Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2023-45871

kernel: IGB driver inadequate buffer size for frames larger than MTU

An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 6 more
CVE-2023-45863

kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write

An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2023-40283

kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c

An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 6 more
CVE-2023-39615

libxml2: crafted xml can cause global buffer overflow

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Enterprise Linux Jboss Core Services Openshift and 3 more
CVE-2023-38408

openssh: Remote code execution in ssh-agent PKCS#11 support

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

CVSS 3.1 · 9.8 Critical EPSS 79.7% KEV · Not listed
Vendors
Fedoraproject Openbsd Redhat
Products
Fedora Openssh Devworkspace and 6 more
CVE-2023-37453

kernel: usb: out-of-bounds read in read_descriptors

An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in drivers/usb/core/sysfs.c.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2023-35945

Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Envoyproxy Nghttp2 Redhat
Products
Envoy Nghttp2 Service Mesh
CVE-2023-35001

Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability

Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace

CVSS 3.1 · 7.8 High EPSS 1.5% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 2 more
Products
Debian Linux Fedora Linux Kernel and 12 more
CVE-2023-34969

dbus: dbus-daemon: assertion failure when a monitor is active and a message from the driver cannot be delivered

D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Freedesktop and 1 more
Products
Debian Linux Fedora Dbus and 2 more
CVE-2023-32665

Gvariant deserialisation does not match spec for non-normal data

A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Glib Enterprise Linux
CVE-2023-32636

glib: Timeout in fuzz_variant_text

A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Glib Enterprise Linux
CVE-2023-32611

G_variant_byteswap() can take a long time with some non-normal inputs

A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Glib Enterprise Linux
CVE-2023-32233

kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege escalation

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.

CVSS 3.1 · 7.8 High EPSS 13.4% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel Hci Baseboard Management Controller Enterprise Linux and 6 more
CVE-2023-7104

SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.

CVSS 3.1 · 5.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Redhat Sqlite
Products
Fedora Enterprise Linux Openshift and 3 more
CVE-2023-31436

kernel: out-of-bounds write in qfq_change_class function

qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Aus and 6 more
CVE-2023-29499

Gvariant offset table entry size is not checked in is_normal()

A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Glib Enterprise Linux
CVE-2023-29491

ncurses: Local users can trigger security-relevant memory corruption via malformed data

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Invisible-island Redhat
Products
Ncurses Enterprise Linux Rhel Eus
CVE-2023-29469

libxml2: Hashing of empty dict strings isn't deterministic

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Redhat Xmlsoft
Products
Debian Linux Enterprise Linux Jboss Core Services and 2 more
CVE-2023-27538

curl: SSH connection too eager reuse still

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.

CVSS 3.1 · 7.7 High EPSS 1.5% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 4 more
Products
Brocade Fabric Operating System Firmware Debian Linux Fedora and 13 more