CVSS: 6.0EPSS: 0%CPEs: 13EXPL: 0CVE-2020-14310 – grub2: Integer overflow read_section_as_string may lead to heap-based buffer overflow
https://notcve.org/view.php?id=CVE-2020-14310
There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized allocation and further heap-based buffer overflow. Se presenta un problema en grub2 versiones anteriores a 2.06, en la función read_section_as_string(). Se espera que el nombre de la fuente sea una longitud máxima UINT32_MAX - 1 en bytes, pero no lo verifica antes de proceder con la asignación del búfer para leer el valor desde el valor de la fuente. • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14310 https://security.gentoo.org/glsa/202104-05 https://usn.ubuntu.com/4432-1 https://access.redhat.com/security/cve/CVE-2020-14310 https://bugzilla.redhat.com/show_bug.cgi?id=1852030 • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •
CVSS: 6.5EPSS: 0%CPEs: 12EXPL: 0CVE-2020-10756 – QEMU SLiRP Networking Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-10756
An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1. Se encontró una vulnerabilidad de lectura fuera de límites en la implementación de red SLiRP del emulador QEMU. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00035.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00040.html https://bugzilla.redhat.com/show_bug.cgi?id=1835986 https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYTZ32P67PZER6P7TW6FQK3SZRKQLVEI https://security.netapp.com/advisory/ntap-20201001-0001 https://usn.ubuntu.com/4437-1 https://usn.ubuntu.com/ • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-10769 – kernel: Buffer over-read in crypto_authenc_extractkeys() when a payload longer than 4 bytes is not aligned.
https://notcve.org/view.php?id=CVE-2020-10769
A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of service. Se encontró un defecto de lectura excesiva del búfer en el kernel de RH versiones anteriores a 5.0, en la función crypto_authenc_extractkeys en el archivo crypto/authenc.c en el módulo del algoritmo Criptográfico IPsec, authenc. Cuando una carga útil de más de 4 bytes y no sigue las pautas de límites de alineación de 4 bytes, esto causa una amenaza de lectura excesiva del búfer, conllevando a un bloqueo del sistema. • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html https://bugzilla.redhat.com/show_bug.cgi?id=1708775%3B https://lkml.org/lkml/2019/1/21/675 https://www.oracle.com/security-alerts/cpuApr2021.html https://access.redhat.com/security/cve/CVE-2020-10769 https://bugzilla.redhat.com/show_bug.cgi?id=1708775 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-14298 – docker: Security regression of CVE-2019-5736 due to inclusion of vulnerable runc
https://notcve.org/view.php?id=CVE-2020-14298
The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. This issue only affects docker version 1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected. La versión de Docker según lo publicado para Red Hat Enterprise Linux 7 Extras por medio del aviso RHBA-2020:0053 incluía una versión incorrecta de runc que no tenía la corrección para CVE-2019-5736, que se corrigió previamente por medio de RHSA-2019:0304. • https://access.redhat.com/errata/RHBA-2020:0427 https://access.redhat.com/security/cve/CVE-2020-14298 https://access.redhat.com/security/vulnerabilities/runcescape https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-5736 https://bugzilla.redhat.com/show_bug.cgi?id=1848239 https://access.redhat.com/security/vulnerabilities/runc-regression-docker-1.13.1-108 • CWE-271: Privilege Dropping / Lowering Errors CWE-273: Improper Check for Dropped Privileges •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-14300 – docker: Security regression of CVE-2016-9962 due to inclusion of vulnerable runc
https://notcve.org/view.php?id=CVE-2020-14300
The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version of runc that was missing multiple bug and security fixes. One of the fixes regressed in that update was the fix for CVE-2016-9962, that was previously corrected in the docker packages in Red Hat Enterprise Linux 7 Extras via RHSA-2017:0116 (https://access.redhat.com/errata/RHSA-2017:0116). The CVE-2020-14300 was assigned to this security regression and it is specific to the docker packages produced by Red Hat. The original issue - CVE-2016-9962 - could possibly allow a process inside container to compromise a process entering container namespace and execute arbitrary code outside of the container. This could lead to compromise of the container host or other containers running on the same container host. • https://access.redhat.com/errata/RHBA-2020:0427 https://access.redhat.com/security/cve/CVE-2016-9962 https://access.redhat.com/security/vulnerabilities/cve-2016-9962 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9962 https://access.redhat.com/security/cve/CVE-2020-14300 https://bugzilla.redhat.com/show_bug.cgi?id=1848829 https://access.redhat.com/security/vulnerabilities/runc-regression-docker-1.13.1-108 • CWE-271: Privilege Dropping / Lowering Errors CWE-273: Improper Check for Dropped Privileges •