CVSS: 7.5EPSS: 0%CPEs: 18EXPL: 0CVE-2024-6600 – Ubuntu Security Notice USN-6903-1
https://notcve.org/view.php?id=CVE-2024-6600
09 Jul 2024 — Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 8192 ints in private shader memory on mac OS. This vulnerability affects Firefox < 128 and Firefox ESR < 115.13. Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 8192 ints in private shader memory on mac OS. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 1... • https://bugzilla.mozilla.org/show_bug.cgi?id=1888340 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2024-32230 – Ubuntu Security Notice USN-6983-1
https://notcve.org/view.php?id=CVE-2024-32230
01 Jul 2024 — FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0 FFmpeg 7.0 es vulnerable al desbordamiento del búfer. Hay un error de parámetro de tamaño negativo en libavcodec/mpegvideo_enc.c:1216:21 en load_input_picture en FFmpeg7.0 Zeng Yunxiang discovered that FFmpeg incorrectly handled memory during video encoding. An attacker could possibly use this issue to perform a denial of service, or execute arbitrary code. • https://trac.ffmpeg.org/ticket/10952 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2024-39134
https://notcve.org/view.php?id=CVE-2024-39134
27 Jun 2024 — A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_fetch_disk_trailer() function at /zzip/zip.c. Una vulnerabilidad de desbordamiento de búfer de pila en zziplibv 0.13.77 permite a atacantes provocar una denegación de servicio a través de la función __zzip_fetch_disk_trailer() en /zzip/zip.c. • https://github.com/gdraheim/zziplib/issues/165 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 10.0EPSS: 0%CPEs: 8EXPL: 0CVE-2024-38439 – Ubuntu Security Notice USN-7347-1
https://notcve.org/view.php?id=CVE-2024-38439
16 Jun 2024 — Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLoginExt in login in etc/uams/uams_pam.c. 2.4.1 and 3.1.19 are also fixed versions. Netatalk 3.2.0 tiene un error de uno en uno y el resultado es un desbordamiento del búfer basado en el montón debido a la configuración de ibuf[PASSWDLEN] en '\0' en FPLoginExt al iniciar sesión en etc/uams/uams_pam.c. It was discovered that Netatalk did not properly manage memory under certa... • https://github.com/Netatalk/netatalk/blob/90d91a9ac9a7d6132ab7620d31c8c23400949206/etc/uams/uams_pam.c#L316 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2024-38440
https://notcve.org/view.php?id=CVE-2024-38440
16 Jun 2024 — Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly using FPLoginExt in BN_bin2bn in etc/uams/uams_dhx_pam.c. The original issue 1097 report stated: 'The latest version of Netatalk (v3.2.0) contains a security vulnerability. This vulnerability arises due to a lack of validation for the length field after parsing user-provided data, leading to an out-of-bounds heap write of one byte (\0). Under specific configurations, thi... • https://github.com/Netatalk/netatalk/blob/90d91a9ac9a7d6132ab7620d31c8c23400949206/etc/uams/uams_dhx_pam.c#L199-L200 • CWE-193: Off-by-one Error •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2024-38441
https://notcve.org/view.php?id=CVE-2024-38441
16 Jun 2024 — Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in afp_mapname in etc/afpd/directory.c. 2.4.1 and 3.1.19 are also fixed versions. Netatalk 3.2.0 tiene un error uno por uno y el resultado es un desbordamiento del búfer basado en el montón debido a la configuración de ibuf[len] en '\0' en FPMapName en afp_mapname en etc/afp/directory.c. • https://github.com/Netatalk/netatalk/blob/90d91a9ac9a7d6132ab7620d31c8c23400949206/etc/afpd/directory.c#L2333 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-193: Off-by-one Error •
CVSS: 4.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-52890
https://notcve.org/view.php?id=CVE-2023-52890
13 Jun 2024 — NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging. NTFS-3G anterior a 75dcdc2 tiene un use-after-free en ntfs_uppercase_mbs en libntfs-3g/unistr.c. NOTA: la discusión sugiere que la explotación sería un desafío. • https://github.com/tuxera/ntfs-3g/issues/84 •
CVSS: 7.6EPSS: 0%CPEs: 35EXPL: 0CVE-2024-5700 – Mozilla: Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12
https://notcve.org/view.php?id=CVE-2024-5700
11 Jun 2024 — Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Errores de seguridad de la memoria presentes en Firefox 126, Firefox ESR 115.11 y Thunderbird 115.11. Algunos de estos errores mostraron evidencia de corrupción de memoria y sup... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1862809%2C1889355%2C1893388%2C1895123 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-786: Access of Memory Location Before Start of Buffer CWE-788: Access of Memory Location After End of Buffer •
CVSS: 8.6EPSS: 1%CPEs: 35EXPL: 0CVE-2024-5696 – Mozilla: Memory Corruption in Text Fragments
https://notcve.org/view.php?id=CVE-2024-5696
11 Jun 2024 — By manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Al manipular el texto en una etiqueta `<input>`, un atacante podría haber dañado la memoria y provocar un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Firefox < 127 y Firefox ESR < 115.12. The Mozilla Foundation Security Advisory describes this flaw ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1896555 • CWE-787: Out-of-bounds Write CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 6.4EPSS: 0%CPEs: 35EXPL: 0CVE-2024-5693 – Mozilla: Cross-Origin Image leak via Offscreen Canvas
https://notcve.org/view.php?id=CVE-2024-5693
11 Jun 2024 — Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Offscreen Canvas no realizó un seguimiento adecuado de la contaminación de origen cruzado, que podría usarse para acceder a datos de imágenes de otro sitio en violación de la política del mismo origen. Esta vulnerabilidad afecta a Firefox < 127 y Firefox ESR &l... • https://bugzilla.mozilla.org/show_bug.cgi?id=1891319 • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •