CVSS: 6.2EPSS: 0%CPEs: 16EXPL: 0CVE-2024-4418 – Libvirt: stack use-after-free in virnetclientioeventloop()
https://notcve.org/view.php?id=CVE-2024-4418
08 May 2024 — A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this i... • https://access.redhat.com/errata/RHSA-2024:4351 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2024-34088
https://notcve.org/view.php?id=CVE-2024-34088
30 Apr 2024 — In FRRouting (FRR) through 9.1, it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer. In cases where calling functions do not handle the returned NULL value, the OSPF daemon crashes, leading to denial of service. En FRRouting (FRR) hasta 9.1, es posible que la función get_edge() en ospf_te.c en el demonio OSPF devuelva un puntero NULL. En los casos en que las funciones de llamada no manejan el valor NULL devuelto, el daemon OSPF falla, lo que lleva a la denegac... • https://github.com/FRRouting/frr/pull/15674/commits/34d704fb0ea60dc5063af477a2c11d4884984d4f • CWE-476: NULL Pointer Dereference •
CVSS: 7.6EPSS: 0%CPEs: 19EXPL: 0CVE-2023-50186 – GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-50186
19 Apr 2024 — GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of metadata within AV1 encoded video files. The issue results from the lack of proper validation of the length of user-supplied data ... • https://gstreamer.freedesktop.org/security/sa-2023-0011.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-121: Stack-based Buffer Overflow •
CVSS: 8.2EPSS: 0%CPEs: 23EXPL: 1CVE-2024-3446 – Qemu: virtio: dma reentrancy issue leads to double free vulnerability
https://notcve.org/view.php?id=CVE-2024-3446
09 Apr 2024 — A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a denial of service or allow arbitrary code execution within the context of the QEMU process on the host. Se encontró una doble vulnerabilidad gratuita en los dispositivos QEMU virtio (virtio-gpu, virtio... • https://github.com/Toxich4/CVE-2024-34469 • CWE-415: Double Free •
CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 0CVE-2024-31948
https://notcve.org/view.php?id=CVE-2024-31948
07 Apr 2024 — In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash. En FRRouting (FRR) hasta 9.1, un atacante que utiliza un atributo SID de prefijo con formato incorrecto en un paquete de BGP UPDATE puede provocar que el daemon bgpd falle. • https://github.com/FRRouting/frr/pull/15628 • CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0CVE-2024-31950
https://notcve.org/view.php?id=CVE-2024-31950
07 Apr 2024 — In FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ri for OSPF LSA packets during an attempt to read Segment Routing subTLVs (their size is not validated). En FRRouting (FRR) hasta 9.1, puede haber un desbordamiento del búfer y un bloqueo del daemon en ospf_te_parse_ri para paquetes OSPF LSA durante un intento de leer subTLV de enrutamiento de segmentos (su tamaño no está validado). • https://github.com/FRRouting/frr/pull/15674 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.6EPSS: 0%CPEs: 8EXPL: 0CVE-2024-31951
https://notcve.org/view.php?id=CVE-2024-31951
07 Apr 2024 — In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated). En el analizador Opaque LSA Extended Link de FRRouting (FRR) hasta 9.1, puede haber un desbordamiento del búfer y una falla del daemon en ospf_te_parse_ext_link para paquetes OSPF LSA durante un intento de leer subTLV SID de adyacencia de enrutamiento d... • https://github.com/FRRouting/frr/pull/15674 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.2EPSS: 0%CPEs: 19EXPL: 2CVE-2024-28085 – util-linux wall Escape Sequence Injection
https://notcve.org/view.php?id=CVE-2024-28085
27 Mar 2024 — wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover. wall en util-linux hasta 2.40, a menudo instalado con permisos setgid tty, permite enviar secuencias de escape a terminales de otros usuarios a través de argv. (Espe... • https://github.com/skyler-ferrante/CVE-2024-28085 • CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences •
CVSS: 6.2EPSS: 0%CPEs: 24EXPL: 0CVE-2024-2494 – Libvirt: negative g_new0 length can lead to unbounded memory allocation
https://notcve.org/view.php?id=CVE-2024-2494
21 Mar 2024 — A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash. Se encontró una falla en las API de la librería RPC de libvi... • https://access.redhat.com/errata/RHSA-2024:2560 • CWE-789: Memory Allocation with Excessive Size Value •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2023-46841 – x86: shadow stack vs exceptions from emulation stubs
https://notcve.org/view.php?id=CVE-2023-46841
20 Mar 2024 — Recent x86 CPUs offer functionality named Control-flow Enforcement Technology (CET). A sub-feature of this are Shadow Stacks (CET-SS). CET-SS is a hardware feature designed to protect against Return Oriented Programming attacks. When enabled, traditional stacks holding both data and return addresses are accompanied by so called "shadow stacks", holding little more than return addresses. Shadow stacks aren't writable by normal instructions, and upon function returns their contents are used to check for possi... • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZON4TLXG7TG4A2XZG563JMVTGQW4SF3A •