CVSS: 6.8EPSS: 2%CPEs: 20EXPL: 0CVE-2015-1863 – wpa_supplicant: P2P SSID processing vulnerability
https://notcve.org/view.php?id=CVE-2015-1863
Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries. Desbordamiento de buffer basado en memoria dinámica en wpa_supplicant 1.0 hasta 2.4 permite a atacantes remotos causar una denegación de servicio (caída), leer la memoria o posiblemente ejecutar código arbitrario a través de información SSID manipulada en un Frame de gestión cuando se crea o actualiza las entradas P2P. A buffer overflow flaw was found in the way wpa_supplicant handled SSID information in the Wi-Fi Direct / P2P management frames. A specially crafted frame could allow an attacker within Wi-Fi radio range to cause wpa_supplicant to crash or, possibly, execute arbitrary code. • http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00000.html http://packetstormsecurity.com/files/131598/Android-wpa_supplicant-Heap-Overflow.html http://rhn.redhat.com/errata/RHSA-2015-1090.html http://seclists.org/fulldisclosure/2015/Apr/82 http://security.alibaba.com/blog/blog.htm?spm=0.0.0.0.p1ECc3&id=19 http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt http://www.debian.org/security/2015/dsa-3233 http://www.securityfocus.com/archive/1/535353& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 7.6EPSS: 9%CPEs: 110EXPL: 0CVE-2013-6435 – rpm: race condition during the installation process
https://notcve.org/view.php?id=CVE-2013-6435
Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory. Condición de carrera en RPM 4.11.1 y anteriores permite a atacantes remotos ejecutar código arbitrario a través de un fichero RPM manipulado cuyo instalación extrae los contenidos de ficheros temporales antes de validar la firma, tal y como fue demostrado mediante la instalación de un fichero en el directorio /etc/cron.d. It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system interprets the unverified temporary file contents and extracts commands from it. This could allow an attacker to modify signed RPM files in such a way that they would execute code chosen by the attacker during package installation. • http://advisories.mageia.org/MGASA-2014-0529.html http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://rhn.redhat.com/errata/RHSA-2014-1974.html http://rhn.redhat.com/errata/RHSA-2014-1975.html http://rhn.redhat.com/errata/RHSA-2014-1976.html http://www.debian.org/security/2015/dsa-3129 http://www.mandriva.com/security/advisories?name=MDVSA-2014:251 http://www.mandriva.com/security/advisories?name=MDVSA-2015:056 http://www.oracle.com/technetwork/topics/ • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 6.8EPSS: 0%CPEs: 142EXPL: 0CVE-2014-8104
https://notcve.org/view.php?id=CVE-2014-8104
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet. OpenVPN 2.x anterior a 2.0.11, 2.1.x, 2.2.x anterior a 2.2.3, y 2.3.x anterior a 2.3.6 permite a usuarios remotos autenticados causar una denegación de servicio (caída del servidor) a través de un paquete de canal de control pequeño. • http://advisories.mageia.org/MGASA-2014-0512.html http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00008.html http://www.debian.org/security/2014/dsa-3084 http://www.mandriva.com/security/advisories?name=MDVSA-2015:139 http://www.ubuntu.com/usn/USN-2430-1 https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 0%CPEs: 23EXPL: 0CVE-2014-4975 – ruby: off-by-one stack-based buffer overflow in the encodes() function
https://notcve.org/view.php?id=CVE-2014-4975
Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow. Error de superación de límite (off-by-one) en la función de codificación ubicada en pack.c en Ruby 1.9.3 y anteriores, y 2.x hasta 2.1.2, cuando se utilizan ciertos especificadores de formato de cadena, permite a atacantes dependientes de contexto provocar una denegación de servicio (fallo de segmentación) a través de vectores que provocan un desbordamiento de buffer basado en pila. • http://advisories.mageia.org/MGASA-2014-0472.html http://rhn.redhat.com/errata/RHSA-2014-1912.html http://rhn.redhat.com/errata/RHSA-2014-1913.html http://rhn.redhat.com/errata/RHSA-2014-1914.html http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=46778 http://www.debian.org/security/2015/dsa-3157 http://www.mandriva.com/security/advisories?name=MDVSA-2015:129 http://www.openwall.com/lists/oss-security/2014/07/09/13 http://www.oracle.com/technet • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 6.8EPSS: 1%CPEs: 16EXPL: 0CVE-2014-3686 – hostapd: wpa_cli and hostapd_cli remote command execution issue
https://notcve.org/view.php?id=CVE-2014-3686
wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame. wpa_supplicant y hostapd 0.7.2 hasta 2.2 cuando se ejecutan ciertas configuraciones y se utilizan los secuencias de comandos using_wpa_cli o hostapd_cli, permite a atacantes remotos ejecutar comandos arbitrarios a través de un frame manipulado. A command injection flaw was found in the way the wpa_cli utility executed action scripts. If wpa_cli was run in daemon mode to execute an action script (specified using the -a command line option), and wpa_supplicant was configured to connect to a P2P group, malicious P2P group parameters could cause wpa_cli to execute arbitrary code. • http://advisories.mageia.org/MGASA-2014-0429.html http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00000.html http://lists.opensuse.org/opensuse-updates/2014-10/msg00027.html http://lists.opensuse.org/opensuse-updates/2014-10/msg00028.html http://rhn.redhat.com/errata/RHSA-2014-1956.html http://secunia.com/advisories/60366 http://secunia.com/advisories/60428 http://secunia.com/advisories/61271 http://w1.fi/security/2014-1 http://www.debian.org/security/2014/ • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •