CVE-2009-1883

kernel: missing capability check in z90crypt

The z90crypt_unlocked_ioctl function in the z90crypt driver in the Linux kernel 2.6.9 does not perform a capability check for the Z90QUIESCE operation, which allows local users to leverage euid 0 privileges to force a driver outage.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2009-1887

net-snmp: DoS (division by zero) via SNMP GetBulk requests

agent/snmp_agent.c in snmpd in net-snmp 5.0.9 in Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP GETBULK request that triggers a divide-by-zero error. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-4309.

CVSS 2.0 · 5.0 Medium EPSS 2.2% KEV · Not listed

Vendors

Net-snmp Redhat

Products

Net-snmp Enterprise Linux

CVE-2009-1888

Samba improper file access

The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory.

CVSS 2.0 · 5.8 Medium EPSS 4.6% KEV · Not listed

Vendors

Canonical Debian Redhat and 1 more

Products

Ubuntu Linux Debian Linux Enterprise Linux and 2 more

CVE-2009-1889

pidgin: DoS via specially-crafted ICQWebMessage

The OSCAR protocol implementation in Pidgin before 2.5.8 misinterprets the ICQWebMessage message type as the ICQSMS message type, which allows remote attackers to cause a denial of service (application crash) via a crafted ICQ web message that triggers allocation of a large amount of memory.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed

Vendors

Pidgin Redhat

Products

Pidgin Enterprise Linux

CVE-2009-1890

httpd: mod_proxy reverse proxy DoS (infinite loop)

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

CVSS 2.0 · 7.1 High EPSS 16.2% KEV · Not listed

Vendors

Apache Canonical Debian and 2 more

Products

Http Server Ubuntu Linux Debian Linux and 8 more

CVE-2009-1891

httpd: possible temporary DoS (CPU consumption) in mod_deflate

The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).

CVSS 2.0 · 7.1 High EPSS 17.1% KEV · Not listed

Vendors

Apache Canonical Debian and 2 more

Products

Http Server Ubuntu Linux Debian Linux and 9 more

CVE-2009-1893

dhcp: insecure temporary file use in the dhcpd init script

The configtest function in the Red Hat dhcpd init script for DHCP 3.0.1 in Red Hat Enterprise Linux (RHEL) 3 allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file, related to the "dhcpd -t" command.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Isc Redhat

Products

Dhcp Enterprise Linux

CVE-2009-1895

kernel: personality: fix PER_CLEAR_ON_SETID

The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr protection mechanism, or (3) defeat address space layout randomization (ASLR).

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 3 more

CVE-2009-1904

ruby: DoS vulnerability in BigDecimal

The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.

CVSS 2.0 · 5.0 Medium EPSS 12.8% KEV · Not listed

Vendors

Redhat Ruby-lang

Products

Enterprise Linux Ruby

CVE-2009-1932

gstreamer-plugins-good: PNG decoder integer overflow

Multiple integer overflows in the (1) user_info_callback, (2) user_endrow_callback, and (3) gst_pngdec_task functions (ext/libpng/gstpngdec.c) in GStreamer Good Plug-ins (aka gst-plugins-good or gstreamer-plugins-good) 0.10.15 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PNG file, which triggers a buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 5.5% KEV · Not listed

Vendors

Gstreamer Redhat

Products

Good Plug-ins Enterprise Linux

CVE-2009-1955

apr-util billion laughs attack

The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.

CVSS 3.1 · 7.5 High EPSS 53.0% KEV · Not listed

Vendors

Apache Apple Canonical and 5 more

Products

Apr-util Http Server Mac Os X and 8 more

CVE-2009-1956

apr-util single NULL byte buffer overflow

Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.

CVSS 2.0 · 6.4 Medium EPSS 12.0% KEV · Not listed

Vendors

Apache Canonical Redhat

Products

Apr-util Http Server Ubuntu Linux and 2 more

CVE-2009-2042

libpng: Interlaced Images Information Disclosure Vulnerability

libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.

CVSS 2.0 · 4.3 Medium EPSS 2.3% KEV · Not listed

Vendors

Libpng Redhat

Products

Libpng Enterprise Linux

CVE-2009-2185

Openswan ASN.1 parser vulnerability

The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.

CVSS 2.0 · 5.0 Medium EPSS 2.4% KEV · Not listed

Vendors

Redhat Strongswan Xelerance

Products

Enterprise Linux Strongswan Openswan

CVE-2009-2210

Thunderbird mail crash

Mozilla Thunderbird before 2.0.0.22 and SeaMonkey before 1.1.17 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a multipart/alternative e-mail message containing a text/enhanced part that triggers access to an incorrect object type.

CVSS 2.0 · 9.3 Critical EPSS 3.8% KEV · Not listed

Vendors

Mozilla Redhat

Products

Seamonkey Thunderbird Enterprise Linux

CVE-2009-2285

libtiff: LZWDecodeCompat underflow

Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327.

CVSS 2.0 · 4.3 Medium EPSS 8.9% KEV · Not listed

Vendors

Libtiff Redhat

Products

Libtiff Enterprise Linux

CVE-2009-2347

libtiff: integer overflows in various inter-color spaces conversion tools (crash, ACE)

Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.

CVSS 2.0 · 9.3 Critical EPSS 4.2% KEV · Not listed

Vendors

Libtiff Redhat

Products

Libtiff Enterprise Linux

CVE-2009-2404

nss regexp heap overflow

Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger (AIM), allows remote SSL servers to cause a denial of service (application crash) or possibly execute arbitrary code via a long domain name in the subject's Common Name (CN) field of an X.509 certificate, related to the cert_TestHostName function.

CVSS 2.0 · 9.3 Critical EPSS 4.2% KEV · Not listed

Vendors

Aol Gnome Mozilla and 2 more

Products

Instant Messenger Evolution Firefox and 6 more

CVE-2009-2406

kernel: ecryptfs stack overflow in parse_tag_11_packet()

Stack-based buffer overflow in the parse_tag_11_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to not ensuring that the key signature length in a Tag 11 packet is compatible with the key signature buffer size.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Kernel Linux Kernel Enterprise Linux and 1 more

CVE-2009-2407

kernel: ecryptfs heap overflow in parse_tag_3_packet()

Heap-based buffer overflow in the parse_tag_3_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to a large encrypted key size in a Tag 3 packet.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus