CVSS: 6.2EPSS: 0%CPEs: 14EXPL: 0CVE-2023-39804 – Ubuntu Security Notice USN-6543-1
https://notcve.org/view.php?id=CVE-2023-39804
11 Dec 2023 — In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. En GNU tar anterior a 1.35, los atributos de extensión mal manejados en un archivo PAX pueden provocar un bloqueo de la aplicación en xheader.c. It was discovered that tar incorrectly handled extended attributes in PAX archives. An attacker could use this issue to cause tar to crash, resulting in a denial of service. • https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1058079 •
CVSS: 9.4EPSS: 0%CPEs: 2EXPL: 0CVE-2023-6394 – Quarkus: graphql operations over websockets bypass
https://notcve.org/view.php?id=CVE-2023-6394
09 Dec 2023 — A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions. Se encontró un defecto en Quarkus. Este problema ocurre cuando se recibe una solicitud a través de websocket sin ningún permiso basado en roles especificado en ... • https://access.redhat.com/errata/RHSA-2023:7612 • CWE-862: Missing Authorization •
CVSS: 9.3EPSS: 0%CPEs: 7EXPL: 0CVE-2023-6622 – Kernel: null pointer dereference vulnerability in nft_dynset_init()
https://notcve.org/view.php?id=CVE-2023-6622
08 Dec 2023 — A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service. Se encontró una vulnerabilidad de desreferencia de puntero nulo en nft_dynset_init() en net/netfilter/nft_dynset.c en nf_tables en el kernel de Linux. Este problema puede permitir que un atacante local con privilegios de usuario CAP_NET_ADMIN active una denegación de serv... • https://access.redhat.com/errata/RHSA-2024:2394 • CWE-476: NULL Pointer Dereference •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 2CVE-2023-6610 – Kernel: oob access in smb2_dump_detail
https://notcve.org/view.php?id=CVE-2023-6610
08 Dec 2023 — An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. Se encontró una vulnerabilidad de lectura fuera de los límites en smb2_dump_detail en fs/smb/client/smb2ops.c en el kernel de Linux. Este problema podría permitir que un atacante local bloquee el sistema o filtre información interna del kernel. It was discovered that the CIFS network file system impl... • https://access.redhat.com/errata/RHSA-2024:0723 • CWE-125: Out-of-bounds Read •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 2CVE-2023-6606 – Kernel: out-of-bounds read vulnerability in smbcalcsize
https://notcve.org/view.php?id=CVE-2023-6606
08 Dec 2023 — An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. Se encontró una vulnerabilidad de lectura fuera de los límites en smbCalcSize en fs/smb/client/netmisc.c en el kernel de Linux. Este problema podría permitir que un atacante local bloquee el sistema o filtre información interna del kernel. It was discovered that the CIFS network file system implementation... • https://access.redhat.com/errata/RHSA-2024:0723 • CWE-125: Out-of-bounds Read •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6393 – Quarkus: potential invalid reuse of context when @cacheresult on a uni is used
https://notcve.org/view.php?id=CVE-2023-6393
06 Dec 2023 — A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request context. This is a problem if the cached Uni context contains sensitive information, and could allow a malicious user to benefit from a POST request returning the response that is meant for another user, gaining access to sensitive data. Se encontró una falla en Quarkus Cach... • https://access.redhat.com/security/cve/CVE-2023-6393 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-47038 – Perl: write past buffer end via illegal user-defined unicode property
https://notcve.org/view.php?id=CVE-2023-47038
27 Nov 2023 — A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer. Se encontró una vulnerabilidad en Perl. Este problema ocurre cuando Perl compila una expresión regular manipulada, lo que puede permitir que un atacante controle el desbordamiento de búfer de bytes en un búfer asignado en el almacenamiento dinámico. It was discovered that Perl incorrectly hand... • https://access.redhat.com/errata/RHSA-2024:2228 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2023-6277 – Libtiff: out-of-memory in tiffopen via a craft file
https://notcve.org/view.php?id=CVE-2023-6277
24 Nov 2023 — An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB. Se encontró un error de falta de memoria en libtiff. Pasar un archivo tiff manipulado a la API TIFFOpen() puede permitir que un atacante remoto provoque una denegación de servicio a través de una entrada artesanal con un tamaño inferior a 379 KB. USN-6644-1 fixed vulnerabilities in LibTIFF. • https://access.redhat.com/security/cve/CVE-2023-6277 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.7EPSS: 0%CPEs: 3EXPL: 0CVE-2023-6176 – Kernel: local dos vulnerability in scatterwalk_copychunks
https://notcve.org/view.php?id=CVE-2023-6176
16 Nov 2023 — A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to crash the system or escalate their privileges on the system. Se encontró una falla de desreferencia de puntero nulo en la API del kernel de Linux para la funcionalidad de dispersión del algoritmo criptográfico. Este problema ocurre cuando un usuario constru... • http://packetstormsecurity.com/files/177029/Kernel-Live-Patch-Security-Notice-LSN-0100-1.html • CWE-476: NULL Pointer Dereference •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2023-6121 – Kernel: nvme: info leak due to out-of-bounds read in nvmet_ctrl_find_get
https://notcve.org/view.php?id=CVE-2023-6121
16 Nov 2023 — An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg). Se encontró una vulnerabilidad de lectura fuera de los límites en el subsistema NVMe-oF/TCP del kernel de Linux. Esta falla permite que un atacante remoto envíe un paquete TCP manipulado, lo que desencadena... • https://access.redhat.com/errata/RHSA-2024:2394 • CWE-125: Out-of-bounds Read •