CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 0CVE-2018-15908 – ghostscript: .tempfile file permission issues (699657)
https://notcve.org/view.php?id=CVE-2018-15908
In Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply malicious PostScript files to bypass .tempfile restrictions and write files. En Artifex Ghostscript 9.23 antes del 23/08/2018, los atacantes pueden proporcionar archivos PostScript maliciosos para omitir las restricciones .tempfile y escribir en archivos. It was discovered that the ghostscript .tempfile function did not properly handle file permissions. An attacker could possibly exploit this to exploit this to bypass the -dSAFER protection and delete files or disclose their content via a specially crafted PostScript document. • http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=0d3901189f245232f0161addf215d7268c4d05a3 https://access.redhat.com/errata/RHSA-2018:3650 https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html https://security.gentoo.org/glsa/201811-12 https://usn.ubuntu.com/3768-1 https://www.debian.org/security/2018/dsa-4288 https://www.kb.cert.org/vuls/id/332928 https://access.redhat.com/security/cve/CVE-2018-15908 https://bugzilla.redhat.com/show_bug.cgi?id=1619756 •
CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 0CVE-2018-15910 – ghostscript: LockDistillerParams type confusion (699656)
https://notcve.org/view.php?id=CVE-2018-15910
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or execute code. En Artifex Ghostscript en versiones anteriores a la 9.24, los atacantes que puedan proporcionar archivos PostScript manipulados podrían emplear una confusión de tipos en el parámetro LockDistillerParams para provocar el cierre inesperado del intérprete o ejecutar código. It was discovered that the type of the LockDistillerParams parameter is not properly verified. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted PostScript document. • http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=c3476dde7743761a4e1d39a631716199b696b880 http://www.securityfocus.com/bid/105122 https://access.redhat.com/errata/RHSA-2018:2918 https://bugs.ghostscript.com/show_bug.cgi?id=699656 https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html https://security.gentoo.org/glsa/201811-12 https://support.f5.com/csp/article/K22141757?utm_source=f5support&%3Butm_medium= • CWE-704: Incorrect Type Conversion or Cast •
CVSS: 10.0EPSS: 2%CPEs: 17EXPL: 0CVE-2011-2767 – mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess
https://notcve.org/view.php?id=CVE-2011-2767
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes. mod_perl 2.0 hasta la versión 2.0.10 permite que los atacantes ejecuten código Perl colocándolo en un archivo .htaccess propiedad del usuario, debido a que (al contrario de lo que pone en la documentación) no hay una opción de configuración que permita el código Perl para el control de administrador del procesamiento de peticiones HTTP sin permitir también que usuarios sin privilegios ejecuten código Perl en el contexto de la cuenta de usuario que ejecuta los procesos Apache HTTP Server. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00063.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00065.html http://www.securityfocus.com/bid/105195 https://access.redhat.com/errata/RHSA-2018:2737 https://access.redhat.com/errata/RHSA-2018:2825 https://access.redhat.com/errata/RHSA-2018:2826 https://bugs.debian.org/644169 https://lists.apache.org/thread.html/c8ebe8aad147a3ad2e7b0e8b2da45263171ab5d0fc7f8c100feaa94d%40%3Cmodperl-cvs.perl.apache.org%3E https://li • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-266: Incorrect Privilege Assignment •
CVSS: 5.6EPSS: 0%CPEs: 11EXPL: 0CVE-2018-10846 – gnutls: "Just in Time" PRIME + PROBE cache-based side channel attack can lead to plaintext recovery
https://notcve.org/view.php?id=CVE-2018-10846
A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets. Se ha detectado un canal lateral basado en memoria caché en la implementación GnuTLS que conduce a un ataque de recuperación de texto plano a través de una máquina virtual. Un atacante podría utilizar una combinación de un ataque "Just in Time" Prime+probe con un ataque Lucky-13 para recuperar texto plano usando paquetes manipulados. A cache-based side channel attack was found in the way GnuTLS implements CBC-mode cipher suites. • http://www.securityfocus.com/bid/105138 https://access.redhat.com/errata/RHSA-2018:3050 https://access.redhat.com/errata/RHSA-2018:3505 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10846 https://eprint.iacr.org/2018/747 https://gitlab.com/gnutls/gnutls/merge_requests/657 https://lists.debian.org/debian-lts-announce/2018/10/msg00022.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ https://lists.fedor • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-385: Covert Timing Channel •
CVSS: 5.9EPSS: 0%CPEs: 11EXPL: 0CVE-2018-10844 – gnutls: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls
https://notcve.org/view.php?id=CVE-2018-10844
It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets. Se ha detectado que la implementación GnuTLS de HMAC-SHA-256 era vulnerable a un ataque de estilo Lucky Thirteen. Los atacantes remotos podrían utilizar este fallo para realizar ataques de distinción y de recuperación en texto plano mediante análisis estadísticos de datos temporales mediante paquetes manipulados. It was found that GnuTLS's implementation of HMAC-SHA-256 was vulnerable to Lucky Thirteen-style attack. • http://www.securityfocus.com/bid/105138 https://access.redhat.com/errata/RHSA-2018:3050 https://access.redhat.com/errata/RHSA-2018:3505 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10844 https://eprint.iacr.org/2018/747 https://gitlab.com/gnutls/gnutls/merge_requests/657 https://lists.debian.org/debian-lts-announce/2018/10/msg00022.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ https://lists.fedor • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-385: Covert Timing Channel •