CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2016-8605
https://notcve.org/view.php?id=CVE-2016-8605
The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected. • http://www.openwall.com/lists/oss-security/2016/10/12/1 http://www.securityfocus.com/bid/93510 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QTAGSDCTYXTABAA77BQJGNKOOBRV4DK https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNVE5N24FLWDYBQ3LAFMF6BFCWKDO7VM https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJP5S36GTXMDEBXWF6LKKV76DSLNQG44 • CWE-275: Permission Issues •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 0CVE-2016-8606
https://notcve.org/view.php?id=CVE-2016-8606
The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack. El servidor REPL (--listen) en GNU Guile 2.0.12 permite a un atacante ejecutar código arbitrario a través de un ataque interprotocolo HTTP. • http://www.openwall.com/lists/oss-security/2016/10/12/2 http://www.securityfocus.com/bid/93514 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QTAGSDCTYXTABAA77BQJGNKOOBRV4DK https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNVE5N24FLWDYBQ3LAFMF6BFCWKDO7VM https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJP5S36GTXMDEBXWF6LKKV76DSLNQG44 • CWE-284: Improper Access Control •
CVSS: 8.4EPSS: 0%CPEs: 4EXPL: 0CVE-2016-7543 – bash: Specially crafted SHELLOPTS+PS4 variables allows command substitution
https://notcve.org/view.php?id=CVE-2016-7543
Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables. Bash en versiones anteriores a 4.4 permite a usuarios locales ejecutar comandos arbitrarios con privilegios root a través de variables de entorno SHELLOPTS y PS4 manipuladas. An arbitrary command injection flaw was found in the way bash processed the SHELLOPTS and PS4 environment variables. A local, authenticated attacker could use this flaw to exploit poorly written setuid programs to elevate their privileges under certain circumstances. • http://rhn.redhat.com/errata/RHSA-2017-0725.html http://www.openwall.com/lists/oss-security/2016/09/26/9 http://www.securityfocus.com/bid/93183 http://www.securitytracker.com/id/1037812 https://access.redhat.com/errata/RHSA-2017:1931 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05388115 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7XOQSHU63Y357NHU5FPTFBM6I3YOCQB https://lists.fedoraproject.org/archives/list&#x • CWE-20: Improper Input Validation CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 9.3EPSS: 1%CPEs: 4EXPL: 3CVE-2016-2334
https://notcve.org/view.php?id=CVE-2016-2334
Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image. Desbordamiento de búfer basado en memoria dinámica en el método NArchive::NHfs::CHandler::ExtractZlibFile en 7zip en versiones anteriores a 16.00 y p7zip permite a atacantes remotos ejecutar código arbitrario a través de una imagen HFS+ manipulada. • https://github.com/icewall/CVE-2016-2334 http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html http://blog.talosintelligence.com/2017/11/exploiting-cve-2016-2334.html http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html http://www.securityfocus.com/bid/90531 http://www.securitytracker.com/id/1035876 http://www.talosintel.com/reports/TALOS-2016-0093 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNYIQAU3FKFBNFPK6GKYTS • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2016-9243
https://notcve.org/view.php?id=CVE-2016-9243
HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size. HKDF en criptografía en versiones anteriores a 1.5.2 devuelve una cadena de bytes vacía si se utiliza con una longitud inferior que algorithm.digest_size. • http://www.openwall.com/lists/oss-security/2016/11/09/2 http://www.securityfocus.com/bid/94216 http://www.ubuntu.com/usn/USN-3138-1 https://cryptography.io/en/latest/changelog https://github.com/pyca/cryptography/commit/b924696b2e8731f39696584d12cceeb3aeb2d874 https://github.com/pyca/cryptography/issues/3211 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R2ZOBMPWDFFHUZ6QOZZY36A6H5CGJXL https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraprojec • CWE-20: Improper Input Validation •