL en fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() que permite que un atacante que controla un servidor CIFS provoque un pánico en un cliente con el servidor montado, debido a que un campo TargetInfo en una respuesta de negociación de instalación NTLMSSP se gestiona de manera incorrecta durante la recuperación de sesión. A flaw was found in the Linux kernel's client-side implementation of the cifs protocol. This flaw allows an attacker controlling the server to kernel panic a client which has the CIFS server mounted. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cabfb3680f78981d26c078a26e5c748531257ebb http://www.securityfocus.com/bid/103378 https://bugzilla.redhat.com/show_bug.cgi?id=1539599 https://github.com/torvalds/linux/commit/cabfb3680f78981d26c078a26e5c748531257ebb https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html https://patchwork.kernel.org/patch/10187633 https://usn.ubuntu.com/3880-1 https:&#x • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 3%CPEs: 63EXPL: 0CVE-2018-7185
https://notcve.org/view.php?id=CVE-2018-7185
The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association. El motor de protocolo en ntp, en versiones 4.2.6 anteriores a la 4.2.8p11, permite que atacantes remotos provoquen una denegación de servicio (interrupción) mediante el envío continuado de un paquete con una marca de tiempo zero-origin y la dirección IP de origen "del otro lado" de una asociación intercalada que provoca que el ntpd de la víctima restablezca su asociación. • http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html http://support.ntp.org/bin/view/Main/NtpBug3454 http://www.securityfocus.com/archive/1/541824/100/0/threaded http://www.securityfocus.com/bid/103339 https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc https://security.gentoo.org/glsa/201805-12 https://security.netapp.com/advisory/ntap-20180626-0001 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en&# •
CVSS: 9.8EPSS: 75%CPEs: 11EXPL: 1CVE-2018-7584 – PHP 7.2.2 - 'php_stream_url_wrap_http_ex' Buffer Overflow
https://notcve.org/view.php?id=CVE-2018-7584
In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string. En PHP hasta la versión 5.6.33, versiones 7.0.x anteriores a la 7.0.28, versiones 7.1.x hasta la 7.1.14 y versiones 7.2.x hasta la 7.2.2, hay una sublectura de búfer basada en pila al analizar una respuesta HTTP en la función php_stream_url_wrap_http_ex en ext/standard/http_fopen_wrapper.c. Esto resulta en la copia de una cadena larga. PHP version 7.2.2 contains a memory corruption bug while parsing malformed HTTP response packets. • https://www.exploit-db.com/exploits/44846 http://php.net/ChangeLog-7.php http://www.securityfocus.com/bid/103204 http://www.securitytracker.com/id/1041607 https://access.redhat.com/errata/RHSA-2019:2519 https://bugs.php.net/bug.php?id=75981 https://github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bba https://lists.debian.org/debian-lts-announce/2018/03/msg00030.html https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html https://usn.ubuntu.com/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •