CVE-2014-3564

gpgme: heap-based buffer overflow in gpgsm status handler

Multiple heap-based buffer overflows in the status_handler function in (1) engine-gpgsm.c and (2) engine-uiserver.c in GPGME before 1.5.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to "different line lengths in a specific order."

CVSS 2.0 · 6.8 Medium EPSS 4.3% KEV · Not listed

Vendors

Canonical Debian Gnu

Products

Ubuntu Linux Debian Linux Gpgme

CVE-2014-4043

glibc: posix_spawn_file_actions_addopen fails to copy the path argument

The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.

CVSS 2.0 · 7.5 High EPSS 3.9% KEV · Not listed

Vendors

Gnu Opensuse

Products

Glibc Opensuse

CVE-2014-4877

wget: FTP symlink arbitrary filesystem access

Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.

CVSS 2.0 · 9.3 Critical EPSS 39.9% KEV · Not listed

Vendors

Gnu Redhat

Products

Wget Enterprise Linux Rhel Eus

CVE-2014-5119

glibc: off-by-one error leading to a heap-based buffer overflow flaw in __gconv_translit_find()

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.

CVSS 2.0 · 7.5 High EPSS 17.0% KEV · Not listed

Vendors

Debian Gnu Redhat

Products

Debian Linux Glibc Enterprise Linux and 2 more

CVE-2014-6040

glibc: crash in code page decoding functions (IBM933, IBM935, IBM937, IBM939, IBM1364)

GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of "0xffff" to the iconv function when converting (1) IBM933, (2) IBM935, (3) IBM937, (4) IBM939, or (5) IBM1364 encoded data to UTF-8.

CVSS 2.0 · 5.0 Medium EPSS 6.6% KEV · Not listed

Vendors

Gnu Redhat

Products

Glibc Enterprise Linux

CVE-2014-6277

bash: uninitialized here document closing delimiter pointer use

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.

CVSS 2.0 · 10.0 Critical EPSS 64.3% KEV · Not listed

Vendors

Gnu

Products

Bash

CVE-2014-7186

bash: parser can allow out-of-bounds memory access while handling redir_stack

The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.

CVSS 2.0 · 10.0 Critical EPSS 64.3% KEV · Not listed

Vendors

Gnu Redhat

Products

Bash Enterprise Linux Rhel Els and 4 more

CVE-2014-7187

bash: off-by-one error in deeply nested flow control constructs

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

CVSS 2.0 · 10.0 Critical EPSS 58.5% KEV · Not listed

Vendors

Gnu Redhat

Products

Bash Enterprise Linux Rhel Els and 4 more

CVE-2014-7817

glibc: command execution in wordexp() with WRDE_NOCMD specified

The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Gnu and 2 more

Products

Ubuntu Linux Debian Linux Glibc and 2 more

CVE-2014-8121

glibc: Unexpected closing of nss_files databases after lookups causes denial of service

DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.

CVSS 2.0 · 5.0 Medium EPSS 5.6% KEV · Not listed

Vendors

Canonical Gnu Redhat and 1 more

Products

Ubuntu Linux Glibc Enterprise Linux and 2 more

CVE-2014-8155

gnutls: gnutls does not perform date/time checks on CA certificates

GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is (1) not yet valid or (2) no longer valid.

CVSS 2.0 · 4.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Enterprise Linux

CVE-2014-8484

binutils: invalid read flaw in libbfd

The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a small S-record.

CVSS 2.0 · 5.0 Medium EPSS 5.1% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 1 more

Products

Ubuntu Linux Fedora Binutils and 1 more

CVE-2014-8485

binutils: lack of range checking leading to controlled write in _bfd_elf_setup_sections()

The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file.

CVSS 2.0 · 7.5 High EPSS 7.5% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 1 more

Products

Ubuntu Linux Fedora Binutils and 1 more

CVE-2014-8501

binutils: out-of-bounds write when parsing specially crafted PE executable

The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable.

CVSS 2.0 · 7.5 High EPSS 5.2% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 1 more

Products

Ubuntu Linux Fedora Binutils and 1 more

CVE-2014-8502

binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file.

CVSS 2.0 · 7.5 High EPSS 4.9% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 1 more

Products

Ubuntu Linux Fedora Binutils and 1 more

CVE-2014-8503

binutils: stack overflow in objdump when parsing specially crafted ihex file

Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file.

CVSS 2.0 · 7.5 High EPSS 6.2% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 1 more

Products

Ubuntu Linux Fedora Binutils and 1 more

CVE-2014-8504

binutils: stack overflow in the SREC parser

Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted file.

CVSS 2.0 · 7.5 High EPSS 6.2% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 1 more

Products

Ubuntu Linux Fedora Binutils and 1 more

CVE-2014-8564

gnutls: Heap corruption when generating key ID for ECC (GNUTLS-SA-2014-5)

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.

CVSS 2.0 · 5.0 Medium EPSS 3.3% KEV · Not listed

Vendors

Canonical Gnu Opensuse and 1 more

Products

Ubuntu Linux Gnutls Opensuse and 5 more

CVE-2014-8737

binutils: directory traversal vulnerability

Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar.

CVSS 2.0 · 3.6 Low EPSS 1.0% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 1 more

Products

Ubuntu Linux Fedora Binutils and 1 more

CVE-2014-8738

binutils: out of bounds memory write

The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (invalid write, segmentation fault, and crash) via a crafted extended name table in an archive.

CVSS 2.0 · 5.0 Medium EPSS 5.2% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 2 more