CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2017-9104
https://notcve.org/view.php?id=CVE-2017-9104
An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is encountered. Se detectó un problema en adns versiones anteriores a 1.5.2. Se cuelga, consumiendo CPU, si un bucle de puntero de compresión es encontrado • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00037.html http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ https://www.chiark.greenend.org.uk/piper • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2017-9108
https://notcve.org/view.php?id=CVE-2017-9108
An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte. Se detectó un problema en adns versiones anteriores a 1.5.2. adnshost maneja inapropiadamente una falta de una nueva línea final en una lectura estándar. • http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2017-9109
https://notcve.org/view.php?id=CVE-2017-9109
An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00037.html http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ https://www.chiark.greenend.org.uk/piper • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.7EPSS: 0%CPEs: 3EXPL: 0CVE-2020-14416
https://notcve.org/view.php?id=CVE-2020-14416
In the Linux kernel before 5.4.16, a race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-after-free, aka CID-0ace17d56824. This affects drivers/net/slip/slip.c and drivers/net/can/slcan.c. En el kernel de Linux versiones anteriores a 5.4.16, una condición de carrera en el manejo de tty-)disc_data en la disciplina de línea slip y slcan podría conllevar a un uso de la memoria previamente liberada, también se conoce como CID-0ace17d56824. Esto afecta a los archivos drivers/net/slip/slip.c y drivers/net/can/slcan.c • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html https://bugzilla.suse.com/show_bug.cgi?id=1162002 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.16 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0ace17d56824165c7f4c68785d6b58971db954dd • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 5.9EPSS: 1%CPEs: 9EXPL: 0CVE-2020-14422 – python: DoS via inefficiency in IPv{4,6}Interface classes
https://notcve.org/view.php?id=CVE-2020-14422
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2. La biblioteca Lib/ipaddress.py en Python versiones hasta 3.8.3, calcula inapropiadamente los valores de hash en las clases IPv4Interface e IPv6Interface, lo que podría permitir a un atacante remoto causar una denegación de servicio si una aplicación está afectada por el desempeño de un diccionario que contiene objetos de IPv4Interface o IPv6Interface, y este atacante puede causar que muchas entradas de diccionario sean creadas. Esto esta corregido en las versiones: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2 A vulnerability was found in the way the ipaddress python module computes hash values in the IPv4Interface and IPv6Interface classes. This flaw allows an attacker to create many dictionary entries, due to the performance of a dictionary containing the IPv4Interface or IPv6Interface objects, possibly resulting in a denial of service. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00032.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00041.html https://bugs.python.org/issue41004 https://github.com/python/cpython/pull/20956 https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html https://lists.debian.org/debian-lts-announce/2023/ • CWE-330: Use of Insufficiently Random Values CWE-400: Uncontrolled Resource Consumption CWE-682: Incorrect Calculation •