CVE-2024-3651

Denial of Service via Quadratic Complexity in kjd/idna

A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Kjd Redhat

Products

Internationalized Domain Names In Applications Ansible Automation Platform Enterprise Linux and 5 more

CVE-2024-27316

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

CVSS 3.1 · 7.5 High EPSS 88.8% KEV · Not listed

Vendors

Apache Fedoraproject Netapp and 1 more

Products

Http Server Fedora Ontap and 4 more

CVE-2023-42465

sudo: Targeted Corruption of Register and Stack Variables

Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Redhat Sudo Project

Products

Enterprise Linux Openshift Data Foundation Rhel Eus and 1 more

CVE-2023-44444

GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability

GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22097.

CVSS 3.1 · 7.8 High EPSS 56.1% KEV · Not listed

Vendors

Gimp Redhat

Products

Gimp Enterprise Linux Rhel Aus and 4 more

CVE-2023-44442

GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-22094.

CVSS 3.1 · 7.8 High EPSS 61.2% KEV · Not listed

Vendors

Gimp Redhat

Products

Gimp Enterprise Linux Rhel Aus and 4 more

CVE-2023-44441

GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DDS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22093.

CVSS 3.1 · 7.8 High EPSS 27.3% KEV · Not listed

Vendors

Gimp Redhat

Products

Gimp Enterprise Linux Rhel Eus

CVE-2023-40403

libxslt: Processing web content may disclose sensitive information

The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 4 more

CVE-2023-1018

TPM2.0 vulnerable to out-of-bounds read

An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM.

CVSS 3.1 · 5.5 Medium EPSS 5.6% KEV · Not listed

Vendors

Microsoft Redhat Trustedcomputinggroup

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 11 more

CVE-2023-1017

TPM2.0 vulnerable to out-of-bounds write

An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed

Vendors

Microsoft Redhat Trustedcomputinggroup

Products

Windows 10 1507 Windows 10 1607 Windows 10 1809 and 11 more

CVE-2023-0401

NULL dereference during PKCS7 data verification

A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Openssl Redhat Stormshield

Products

Openssl Enterprise Linux Rhel Eus and 1 more

CVE-2023-0217

NULL dereference validating DSA public key

An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Rhel Eus

CVE-2023-0216

Invalid pointer dereference in d2i_PKCS7 functions

An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Openssl Redhat Stormshield

Products

Openssl Enterprise Linux Rhel Eus and 1 more

CVE-2022-4203

X.509 Name Constraints Read Buffer Overflow

A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. The read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.

CVSS 3.1 · 4.9 Medium EPSS 1.4% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Rhel Eus

CVE-2020-25687

dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled

A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.9 Medium EPSS 89.3% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 2 more

CVE-2020-25686

dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker

A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the "Birthday Attacks" section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.

CVSS 3.1 · 3.7 Low EPSS 5.5% KEV · Not listed

Vendors

Arista Debian Fedoraproject and 2 more

Products

Eos Debian Linux Fedora and 7 more

CVE-2020-25685

dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker

A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.

CVSS 3.1 · 3.7 Low EPSS 2.2% KEV · Not listed

Vendors

Arista Debian Fedoraproject and 2 more

Products

Eos Debian Linux Fedora and 7 more

CVE-2020-25684

dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker

A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.

CVSS 3.1 · 3.7 Low EPSS 4.2% KEV · Not listed

Vendors

Arista Debian Fedoraproject and 2 more

Products

Eos Debian Linux Fedora and 7 more

CVE-2020-25683

dnsmasq: heap-based buffer overflow with large memcpy in get_rdata() when DNSSEC is enabled

A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.9 Medium EPSS 88.8% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 2 more

CVE-2020-25682

dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled

A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.1 High EPSS 75.1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 2 more

CVE-2020-25681

dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled

A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.1 High EPSS 84.1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 2 more