CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 0CVE-2019-9578
https://notcve.org/view.php?id=CVE-2019-9578
In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device. En devs.c en Yubico libu2f-host, en versiones anteriores a la 1.1.8, la respuesta a init se analiza erróneamente, filtrando memoria de pila no inicializada de vuelta al dispositivo. • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html https://blog.inhq.net/posts/yubico-libu2f-host-vuln-part2 https://developers.yubico.com/libu2f-host/Release_Notes.html https://github.com/Yubico/libu2f-host/commit/e4bb58cc8b6202a421e65f8230217d8ae6e16eb5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMA4H6AZFYIR3LA5VKKEJZNCCIVMUCFQ https://lists.fedoraproject.org/archives/list/packa • CWE-908: Use of Uninitialized Resource •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-20340
https://notcve.org/view.php?id=CVE-2018-20340
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey. Yubico libu2f-host 1.1.6 contiene búferes sin comprobar en devs.c, lo que podría permitir que un token malicioso explote un desbordamiento de búfer. Un atacante podría emplear esto para ejecutar código malicioso mediante un dispositivo USB manipulado enmascarado como token de seguridad en un ordenador en el que se está empleando la librería afectada. • https://blog.inhq.net/posts/yubico-libu2f-host-vuln-part1 https://developers.yubico.com/libu2f-host/Release_Notes.html https://seclists.org/bugtraq/2019/Feb/23 https://security.gentoo.org/glsa/202004-15 https://www.debian.org/security/2019/dsa-4389 https://www.yubico.com/support/security-advisories/ysa-2019-01 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •