CVSS: 9.8EPSS: 13%CPEs: 2EXPL: 2CVE-2014-5119 – glibc - NUL Byte gconv_translit_find Off-by-One
https://notcve.org/view.php?id=CVE-2014-5119
26 Aug 2014 — Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules. Error de superación de límite (off-by-one) en la función __gconv_translit_find en gconv_trans.c en GNU C Library (también conocido como glibc) permite a atacantes dependientes de contexto causar una denegación de servicio ... • https://packetstorm.news/files/id/128002 • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 3CVE-2014-4043 – Mandriva Linux Security Advisory 2014-152
https://notcve.org/view.php?id=CVE-2014-4043
04 Aug 2014 — The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities. La función posix_spawn_file_actions_addopen en glibc anterior a 2.20 no copia su argumento de ruta de acuerdo con la especificación POSIX, lo que permite a atacantes dependientes de contexto provocar vulnerabilidades de uso después de liberación. USN-2306-1 fixed vulnerabilities in th... • https://packetstorm.news/files/id/154361 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 29EXPL: 0CVE-2014-0475 – glibc: directory traversal in LC_* locale handling
https://notcve.org/view.php?id=CVE-2014-0475
11 Jul 2014 — Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable. Múltiples vulnerabilidades de salto de directorio en GNU C Library (también conocido como glibc or libc6) anterior a 2.20 permiten a atacantes dependientes de contexto evadir las restricciones ForceCommand y posiblemente t... • http://linux.oracle.com/errata/ELSA-2015-0092.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2010-3192
https://notcve.org/view.php?id=CVE-2010-3192
12 Oct 2010 — Certain run-time memory protection mechanisms in the GNU C Library (aka glibc or libc6) print argv[0] and backtrace information, which might allow context-dependent attackers to obtain sensitive information from process memory by executing an incorrect program, as demonstrated by a setuid program that contains a stack-based buffer overflow error, related to the __fortify_fail function in debug/fortify_fail.c, and the __stack_chk_fail (aka stack protection) and __chk_fail (aka FORTIFY_SOURCE) implementations... • http://seclists.org/fulldisclosure/2010/Apr/399 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •