CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 1CVE-2023-38283
https://notcve.org/view.php?id=CVE-2023-38283
In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006. • https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/006_bgpd.patch.sig https://github.com/openbgpd-portable/openbgpd-portable/releases/tag/8.1 https://news.ycombinator.com/item?id=37305800 https://www.openbsd.org/errata73.html • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 5.5EPSS: 0%CPEs: 14EXPL: 0CVE-2023-40216
https://notcve.org/view.php?id=CVE-2023-40216
OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences. OpenBSD 7.3 antes de la errata 014 carece de una comprobación de límites de recuento de argumentos en la emulación de terminal de consola. Esto podría provocar un acceso incorrecto a la memoria y un bloqueo del kernel tras recibir secuencias de escape de terminal DCS o CSI falsificadas. • https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/014_wscons.patch.sig https://github.com/openbsd/src/commit/9d3f688f46eba347e96ff0ae9506ef2061622e0c • CWE-862: Missing Authorization •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-35784
https://notcve.org/view.php?id=CVE-2023-35784
A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected. • https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.3-relnotes.txt https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.7.3-relnotes.txt https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/026_ssl.patch.sig https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/004_ssl.patch.sig https://github.com/libressl/openbsd/commit/e42d8f4b21a8a498e2eabbffe4c7b7d4ef7cec54 • CWE-415: Double Free CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 2CVE-2010-4816
https://notcve.org/view.php?id=CVE-2010-4816
It was found in FreeBSD 8.0, 6.3 and 4.9, and OpenBSD 4.6 that a null pointer dereference in ftpd/popen.c may lead to remote denial of service of the ftpd service. Se encontró en FreeBSD versiones 8.0, 6.3 y 4.9, y en OpenBSD versiones 4.6 que una desreferencia de puntero null en el archivo ftpd/popen.c puede conllevar a una denegación de servicio remota del servicio ftpd • https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=144761 https://seclists.org/fulldisclosure/2010/Mar/117 https://seclists.org/oss-sec/2011/q3/284 • CWE-476: NULL Pointer Dereference •
CVSS: 4.0EPSS: 0%CPEs: 84EXPL: 3CVE-2010-4755
https://notcve.org/view.php?id=CVE-2010-4755
The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632. La (1) función remote_glob en sftp-glob.c y (2) la función process_put en sftp.c en OpenSSH v5.8 y versiones anteriores, como se usa en FreeBSD v7.3 y v8.1, NetBSD v5.0.2, OpenBSD v4.7 y otros productos, permiten a usuarios remotos autenticados causar una denegación de servicio (por excesivo uso de CPU y consumo de memoria) a través de expresiones glob debidamente modificadas que no coinciden con ningún nombre de ruta, como lo demuestran las expresiones glob en las solicitudes SSH_FXP_STAT a un demonio de sftp. Se trata de una vulnerabilidad diferente a CVE-2010-2632. • http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/dist/ssh/Attic/sftp-glob.c#rev1.13.12.1 http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/dist/ssh/Attic/sftp.c#rev1.21.6.1 http://cxib.net/stuff/glob-0day.c http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2010-008.txt.asc http://securityreason.com/achievement_securityalert/89 http://securityreason.com/exploitalert/9223 http://securityreason.com/securityalert/8116 • CWE-399: Resource Management Errors •