CVE-2022-1011

kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 3 more

Products

Debian Linux Fedora Linux Kernel and 36 more

CVE-2021-3669

kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts

A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Ibm and 2 more

Products

Debian Linux Fedora Spectrum Copy Data Management and 21 more

CVE-2017-15041

golang: arbitrary code execution during "go get" or "go get -d"

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

CVSS 3.1 · 9.8 Critical EPSS 8.9% KEV · Not listed

Vendors

Debian Golang Redhat

Products

Debian Linux Go Developer Tools and 6 more

CVE-2012-6153

CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.

CVSS 2.0 · 4.3 Medium EPSS 5.8% KEV · Not listed

Vendors

Apache Redhat

Products

Commons-httpclient Developer Toolset Jboss Bpms and 10 more

CVE-2012-5784

axis: missing connection hostname check against X.509 certificate name

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS 2.0 · 5.8 Medium EPSS 5.7% KEV · Not listed

Vendors

Apache Paypal Redhat

Products

Activemq Axis Mass Pay and 5 more

CVE-2019-9514

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

CVSS 3.1 · 7.5 High EPSS 82.8% KEV · Not listed

Vendors

Apache Apple Canonical and 10 more

Products

Traffic Server Mac Os X Swiftnio and 41 more

CVE-2022-27649

podman: Default inheritable capabilities for linux container should be empty

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Fedoraproject Podman Project Redhat

Products

Fedora Podman Developer Tools and 12 more

CVE-2022-1227

psgo: Privilege escalation in 'podman top'

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.

CVSS 3.1 · 8.8 High EPSS 4.2% KEV · Not listed

Vendors

Fedoraproject Podman Project Psgo Project and 1 more

Products

Fedora Podman Psgo and 16 more

CVE-2022-0330

kernel: possible privileges escalation due to missing TLB flush

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Netapp and 1 more

Products

Fedora Linux Kernel H300e and 49 more

CVE-2021-3744

kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()

A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 2 more

Products

Debian Linux Fedora Linux Kernel and 21 more

CVE-2021-3697

grub2: Crafted JPEG image can lead to buffer underflow write in the heap

A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be performed the attacker needs to perform some triage over the heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data corruption and eventual code execution or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Grub2 Codeready Linux Builder Developer Tools and 11 more

CVE-2021-3696

grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling

A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space. Confidentiality, Integrity and Availablity impact may be considered Low as it's very complex to an attacker control the encoding and positioning of corrupted Huffman entries to achieve results such as arbitrary code execution and/or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Netapp Redhat

Products

Grub2 Ontap Select Deploy Administration Utility Codeready Linux Builder and 12 more

CVE-2021-3695

grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap

A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent secure boot protections. This issue has a high complexity to be exploited as an attacker needs to perform some triage over the heap layout to achieve signifcant results, also the values written into the memory are repeated three times in a row making difficult to produce valid payloads. This flaw affects grub2 versions prior grub-2.12.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Gnu Netapp and 1 more

Products

Fedora Grub2 Ontap Select Deploy Administration Utility and 13 more

CVE-2019-9741

golang: CRLF injection in net/http

An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.

CVSS 3.1 · 6.1 Medium EPSS 2.2% KEV · Not listed

Vendors

Debian Fedoraproject Golang and 1 more

Products

Debian Linux Fedora Go and 3 more

CVE-2019-17596

golang: invalid public key causes panic in dsa.Verify

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

CVSS 3.1 · 7.5 High EPSS 4.7% KEV · Not listed

Vendors

Arista Debian Fedoraproject and 3 more

Products

Cloudvision Portal Eos Mos and 10 more

CVE-2019-16276

golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling

Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

CVSS 3.1 · 7.5 High EPSS 5.3% KEV · Not listed

Vendors

Debian Fedoraproject Golang and 3 more

Products

Debian Linux Fedora Go and 8 more

CVE-2018-16871

kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence

A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel Cloud Backup H300e and 28 more