CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2018-16840 – curl: Use-after-free when closing "easy" handle in Curl_close()
https://notcve.org/view.php?id=CVE-2018-16840
A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. Se ha detectado un error de uso de memoria dinámica (heap) previamente liberada en Curl, desde la versión 7.59.0 hasta la 7.61.1, en el código relacionado con el cierre de un controlador "easy". Al cerrar y limpiar un controlador "easy" en la función "Curl_close()", el código de la biblioteca libera, en primer lugar, un struct (sin pasar el puntero a null) y, después, podría escribir erróneamente en un campo struct dentro del struct ya liberado. • http://www.securitytracker.com/id/1042013 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16840 https://curl.haxx.se/docs/CVE-2018-16840.html https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f https://security.gentoo.org/glsa/201903-03 https://usn.ubuntu.com/3805-1 https://access.redhat.com/security/cve/CVE-2018-16840 https://bugzilla.redhat.com/show_bug.cgi?id=1642203 • CWE-416: Use After Free •
CVSS: 9.8EPSS: 1%CPEs: 7EXPL: 0CVE-2018-16839 – curl: Integer overflow leading to heap-based buffer overflow in Curl_sasl_create_plain_message()
https://notcve.org/view.php?id=CVE-2018-16839
Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service. Curl, desde la versión 7.33.0 hasta la 7.61.1, es vulnerable a una saturación del búfer en el código de autenticación SASL que podría conducir a una denegación de servicio (DoS). • http://www.securitytracker.com/id/1042012 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16839 https://curl.haxx.se/docs/CVE-2018-16839.html https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5 https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html https://security.gentoo.org/glsa/201903-03 https://usn.ubuntu.com/3805-1 https://www.d • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •
CVSS: 9.1EPSS: 1%CPEs: 8EXPL: 0CVE-2018-16842 – curl: Heap-based buffer over-read in the curl tool warning formatting
https://notcve.org/view.php?id=CVE-2018-16842
Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service. Curl, desde la versión 7.14.1 hasta la 7.61.1, es vulnerable a una sobrelectura de búfer basada en memoria dinámica (heap) en la función tool_msgs.c:voutf() que podría resultar en una exposición de información y una denegación de servicio (DoS). • http://www.securitytracker.com/id/1042014 https://access.redhat.com/errata/RHSA-2019:2181 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16842 https://curl.haxx.se/docs/CVE-2018-16842.html https://github.com/curl/curl/commit/d530e92f59ae9bb2d47066c3c460b25d2ffeb211 https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html https://security.gentoo.org/glsa/201903-03 https://usn.ubuntu.com/3805-1 https://usn.ubuntu.com/3805-2 https://www.debian.org/security/2 • CWE-125: Out-of-bounds Read •
CVSS: 5.9EPSS: 0%CPEs: 44EXPL: 0CVE-2018-0734 – Timing attack against DSA
https://notcve.org/view.php?id=CVE-2018-0734
The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p). • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html http://www.securityfocus.com/bid/105758 https://access.redhat.com/errata/RHSA-2019:2304 https://access.redhat.com/errata/RHSA-2019:3700 https://access.redhat.com/errata/RHSA-2019:3932 https://access.redhat.com/errata/RHSA-2019:3933 https://access.redhat.com/errata/RHSA-2019:3935 https://git.openssl.org/gitweb/?p=openssl.git%3Ba • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-385: Covert Timing Channel •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 1CVE-2018-18281 – kernel: TLB flush happens too late on mremap
https://notcve.org/view.php?id=CVE-2018-18281
Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19. Desde la versión 3.2 del kernel de Linux, la syscall mremap() realiza vaciados TLB tras soltar bloqueos de tabla de página. Si una syscall como ftruncate() elimina las entradas de las tablas de página de una tarea en medio de mremap(), una entrada TLB obsoleta puede permanecer por poco tiempo, lo que permite el acceso a una página física una vez se ha devuelto al asignador de páginas y se reutiliza. • http://packetstormsecurity.com/files/150001/Linux-mremap-TLB-Flush-Too-Late.html http://www.openwall.com/lists/oss-security/2018/10/29/5 http://www.securityfocus.com/bid/105761 http://www.securityfocus.com/bid/106503 https://access.redhat.com/errata/RHSA-2019:0831 https://access.redhat.com/errata/RHSA-2019:2029 https://access.redhat.com/errata/RHSA-2019:2043 https://access.redhat.com/errata/RHSA-2020:0036 https://access.redhat.com/errata/RHSA-2020:0100 https://access&# • CWE-459: Incomplete Cleanup CWE-672: Operation on a Resource after Expiration or Release •