CVE-2023-6857

Mozilla: Symlinks may resolve to smaller than expected buffers

When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. *This bug only affects Firefox on Unix-based operating systems (Android, Linux, MacOS). Windows is unaffected.* This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 9 more

CVE-2023-47747

IBM Db2 denial of service

IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 272646.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hp Ibm Linux and 2 more

Products

Hp-ux Aix Db2 and 4 more

CVE-2023-47746

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 272644.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hp Ibm Linux and 2 more

Products

Hp-ux Aix Db2 and 5 more

CVE-2023-47701

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 266166.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Ibm Linux Microsoft and 1 more

Products

Db2 Linux Kernel Windows and 1 more

CVE-2023-4208

Use-after-free in Linux kernel's net/sched: cls_u32 component

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 3 more

CVE-2023-4207

Use-after-free in Linux kernel's net/sched: cls_fw component

A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 3 more

CVE-2023-4206

Use-after-free in Linux kernel's net/sched: cls_route component

A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 3 more

CVE-2023-4136

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.

CVSS 3.1 · 7.4 High EPSS 1.4% KEV · Not listed

Vendors

Apple Craftercms Linux and 1 more

Products

Macos Craftercms Linux Kernel and 1 more

CVE-2023-30449

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 253439.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Hp Ibm Linux and 2 more

Products

Hp-ux Aix Db2 and 4 more

CVE-2023-30448

IBM Db2 denial of service

IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253437.

CVSS 3.1 · 5.9 Medium EPSS 1.4% KEV · Not listed

Vendors

Hp Ibm Linux and 2 more

Products

Hp-ux Aix Db2 and 3 more

CVE-2023-30445

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253357.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Hp Ibm Linux and 2 more

Products

Hp-ux Aix Db2 and 4 more

CVE-2023-1998

Spectre v2 SMT mitigations problem in Linux kernel

The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons, which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target injection against which STIBP protects.

CVSS 3.1 · 5.6 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 2 more

CVE-2023-1872

Use-after-free in Linux kernel's io_uring subsystem

A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local privilege escalation. The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered. We recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux

Products

Debian Linux Linux Kernel

CVE-2023-0045

Incorrect indirect branch prediction barrier in the Linux Kernel

The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set  function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall.  The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit a664ec9158eeddd75121d39c9a0758016097fa96

CVSS 3.1 · 4.7 Medium EPSS 2.4% KEV · Not listed

Vendors

Debian Linux Netapp

Products

Debian Linux Linux Kernel Active Iq Unified Manager and 10 more

CVE-2023-47141

IBM Db2 denial of service

IIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 270264.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Aix Db2 Linux On Ibm Z and 2 more

CVE-2023-46167

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of service when a specially crafted cursor is used. IBM X-Force ID: 269367.

CVSS 3.1 · 5.9 Medium EPSS 1.1% KEV · Not listed

Vendors

Ibm Linux Microsoft and 1 more

Products

Db2 Linux Kernel Windows and 1 more

CVE-2023-45193

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of service when a specially crafted cursor is used. IBM X-Force ID: 268759.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Aix Db2 Linux On Ibm Z and 2 more

CVE-2023-40687

IBM Db2 denial of service

IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted RUNSTATS command on an 8TB table. IBM X-Force ID: 264809.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Ibm Linux Microsoft and 1 more

Products

Db2 Linux Kernel Windows and 1 more

CVE-2023-40374

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted query statement. IBM X-Force ID: 263575.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft and 1 more

Products

Db2 Linux Kernel Windows and 1 more

CVE-2023-40373

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to denial of service with a specially crafted query containing common table expressions. IBM X-Force ID: 263574.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft and 1 more

Products

Db2 Linux Kernel Windows and 1 more