CVSS: 7.0EPSS: 0%CPEs: 11EXPL: 0CVE-2020-1752 – glibc: use-after-free in glob() function when expanding ~user
https://notcve.org/view.php?id=CVE-2020-1752
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32. Una vulnerabilidad de uso de la memoria previamente liberada introducida en glibc versiones anteriores a la versión 2.14, se descubrió en la manera en que se llevó a cabo la expansión de tilde. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1752 https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html https://security.gentoo.org/glsa/202101-20 https://security.netapp.com/advisory/ntap-20200511-0005 https://sourceware.org/bugzilla/show_bug.cgi?id • CWE-416: Use After Free •
CVSS: 6.1EPSS: 1%CPEs: 10EXPL: 0CVE-2020-12137 – mailman: XSS via file attachments in list archives
https://notcve.org/view.php?id=CVE-2020-12137
GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code. GNU Mailman versiones 2.x anteriores a la versión 2.1.30, usa una extensión .obj para partes MIME de aplications/octet-stream. Este comportamiento puede contribuir a ataques de tipo XSS contra visitantes de archivos de lista, porque una respuesta HTTP desde un servidor web de archivo puede carecer de un tipo MIME, y un navegador web puede realizar rastreo del MIME, concluir que el tipo MIME debería haber sido text/html, y ejecutar código JavaScript. • http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00047.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00063.html http://www.openwall.com/lists/oss-security/2020/04/24/3 https://lists.debian.org/debian-lts-announce/2020/05/msg00002.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YCMGTTOXXCVM4O6CYZLTZDX6YLYORNF https://lists.fedoraproject.org • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.0EPSS: 0%CPEs: 5EXPL: 0CVE-2020-1751 – glibc: array overflow in backtrace functions for powerpc
https://notcve.org/view.php?id=CVE-2020-1751
An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability. Se encontró una vulnerabilidad de escritura fuera de límites en glibc versiones anteriores a 2.31, cuando se manejaban trampolines de señal en PowerPC. Concretamente, la función backtrace no comprueba apropiadamente los límites de la matriz cuando almacena la dirección de la trama, resultando en una denegación de servicio o a una posible ejecución de código. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1751 https://security.gentoo.org/glsa/202006-04 https://security.netapp.com/advisory/ntap-20200430-0002 https://sourceware.org/bugzilla/show_bug.cgi?id=25423 https://usn.ubuntu.com/4416-1 https://access.redhat.com/security/cve/CVE-2020-1751 https://bugzilla.redhat.com/show_bug.cgi?id=1810719 • CWE-787: Out-of-bounds Write •
CVSS: 7.4EPSS: 0%CPEs: 6EXPL: 0CVE-2020-11501 – gnutls: DTLS client hello contains a random value of all zeroes
https://notcve.org/view.php?id=CVE-2020-11501
GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol. GnuTLS versiones 3.6.x anteriores a 3.6.13, usa una criptografía incorrecta para DTLS. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00015.html https://gitlab.com/gnutls/gnutls/-/commit/5b595e8e52653f6c5726a4cdd8fddeb6e83804d2 https://gitlab.com/gnutls/gnutls/-/issues/960 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7 https://security.gentoo.org/glsa/202004-06 https://security.netapp.com/advis • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-330: Use of Insufficiently Random Values •
CVSS: 8.1EPSS: 7%CPEs: 4EXPL: 0CVE-2020-6096
https://notcve.org/view.php?id=CVE-2020-6096
An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data. • https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPYXTDOOB4PQGTYAMZAZNJIB3FF6YQXI https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URXOIA2LDUKHQXK4BE55BQBRI6ZZG3Y6 https://security.gentoo.org/glsa/202101-20 https://sourceware.org/bugzilla/show_bug.cgi?id=25620 https: • CWE-191: Integer Underflow (Wrap or Wraparound) CWE-195: Signed to Unsigned Conversion Error CWE-681: Incorrect Conversion between Numeric Types •