Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,088

Export CSV
CVE-2023-32324

OpenPrinting CUPS vulnerable to heap buffer overflow

OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function `format_log_line` could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file `cupsd.conf` sets the value of `loglevel `to `DEBUG`. No known patches or workarounds exist at time of publication.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Debian Openprinting Redhat
Products
Debian Linux Cups Enterprise Linux and 1 more
CVE-2023-32254

Tree connection race condition remote code execution vulnerability

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.

CVSS 3.1 · 9.8 Critical EPSS 2.9% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel H300s H410s and 4 more
CVE-2023-32250

Session race condition remote code execution vulnerability

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.

CVSS 3.1 · 9 Critical EPSS 2.6% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel H300s H410s and 5 more
CVE-2023-32067

0-byte UDP payload DoS in c-ares

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
C-ares C-ares Project Debian and 2 more
Products
C-ares C-ares Debian Linux and 7 more
CVE-2023-31147

Insufficient randomness in generation of DNS query IDs in c-ares

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
C-ares Project Fedoraproject Redhat
Products
C-ares Fedora Enterprise Linux and 2 more
CVE-2023-29409

Large RSA keys can cause high CPU usage in crypto/tls

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.

CVSS 3.1 · 5.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Golang Redhat
Products
Go Ansible Automation Platform Cert Manager and 17 more
CVE-2023-29406

Insufficient sanitization of Host header in net/http

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Golang Redhat
Products
Go Advanced Cluster Security Cryostat and 16 more
CVE-2023-29403

Unsafe behavior in setuid/setgid binaries in runtime

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Go Devtools and 1 more
CVE-2023-29402

Code injection via go command with cgo in cmd/go

The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).

CVSS 3.1 · 9.8 Critical EPSS 1.7% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Go Ceph Storage and 2 more
CVE-2023-28856

`HINCRBYFLOAT` can be used to crash a redis-server process

Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Acm and 2 more
CVE-2023-2828

named's configured cache size limit can be significantly exceeded

Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit. It has been discovered that the effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.

CVSS 3.1 · 7.5 High EPSS 3.7% KEV · Not listed
Vendors
Debian Fedoraproject Isc and 2 more
Products
Debian Linux Fedora Bind and 16 more
CVE-2023-28198

webkitgtk: use after free vulnerability

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.4 and iPadOS 16.4, macOS Ventura 13.3. Processing web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apple Redhat Webkitgtk and 1 more
Products
Ipados Iphone Os Macos and 4 more
CVE-2023-28100

TIOCLINUX can send commands outside sandbox if running on a virtual console

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is primarily designed to be used in a Wayland or X11 graphical environment.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Flatpak Redhat
Products
Flatpak Enterprise Linux
CVE-2023-2680

Dma reentrancy issue (incomplete fix for cve-2021-3750)

This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Advanced Virtualization Enterprise Linux and 1 more
CVE-2023-25588

Field `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab`

A flaw was found in Binutils. The field `the_bfd` of `asymbol`struct is uninitialized in the `bfd_mach_o_get_synthetic_symtab` function, which may lead to an application crash and local denial of service.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Binutils Enterprise Linux
CVE-2023-25586

Local variable `ch_type` in function `bfd_init_section_decompress_status` can be uninitialized

A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Binutils Enterprise Linux
CVE-2023-25585

Field `file_table` of `struct module *module` is uninitialized

A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Binutils Enterprise Linux
CVE-2023-25584

Out of bounds read in parse_module function in bfd/vms-alpha.c

An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Binutils Enterprise Linux
CVE-2023-24805

Command injection in cups-filters

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use the Backend Error Handler (beh) to create an accessible network printer, this security vulnerability can cause remote code execution. `beh.c` contains the line `retval = system(cmdline) >> 8;` which calls the `system` command with the operand `cmdline`. `cmdline` contains multiple user controlled, unsanitized values. As a result an attacker with network access to the hosted print server can exploit this vulnerability to inject system commands which are executed in the context of the running server. This issue has been addressed in commit `8f2740357` and is expected to be bundled in the next release. Users are advised to upgrade when possible and to restrict access to network printers in the meantime.

CVSS 3.1 · 8.8 High EPSS 3.7% KEV · Not listed
Vendors
Debian Fedoraproject Linuxfoundation and 1 more
Products
Debian Linux Fedora Cups-filters and 5 more