CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 2CVE-2022-2989 – podman: possible information disclosure and modification
https://notcve.org/view.php?id=CVE-2022-2989
13 Sep 2022 — An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container. Un manejo incorrecto de los grupos suplementarios en el motor de contenedores Podman podría conllevar a una divulgación de información confidencial o una posible modificació... • https://bugzilla.redhat.com/show_bug.cgi?id=2121445 • CWE-842: Placement of User into Incorrect Group CWE-863: Incorrect Authorization •
CVSS: 7.8EPSS: 0%CPEs: 23EXPL: 0CVE-2020-10735 – python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading to DoS
https://notcve.org/view.php?id=CVE-2020-10735
09 Sep 2022 — A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability. Se ha encontrado un fallo en python. En los algoritmos con complejidad de tiempo cuadrática que usan bases no binarias, cuan... • http://www.openwall.com/lists/oss-security/2022/09/21/1 • CWE-400: Uncontrolled Resource Consumption CWE-704: Incorrect Type Conversion or Cast •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 1CVE-2022-2905 – Ubuntu Security Notice USN-5729-1
https://notcve.org/view.php?id=CVE-2022-2905
09 Sep 2022 — An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data. Se ha encontrado un fallo de lectura de memoria fuera de límites en el subsistema BPF del kernel de Linux en la forma en que un usuario llama a la función bpf_tail_call con una clave mayor que el max_entries del mapa. Este fallo permite a un usuario local conseguir a... • https://bugzilla.redhat.com/show_bug.cgi?id=2121800 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 17EXPL: 0CVE-2022-2964 – kernel: memory corruption in AX88179_178A based USB ethernet device.
https://notcve.org/view.php?id=CVE-2022-2964
09 Sep 2022 — A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes. Se ha encontrado un fallo en el controlador del kernel de Linux para los dispositivos USB 2.0/3.0 Gigabit Ethernet basados en ASIX versión AX88179_178A. La vulnerabilidad contiene múltiples lecturas fuera de límites y posibles escrituras fuera de límites Red Hat Advanced Cluster Management for Kubernetes... • https://bugzilla.redhat.com/show_bug.cgi?id=2067482 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 6.8EPSS: 0%CPEs: 10EXPL: 2CVE-2022-2850 – 389-ds-base: SIGSEGV in sync_repl
https://notcve.org/view.php?id=CVE-2022-2850
05 Sep 2022 — A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514. Se ha encontrado un fallo en 389-ds-base. • https://access.redhat.com/security/cve/CVE-2022-2850 • CWE-476: NULL Pointer Dereference •
CVSS: 7.0EPSS: 0%CPEs: 3EXPL: 2CVE-2022-1247
https://notcve.org/view.php?id=CVE-2022-1247
31 Aug 2022 — An issue found in linux-kernel that leads to a race condition in rose_connect(). The rose driver uses rose_neigh->use to represent how many objects are using the rose_neigh. When a user wants to delete a rose_route via rose_ioctl(), the rose driver calls rose_del_node() and removes neighbours only if their “count” and “use” are zero. Se ha encontrado un problema en linux-kernel que conlleva a una condición de carrera en la función rose_connect(). El controlador de rose usa rose_neigh-)use para representar c... • https://access.redhat.com/security/cve/CVE-2022-1247 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.6EPSS: 0%CPEs: 10EXPL: 2CVE-2022-1355 – libtiff: stack-buffer-overflow in tiffcp.c in main()
https://notcve.org/view.php?id=CVE-2022-1355
31 Aug 2022 — A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue, possibly corrupting the memory, and causing a crash that leads to a denial of service. Se ha encontrado un fallo de desbordamiento del búfer de la pila en la función main() del archivo tiffcp.c de Libtiffs. Este defecto permite a un atacante pasar un archivo TIFF diseñado a la herramienta tiffcp, desencadenando... • https://access.redhat.com/security/cve/CVE-2022-1355 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 2CVE-2022-1354 – libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c
https://notcve.org/view.php?id=CVE-2022-1354
31 Aug 2022 — A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service. Se ha encontrado un fallo de desbordamiento del búfer de la pila en el archivo tiffinfo.c de Libtiffs, en la función TIFFReadRawDataStriped(). Este defecto permite a un atacante pasar un archivo TIFF diseñado a la herramienta tiffinfo, de... • https://access.redhat.com/security/cve/CVE-2022-1354 • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2022-0851 – convert2rhel: Activation key passed via command line by code
https://notcve.org/view.php?id=CVE-2022-0851
29 Aug 2022 — There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subsequently passed to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the activation key via the process command line via e.g. htop or ps. The specific impact varies upon the subscription, but generally this would allow an attacker to register systems purchased by the victim until discovered; a form of fraud. This could occur regard... • https://access.redhat.com/security/cve/CVE-2022-0851 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-0480 – kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion
https://notcve.org/view.php?id=CVE-2022-0480
29 Aug 2022 — A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX) file locks. Se ha encontrado un fallo en la función filelock_init en el archivo fs/locks.c del kernel de Linux. Este problema puede conllevar a un agotamiento de la memoria del host debido a que memcg no limita el número de bloqueos de archivos de la Interfaz del Sistema Operativo Portátil (POSIX) A... • https://access.redhat.com/security/cve/CVE-2022-0480 • CWE-770: Allocation of Resources Without Limits or Throttling •