CVSS: 8.4EPSS: 0%CPEs: 4EXPL: 0CVE-2016-7543 – bash: Specially crafted SHELLOPTS+PS4 variables allows command substitution
https://notcve.org/view.php?id=CVE-2016-7543
Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables. Bash en versiones anteriores a 4.4 permite a usuarios locales ejecutar comandos arbitrarios con privilegios root a través de variables de entorno SHELLOPTS y PS4 manipuladas. An arbitrary command injection flaw was found in the way bash processed the SHELLOPTS and PS4 environment variables. A local, authenticated attacker could use this flaw to exploit poorly written setuid programs to elevate their privileges under certain circumstances. • http://rhn.redhat.com/errata/RHSA-2017-0725.html http://www.openwall.com/lists/oss-security/2016/09/26/9 http://www.securityfocus.com/bid/93183 http://www.securitytracker.com/id/1037812 https://access.redhat.com/errata/RHSA-2017:1931 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05388115 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7XOQSHU63Y357NHU5FPTFBM6I3YOCQB https://lists.fedoraproject.org/archives/list&#x • CWE-20: Improper Input Validation CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2016-2312
https://notcve.org/view.php?id=CVE-2016-2312
Turning all screens off in Plasma-workspace and kscreenlocker while the lock screen is shown can result in the screen being unlocked when turning a screen on again. Desactivar todas las pantallas en Plasma-workspace y kscreenlocker mientras se muestra la pantalla de bloqueo puede resultar en el desbloqueo de la pantalla cuando se vuelva a encender una pantalla. • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177454.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177557.html https://bugs.kde.org/show_bug.cgi?id=358125 https://bugzilla.opensuse.org/show_bug.cgi?id=964548 https://www.kde.org/info/security/advisory-20160209-1.txt • CWE-254: 7PK - Security Features •
CVSS: 9.3EPSS: 1%CPEs: 4EXPL: 3CVE-2016-2334
https://notcve.org/view.php?id=CVE-2016-2334
Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image. Desbordamiento de búfer basado en memoria dinámica en el método NArchive::NHfs::CHandler::ExtractZlibFile en 7zip en versiones anteriores a 16.00 y p7zip permite a atacantes remotos ejecutar código arbitrario a través de una imagen HFS+ manipulada. • https://github.com/icewall/CVE-2016-2334 http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html http://blog.talosintelligence.com/2017/11/exploiting-cve-2016-2334.html http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html http://www.securityfocus.com/bid/90531 http://www.securitytracker.com/id/1035876 http://www.talosintel.com/reports/TALOS-2016-0093 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNYIQAU3FKFBNFPK6GKYTS • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 3.3EPSS: 0%CPEs: 3EXPL: 0CVE-2016-1544
https://notcve.org/view.php?id=CVE-2016-1544
nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion). nghttp2 versiones anteriores a 1.7.1, permite a atacantes remotos causar una denegación de servicio (agotamiento de la memoria). • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177308.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177666.html https://bugzilla.redhat.com/show_bug.cgi?id=1308461 https://github.com/nghttp2/nghttp2/compare/v1.7.0...v1.7.1 https://github.com/nghttp2/nghttp2/releases/tag/v1.7.1 https://security.gentoo.org/glsa/201612-13 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2016-9243
https://notcve.org/view.php?id=CVE-2016-9243
HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size. HKDF en criptografía en versiones anteriores a 1.5.2 devuelve una cadena de bytes vacía si se utiliza con una longitud inferior que algorithm.digest_size. • http://www.openwall.com/lists/oss-security/2016/11/09/2 http://www.securityfocus.com/bid/94216 http://www.ubuntu.com/usn/USN-3138-1 https://cryptography.io/en/latest/changelog https://github.com/pyca/cryptography/commit/b924696b2e8731f39696584d12cceeb3aeb2d874 https://github.com/pyca/cryptography/issues/3211 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R2ZOBMPWDFFHUZ6QOZZY36A6H5CGJXL https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraprojec • CWE-20: Improper Input Validation •