CVE-2017-0358

ntfs-3g: Modprobe influence vulnerability via environment variables

Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.

CVSS 3.1 · 7.8 High EPSS 2.2% KEV · Not listed

Vendors

Debian Tuxera

Products

Debian Linux Ntfs-3g

CVE-2017-13687

tcpdump: Buffer over-read in print-chdlc.c:chdlc_print() in Cisco HDLC parser

The Cisco HDLC parser in tcpdump before 4.9.2 has a buffer over-read in print-chdlc.c:chdlc_print().

CVSS 3.1 · 9.8 Critical EPSS 3.3% KEV · Not listed

Vendors

Debian Redhat Tcpdump

Products

Debian Linux Enterprise Linux Tcpdump

CVE-2017-9022

strongswan: Insufficient validation of RSA public keys passed to the gmp plugin

The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers to cause a denial of service (floating point exception and process crash) via a crafted certificate.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed

Vendors

Canonical Debian Strongswan

Products

Ubuntu Linux Debian Linux Strongswan

CVE-2017-5130

chromium-browser: heap overflow in libxml2

An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.

CVSS 3.1 · 8.8 High EPSS 2.7% KEV · Not listed

Vendors

Debian Google Redhat and 1 more

Products

Debian Linux Chrome Rhel Extras and 1 more

CVE-2018-16152

strongswan: authentication bypass in verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c

In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. This is a variant of CVE-2006-4790 and CVE-2014-1568.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed

Vendors

Canonical Debian Strongswan

Products

Ubuntu Linux Debian Linux Strongswan

CVE-2018-16151

strongswan: authentication bypass in verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c

In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data after the encoded algorithm OID during PKCS#1 v1.5 signature verification. Similar to the flaw in the same version of strongSwan regarding digestAlgorithm.parameters, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed

Vendors

Canonical Debian Strongswan

Products

Ubuntu Linux Debian Linux Strongswan

CVE-2018-14882

tcpdump: Buffer over-read in function rpl_dio_printopt in print-icmp6.c

The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c.

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed

Vendors

Apple Debian F5 and 4 more

Products

Mac Os X Debian Linux Traffix Signaling Delivery Controller and 4 more

CVE-2018-14881

tcpdump: Buffer over-read in bgp_capabilities_print() function in print-bgp.c

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART).

CVSS 3.1 · 9.8 Critical EPSS 4.8% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 3 more

Products

Mac Os X Debian Linux Fedora and 3 more

CVE-2018-14879

tcpdump: Out of bounds read/write in in get_next_file() in tcpdump.c

The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:get_next_file().

CVSS 3.1 · 7 High EPSS 4.7% KEV · Not listed

Vendors

Apple Debian F5 and 4 more

Products

Mac Os X Debian Linux Traffix Signaling Delivery Controller and 4 more

CVE-2018-14470

tcpdump: Buffer over-read in babel_print_v2() in print-babel.c

The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2().

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 3 more

Products

Mac Os X Debian Linux Fedora and 3 more

CVE-2018-14468

tcpdump: Buffer over-read in mfr_print() function in print-fr.c

The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print().

CVSS 3.1 · 7.5 High EPSS 4.0% KEV · Not listed

Vendors

Apple Debian F5 and 4 more

Products

Mac Os X Debian Linux Big-ip Access Policy Manager and 20 more

CVE-2018-14467

tcpdump: Buffer over-read in bgp_capabilities_print() in print-bgp.c

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 3 more

Products

Mac Os X Debian Linux Fedora and 3 more

CVE-2018-14462

tcpdump: Buffer over-read in icmp_print() function in print-icmp.c

The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Apple Debian F5 and 4 more

Products

Mac Os X Debian Linux Traffix Signaling Delivery Controller and 4 more

CVE-2018-14461

tcpdump: Buffer over-read in ldp_tlv_print() function in print-ldp.c

The LDP parser in tcpdump before 4.9.3 has a buffer over-read in print-ldp.c:ldp_tlv_print().

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 3 more

Products

Mac Os X Debian Linux Fedora and 3 more

CVE-2018-16451

tcpdump: Buffer over-read in print_trans() function in print-smb.c

The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIPE\LANMAN.

CVSS 3.1 · 9.8 Critical EPSS 4.0% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 3 more

Products

Mac Os X Debian Linux Fedora and 3 more

CVE-2018-16230

tcpdump: Buffer over-read in bgp_attr_print() function in print-bgp.c

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 3 more

Products

Mac Os X Debian Linux Fedora and 3 more

CVE-2018-16228

tcpdump: Access to uninitialized buffer in print_prefix() function in print-hncp.c

The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix().

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 3 more

Products

Mac Os X Debian Linux Fedora and 3 more

CVE-2019-15166

lmp_print in tcpdump lacks certain boundary checks

lmp_print_data_link_subobjs() in print-lmp.c in tcpdump before 4.9.3 lacks certain bounds checks.

CVSS 3.1 · 1.6 Low EPSS 4.8% KEV · Not listed

Vendors

Apple Canonical Debian and 5 more

Products

Mac Os X Ubuntu Linux Debian Linux and 7 more

CVE-2019-15165

libpcap: Resource exhaustion during PHB header length validation

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.

CVSS 3.1 · 5.3 Medium EPSS 2.8% KEV · Not listed

Vendors

Apple Canonical Debian and 5 more

Products

Ipados Iphone Os Mac Os X and 9 more

CVE-2020-8597

ppp: Buffer overflow in the eap_request and eap_response functions in eap.c

eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

CVSS 3.1 · 9.8 Critical EPSS 19.9% KEV · Not listed

Vendors

Canonical Debian Point-to-point Protocol Project and 2 more

Products

Ubuntu Linux Debian Linux Point-to-point Protocol and 5 more