Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,842

Export CSV
CVE-2023-2283

libssh: authorization bypass in pki_verify_data_signature

A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Libssh Redhat
Products
Fedora Libssh Enterprise Linux and 1 more
CVE-2022-41877

Missing input length validation in `drive` channel in FreeRDP

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in `drive` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the drive redirection channel - command line options `/drive`, `+drives` or `+home-drive`.

CVSS 3.1 · 4.6 Medium EPSS 1.0% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2022-39347

Missing path sanitation with `drive` channel in FreeRDP

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing path canonicalization and base path check for `drive` channel. A malicious server can trick a FreeRDP based client to read files outside the shared directory. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/drive`, `/drives` or `+home-drive` redirection switch.

CVSS 3.1 · 2.6 Low EPSS 1.2% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2022-39320

Heap buffer overflow in urbdrc channel

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt integer addition on too narrow types leads to allocation of a buffer too small holding the data written. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2022-39319

Missing length validation in urbdrc channel in FreeRDP

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2022-39318

Division by zero in urbdrc channel in FreeRDP

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with division by zero. This issue has been addressed in version 2.9.0. All users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.

CVSS 3.1 · 4.8 Medium EPSS 1.3% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2022-39316

Out of bound read in FreeRDP

FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in the 2.9.0 release. Users are advised to upgrade.

CVSS 3.1 · 4.8 Medium EPSS 1.3% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2022-39283

FreeRDP may read and display out of bounds data

FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the `/video` switch.

CVSS 3.1 · 5.9 Medium EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2022-39282

RDP client: Read of uninitialized memory with parallel port redirection

FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.

CVSS 3.1 · 3.5 Low EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2022-2850

389-ds-base: SIGSEGV in sync_repl

A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Fedoraproject Port389 and 1 more
Products
Debian Linux Fedora 389-ds-base and 3 more
CVE-2021-41160

Improper region checks in FreeRDP allow out of bound write to memory

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0` width/height or out of bound rectangles to trigger out of bound writes. With `0` width or heigth the memory allocation will be `0` but the missing bounds checks allow writing to the pointer at this (not allocated) region. This issue has been patched in FreeRDP 2.4.1.

CVSS 3.1 · 5.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux and 1 more
CVE-2021-3621

sssd: shell command injection in sssctl

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 8.8 High EPSS 2.6% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Sssd Enterprise Linux and 7 more
CVE-2021-33646

libtar: memory leak found in th_read() function

The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Fedoraproject Feep Openatom and 1 more
Products
Fedora Libtar Openeuler and 1 more
CVE-2021-33645

libtar: memory leak found in th_read() function

The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Fedoraproject Feep Openatom and 1 more
Products
Fedora Libtar Openeuler and 1 more
CVE-2021-33644

libtar: out-of-bounds read in gnu_longname

An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.

CVSS 3.1 · 8.1 High EPSS 1.6% KEV · Not listed
Vendors
Fedoraproject Feep Openatom and 1 more
Products
Fedora Libtar Openeuler and 1 more
CVE-2022-23303

wpa_supplicant: SAE side channel attacks as a result of cache access patterns

The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.

CVSS 3.1 · 9.8 Critical EPSS 3.3% KEV · Not listed
Vendors
Fedoraproject Redhat W1.fi
Products
Fedora Enterprise Linux Hostapd and 1 more
CVE-2022-1122

openjpeg: segmentation fault in opj2_decompress due to uninitialized pointer

A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a segmentation fault and a denial of service.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 1 more