6.9.3 Yellowbrick Release Notes
Release Version: 6.9.3-8785.f60b9318
Release Date: 8/28/2024
Yellowbrick Data Warehouse Version 6.9.3 is supported for AWS and Microsoft Azure cloud deployments. This version of Yellowbrick Data Warehouse is installed on Cloud Data Warehouse Manager (CDWM) Version 3.69.3.
Cloud Provider | CDWM Version | Yellowbrick Data Warehouse Version | Kubernetes Version |
---|---|---|---|
AWS | 3.69.3-1433.07baae08 | 6.9.3-8558.0e5a282c | EKS 1.28 |
Azure | 3.69.3-1433.07baae08 | 6.9.3-8558.0e5a282c | AKS 1.28 |
Upgrade Requirements
Read the following information before beginning an upgrade to Version 6.9.3:
- Contact Customer Support to review the process and schedule the upgrade.
- Only upgrades from Version 6.9.2 to 6.9.3 are supported. These upgrades apply to both CDWM and data warehouse instances.
- YBD Instances and cluster must be running and not suspended before being upgraded.
- Existing installations using the standard installation method can only be upgraded using the standard method. Similarly, installations using the offline method must be upgraded using the same offline method. Cross-method upgrades are not supported.
Note: The default cluster must be up and running before attempting to upgrade data warehouse instances. You cannot upgrade suspended instances.
AWS Upgrades from Version 6.9.2
For version 6.9.3, EKS version has been changed from 1.27 to 1.28.
Before beginning the CDWM upgrade, suspend all instances managed by the CDWM.
Push the CDWM and YBD images to the AWS ECR and check that the required files are in the S3 bucket.
Note: The following step is done for EKS upgrade as well as CDWM upgrade. Before upgrading EKS, On Demand Capacity Reservation (ODCR) must be completed. ODCR is necessary whenever there is an EKS upgrade or a node image change. As the EKS version is changing and we are updating the node image for the current release, ODCR is required.
In AWS CloudFormation > Stacks, search for your root stack for your installation; click update and then
Select
Replace current template
and update the Amazon S3 URL to point to the location of the yb-cdw.template.yaml file for the 3.69.3-1433.07baae08 build.Update and verify information on stack details page.
In the
Yellowbrick software
section, the URL for the chart repository and CloudFormation S3 key prefix must be updated.On the final review page, confirm that the only changes or overrides will be to the CFS3KeyPrefix and ChartRepository values. All other key values remain the same.
Note: If in the user's environment, the user has created a Scaled Instance, then the user should select Scaled in the Shared Services Type.
Submit to start the deployment process and once it completes verify that the CDWM is reporting the correct version of 3.69.3-1433.07baae08 in the Yellowbrick manager UI, Configuration->Warehouse Manager section.
Once the upgrade of the CDWM to version 3.69.3-1433.07baae08 is completed each of the YBD instances will also need to be upgraded to 6.9.3-8558.0e5a282c using the Upgrade option in the Configuration->Instances page on the Yellowbrick manager UI.
Azure Upgrades from Version 6.9.2
Upgrade from versions prior to 6.9.2 are not supported. Please follow instructions to upgrade to 6.9.2 prior to proceeding with this upgrade. Note that version 6.9.2 includes AKS version 1.28.
Note: Please update variables and settings for your environment including URL to the files.
Before beginning the CDWM upgrade, suspend all instances managed by the CDWM. Ensure that all the worker nodes are not running.
Push the CDWM and YBD images to the Azure ACR and check that the required files are in the Azure Storage Account Container. Azure upgrade involves:
Note: The manual scaling of nodepools will cause the configuration of the nodepool to get reset, and break the ability to spin up worker clusters. This is not supported and must not be attempted.
Upgrades from Version 5.x (Not Supported)
You cannot upgrade from Version 5.x to Version 6. However, you can replicate databases from some older releases to Version 6; see BAR2 and Replication Compatibility.
Changes in Behavior in This Version
- 6.9.0
SMC global retention feature removed in favor of individual SQL policy
The global retention setting in System Management Console has been removed. Retention settings can still be changed via SQL on a per-table basis. See Retention Policies for System Relations for more details.
- 6.8.0
RETENTION_AGE and RETENTION_SIZE are now reserved words
With the new feature regarding Retention Policy on System Objects,
RETENTION_AGE
andRETENTION_SIZE
had to be added as reserved words.To use them as identifiers in SQL statements, they will need to be quoted. See the Reserved Words for the complete list.
- 6.7.0
Azure has new limits on node group maximums
This change from Azure will reduce the maximum number of nodes as follows:
Type Maximum inst32 10 inst48 10 compiler 10 bulk 50 large worker 125 small worker 125 controller 10(default) system 10(default) - 6.3.0
Default Time Zone for Data Warehouse Instances
In Version 6.3.0, the timezone and log_timezone configuration settings default to UTC for all new data warehouse instances.
- 6.3.0
Behavior of the CHAR Data Type
The CHAR data type implementation has changed in Version 6.x. The pg_char_compatibility_mode parameter is now set to FULL and cannot be set to any other value. See Upcoming Behavioral Changes to the CHAR Data Type.
- 6.3.0
Default Behavior of WLM Restart Rules
By default, a subset of recoverable error codes triggers an attempted restart, and an attempted restart occurs only once per query. For details, see Restarting Queries.
Changes in Compatibility in This Version
- 6.7.0
Client tools tzdata compatibility
When executing ybload and load table SQL, the outcome of loading a timestamp with timezone data to a timestamp column may vary based on the tzdata version. Differences between the JRE’s tzdata version and the Yellowbrick database’s tzdata version can lead to inconsistencies between timestamp directly inserted into the database and those loaded using ybload or load table SQL.
For example, in the case of JRE with tzdata version 2022b, Chile's Daylight Saving Time (DST) transition is delayed by a week in September 2022. As a result, a timestamp such as 04-09-2022 12:00:00 Chile/Continental might be directly inserted into the database as 2022-04-09 15:00:00+00 while being loaded as 2022-04-09 16:00:00+00 due to differences in timezone conversions.
It is recommended to check tzdata version used JRE in the environment, using the tzupdater tool provided by Oracle.
- 6.7.0
ybtools Compatibility
Yellowbrick recommends that you always upgrade ybtools to match the Yellowbrick server version you are running (for example, upgrade to ybtools Version 6.7 before connecting to a Version 6.7 data warehouse). In most cases, using an older version of ybtools, such as 6.6, to connect to a Version 6.7 Data Warehouse will work but is not recommended.
Using Version 6.7 of ybtools with an older server version (such as Version 6.6) may result in error messages for some commands or a mismatch between client and server features.
Important:
On CentOS and Red Hat client platforms, you must first remove any existing 5.x version of ybtools. Then you can proceed with the installation of the Version 6.0 ybtools. You cannot upgrade directly from an earlier 5.x version of ybtools to Version 6.0. - 6.7.0
BAR2 and Replication Compatibility
Important: The source and target systems used for database backup and restore (BAR2) and database replication must be compatible. To support full functionality, the source and target systems should both be running a 6.7 version of Yellowbrick software.
Nonetheless, you can back up and restore a database, or replicate a database, from:
- 5.2.x to 6.5.x
- 5.4.3 or later to 6.5.x
- 6.1.x to 6.5.x
- 6.2.x to 6.5.x
- 6.3.x to 6.5.x
- 6.4.x to 6.5.x
- 6.5.x to 6.6.x
Although you can start replication from a 5.2, 5.4, 6.1, 6.2... or 6.6 source to a 6.7 target, and you can fail over to the 6.7 target, you cannot fail back to the 5.2, 5.4, 6.1, 6.2, 6.3, 6.4 or 6.6 source. In general, you cannot fail back to a Yellowbrick version with a catalog version that is earlier than the current catalog version.
What's New in This Version
- 6.9.3
Federal Information Processing Standard (FIPS)
To enable FIPS for Yellowbrick software, please contact support team.
- 6.9.0
Use network data compression techniques to minimize the data distributed between compute nodes
Reduce the amount of data distributed between compute nodes via network data compression techniques. Workloads that result in heavy distribution of data across compute nodes might benefit from this feature. This can be enabled via a new boolean GUC “enable_rowpacket_compression_in_distribution”.
- 6.9.0
Ybunload Option (--header) to Include Column Headers in CSV/TEXT Mode
Ybunload client tool supports new option
--header
that includes column headers in generated CSV/TEXT.- Support sql column aliases.
- Support customization options with
--quote
,--quote-escape
and--delimiter
. - Support uncompressed and
gzip
block compression modes (gzip_stream
is not yet supported). - Advanced conflict resolution for column names with
--column-prefix
,--disable-column-aliases
,--disable-column-names
.
Yellowbrick database must be updated to version 5.4.0 or above to use this feature
- 6.9.0
Increase the column limit for views and select queries to 8000
Views and
SELECT
queries can now have up to 8000 columns, from 2000. Other database limits are still the same, notably:- the maximum number of columns in a table is still 2000.
- the maximum row size is still 64231 bytes.
- 6.8.0
Retention Policy for System Relations
Retention policies can be applied on some of the growing system relations to limit their maximum size.
See Retention Policies for System Relations for more details.
- 6.8.0
Parquet support to INT96 timestamp values
Interpret
INT96
data (without a logical type) as a timestamp to provide compatibility with third-party systems, such as Impala, Hive and Spark. New option toybload
:console--int96-as-timestamp (default) --no-int96-as-timestamp
- 6.8.0
Automatic download of diagnostics bundles
The diagnostics bundles are now available to download automatically from the YB manager UI, once the job is completed.
- 6.8.0
Various view changes
New storage for views
Starting with 6.8.0 the exact statement used is saved when creating a view. Views have now two possible representation format:
TEXT
introduced in 6.8.0: store the exact statement used to create the view.BINARY
former one: store an intermediate binary representation of the view.
Frontend view
Views can now use fronted tables and views. The restriction for mixed queries are now the same for views and selects statements.
consoleyellowbrick=# create view v as select u.name owner_name, s.name schema_name from sys.schema s join sys.user u on s.owner_id = u.user_id; CREATE VIEW yellowbrick=# select * from v; owner_name | schema_name ----------------------------------+-------------------------------- yellowbrick | sc1 yellowbrick | sc2
Describe functions
The following functions now use the new representation if available:
pg_get_viewdef
\d
describe with ddl
ybdumpschema
The full statement used to create a view can now be displayed using the new function
pg_get_viewddl
.consoleyellowbrick=# select pg_get_viewdef('v'); pg_get_viewdef ----------------------------------------------------------------------------------------------------------- select u.name owner_name, s.name schema_name from sys.schema s join sys.user u on s.owner_id = u.user_id; (1 row) yellowbrick=# select pg_get_viewddl('v'); pg_get_viewddl ---------------------------------------------------------------------------------------------------------------------------- create view v as select u.name owner_name, s.name schema_name from sys.schema s join sys.user u on s.owner_id = u.user_id; (1 row) yellowbrick=#
New type checking
Views created within the new format will now raise an error if the column output type does not match the one stored in the view definition when used.
Format change
Views created before 6.8.0 are only stored in binary format. Views created after 6.8.0 use the new text format by default but can be reverted to the old representation using ALTER VIEW.
Correct latebounded behavior for string to oid literal casts
String to oid casts (
'table_name'::regclass
) are now evaluated at view usage instead of view creation. - 6.7.0
Java version update to Java 11, bug fixes
Version 6.7.0 provides critical bug fixes. Java 11 is the minimum required java version for Java based client tools. Please refer to Installing JRE. Please see issues fixed in this version.
- 6.6.0
Offline Installer
This provides an installer that allows customers installing into networks with no public internet access.
Commands
- load
-
This command must first be ran to load all the container images into the local docker registry from the images.tgz file.
./ybdsw load
This should result in all containers in images.tgz to be loaded into local docker registry.
- push
-
This command will push the resources into the specified customer locations ready for install
Options
- AWS
-
Instructions for Amazon Web Services cloud environments
-a auto create the s3 bucket -c aws ecr s3-bucket region ./ybdsw push -a -c aws 123456789.dkr.ecr.us-east-2.amazonaws.com ybd-data us-east-2
- Azure
-
Instructions for Microsoft Azure cloud environments
-a auto create the storage account -c azure acr storage-container region resource-group ./ybdsw push -a -c azure 123456789.azurecr.io ybd-data eastus my-resource-group
Example
The result of this would appear as:
S3 Bucket contents: 2023-08-23 20:26:45 11350 cdw/3-65-12-527-06079e02/functions/LICENSE.txt 2023-08-23 20:26:45 549 cdw/3-65-12-527-06079e02/functions/NOTICE.txt 2023-08-28 17:16:28 503 cdw/3-65-12-527-06079e02/functions/packages/CleanupLambdas/lambda.zip 2023-08-28 17:16:29 1797 cdw/3-65-12-527-06079e02/functions/packages/CleanupLoadBalancers/lambda.zip 2023-08-28 17:16:29 1209 cdw/3-65-12-527-06079e02/functions/packages/CleanupSecurityGroupDependencies/lambda.zip 2023-08-28 17:16:31 17003610 cdw/3-65-12-527-06079e02/functions/packages/awscliLayer/lambda.zip . . . Repositories: "repositoryUri": "123456789.dkr.ecr.us-east-2.amazonaws.com/yellowbrick/ybd-worker", "repositoryUri": "123456789.dkr.ecr.us-east-2.amazonaws.com/grafana/loki", "repositoryUri": "123456789.dkr.ecr.us-east-2.amazonaws.com/yellowbrick/ybd-mgr", . . . "repositoryUri": "123456789.dkr.ecr.us-east-2.amazonaws.com/csi-secrets-store/driver", "repositoryUri": "123456789.dkr.ecr.us-east-2.amazonaws.com/kiwigrid/k8s-sidecar",
Use the http URL for the
cdw/3-65-12-527-06079e02/templates/yb-cdw.template.yaml
in the Cloud Formation install - 6.3.0
Standard or Scaled Shared Services
Version 6.3 on AWS gives customers the flexibility to install Yellowbrick into a smaller cloud hardware footprint. The Standard Shared Services option creates fewer AWS node groups to run Yellowbrick software. The Scaled Shared Services option is intended for larger data warehouse environments that anticipate more than 100 active users and need more than 5TB of primary data storage.
This feature is supported on AWS only; it is not yet supported for Azure deployments.
- 6.3.0
Proxy Support for Azure Deployments
During Yellowbrick deployment on Azure, you can set options to route AKS-required network traffic through HTTP/HTTPS proxies.
- 6.3.0
ybtools Clients on Ubuntu
Version 6.3.0 supports ybtools on Ubuntu 16.04 LTS, 18.04 LTS, and 20.04 LTS.
Known Issues in This Version
You may encounter the following issues in Version 6.9.3. Use the workarounds provided in the description and contact Customer Support for additional information.
Issue # | Description |
---|---|
26340 | Aborted or cancelled executions of ybload or LOAD TABLE against an Azure Storage may leave parts from multi-part uploads on the storage account. |
31195 |
|
31293 | Query details requires default cluster to be up and running; inability to use arbitrary cluster from the dropdown. |
31290 | Query history information may not get rendered if there isn't a default cluster running. |
34570 | Kubelet does not respect container-log-max-size on time, during heavy log writes from container. |
Issues Fixed in This Version
The following issues are addressed in this version:
Release | Issue # | Description |
---|---|---|
6.9.3 | 36374 | Fixed the WriteKRI RPC call to support KRI lists greater than 2 MB. Prior to this fix, sending such a large list would cause the worker to terminate, killing all running queries. This issue typically arose from deleting or updating a significant number of shards in a single statement. |
6.9.3 | 36259, 36799 | Fixed a DB frontend crash related to the usage of an incorrect memory context after aborting a query execution. |
6.9.3 | 36863 | Fixed an issue with CREATE REMOTE SERVER that ignore NOHOSTNAMECHECK option. |
6.9.2 | 36511 | Fixed an issue when running a single table restore for a table DDL with the cluster on. |
6.9.2 | 36691 | Upgraded ybtoken’s logging from log4j-1.2.17 to log4j2, which is used by ybtoken, to address several high priority CVEs. |
6.9.2 | 36262 | Fixed an issue with native memory leak held by ssl connection callbacks. This affects databases that establish many ssl connections for replication, backup or restore and load or unload. |
6.9.1 | 34587 | Support for NPGSQL 7.x and 8.x. |
6.9.1 | 35025 | In some cases of data reconstruction using parity, inter-query race conditions would lead to compute workers crashing because the parity solution employed overly stringent conditions for correctness verification. These conditions have now been relaxed to match the actual requirements. |
6.9.1 | 35403 | Resolved an issue on Azure where certain compute nodes failed to initialize properly. The problem stemmed from a race condition related to the specific number of network interfaces not being fully up and ready when the node was marked as available. This led to a failure in configuring the network setup, rendering the node correctly available but incapable of running the compute worker. The fix involves addressing the race condition by implementing a mechanism to ensure we wait for all interfaces to be up before completing the setup process. |
6.9.1 | 33814 | Fixed an error condition in the usage of the extended DB protocol that caused |
6.9.1 | 35774 | Fixed a rare crash for |
6.9.0 | 35704 | Fixed an issue where Ybunload could not complete multipart upload, when unloading parquet to Azure Data Lake Storage Gen2. |
6.9.0 | 34140 | Improved support for decorrelating operators mixing correlated and uncorrelated expressions on both sides. For instance:
|
6.9.0 | 34286 | Fixed case when a |
6.9.0 | 33162 | The issue of YB backup failing when executed on a Disaster Recovery system concurrently with a replication cycle has been fixed. |
6.9.0 | 35241 | Fixed issue where an internal cache could grow above the defined capacity, resulting in potential memory issues and timing differences between query executions. |
6.9.0 | 33228 | Fixed issue with the values of the columns |
6.9.0 | 27006 | Fixed issue where manually stopping the lime service may fail because of low memory resources. |
6.9.0 | 33988 | The crash caused by an excessive number of open files or exceeding direct memory has been fixed. |
6.9.0 | 34537 | Fixed an issue by simplifying away explicit cast to same type when using operations on the decimal type that would cause the wrong precision/scale for the output. |
6.9.0 | 34243 | Adhere to IEEE754 standard when comparing floats against NaN values. |
6.9.0 | 33343 | Improved force cancellation of queries containing regular expressions that affect system stability. |
6.8.1 | 35059 | Create configurable truststore for keycloak with default cacerts as initial content. |
6.8.1 | 3496 | Fix the base diags to speed up collection of the node-specific logs. |
6.8.0 | 34187 | Diagnostics collection may fail if the selected time window is large. |
6.8.0 | 34599 | Improved the performance of auto analyze queries in order to reduce execution time in the system pool. |
6.8.0 | 33239 | Fixed a rare query deadlock when handling an aborted transaction during cleanup of written data. |
6.8.0 | 30809 | Utility queries (like CREATE USER and GRANT statements) were not persisted when using some drivers (e.g. JDBC). |
6.8.0 | 32725 | Utility queries (like CREATE USER and GRANT statements) were not persisted when run from procedures. |
6.8.0 | 34128 | CREATE/ALTER CLUSTER queries could not be used in procedures. |
6.8.0 | 34064 | Fixed an issue in |
6.8.0 | 34553 | Fixed |
6.8.0 | 34043 | Fixed exception in |
6.8.0 | 34065 | Fixed support for AWS SSO login with |
6.8.0 | 34092 | Fixed an issue in |
6.8.0 | 34174 | Some backups could error out with: |
6.7.0 | 33739 | When using the Cloudformation installer to create a VPC network, the option CreateNATGateways must be set to “true” under all network conditions. |
6.7.0 | 33799 | Azure installation on full private/ UDR fails AKS 1.25 creation due to node count limit. Cluster's upper limit node count is 452 which exceeds the limit for Kubenet 400. If Autoscaler is enabled, the max-count from each node pool is counted towards this total. |
6.7.0 | 29590 | Restore may fail if backup media was moved. e.g. from on-premise to s3 or Azure. |
6.7.0 | 33577 | Use of LEFT(varchar f() , N) or RIGHT(varchar f(), N), N < 30 in a CTAS can cause system instability and possible outage. |
6.7.0 | 33374 | Duplicated targetList entries result in errors for distribution |
6.7.0 | 33092 | Issue was caused by the evaluation of a very deep expression comprised of thousands of OR expressions during the storage engine pushdown phase. This caused the corruption of internal data structures thus leading to a crash. Resolution - Cap the number of OR expressions during storage engine pushdown. |
6.7.0 | 32529 | Some types of correlated sub-queries could lead to DB error. In some rare circumstances, it could cause a DB restart. Queries of this type will now error out with - "This form of correlated subquery is not supported" |
6.7.0 | 29487 | Support Neteeza built-in functions LE_DST() (LEvenshtein DiSTance) and DLE_DST() (Damerau-LEvenshtein DiSTance). |
6.7.0 | 31381 | PostgreSQL CVE-2202-2625 |
6.7.0 | 29549 | In some instances, the planner significantly underestimated LEFT joins containing a WHERE clause condition, resulting in poor planning and performance during execution. |
6.7.0 | 28851 | Sometimes on a busy cluster, we could timeout one of the sockets while sending data which caused error KE037 Something went wrong try again later. Fixed by recording and returning the known PG status (00000 or P0003) |
6.7.0 | 16535 | The issue where a TO_CHAR function call with a string casted to a timestamp with time zone as an argument would incorrectly return nothing has been fixed. |
6.6.0 | 22160 | Upgraded server side log4j.jar file to version 2.17.1 |
6.6.0 | 33592 | Upgrade without administrative privileges |
6.5.1 | 32571, 32542 | The Java-based client tools (ybload, ybunload, ybbackup, ybrestore) do not support the --auth-token connection option. Support for this option is added in this release. |
6.5.1 | 29045 | BAR2: Could not create temp directory for caching of metadata for use with ybbar |
6.5.1 | 31970 | Could not handle object store path containing spaces on YbFileInfo/Ybload |
6.5.1 | 32533 | Could not support JSON lookup for not null column |
6.5.1 | 32538 | Unable to connect using --auth-token on all java based client tools (i.e. ybload) |
6.5.1 | 32721 | Accomodate user specified start/end time for diagnostics |
6.4.0 | 31836 | During AWS deployment, the Kubernetes external-dns software attempts to create DNS records in the most-specific variant when multiple Route 53 zones are present in a hierarchy. The documentation now states that you must either specify values for the most-specific variant, or values for a different DNS zone that does not have overlaps. |
6.4.0 | 29683 | In Version 6.4.0, the database row store alert message has been improved to indicate that it is the catalog row store that is becoming full. |
6.3.0 | 32092 | The GETBIT function returned wrong results when used with BIGINT columns. |
6.3.0 | 31831 | The YBCLUSTER environment variable was not supported for ybsql connections. This variable is now supported for all ybtools clients. |
6.3.0 | 31747 | The description of the contents of a backup bundle was improved in the Version 6.3.0 documentation. |
6.3.0 | 31180 | TIMEZONE, TIMEZONE_HOUR, and TIMEZONE_MINUTE date parts were not supported in EXTRACT and DATE_PART functions applied to TIMESTAMPTZ data types. These date parts are now supported. |
6.3.0 | 25808 | The Yellowbrick Manager Query Editor returned incorrect time zone information for casts to TIMESTAMP and TIMESTAMPTZ. |
CVE Fixes in This Version
The following CVEs are addressed in this version:
Release | CVE Fix | Description |
---|---|---|
6.9.3 | CVE-2024-27983 | Overview node is a JavaScript runtime built on Chrome's V8 JavaScript engine. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a race condition in |
6.9.3 | CVE-2018-5709 | An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data. |
6.9.3 | CVE-2022-47007 | An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. |
6.9.3 | CVE-2018-20657 | The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698. |
6.9.3 | CVE-2023-52356 | A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service. |
6.9.3 | CVE-2007-2243 | OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483 |
6.9.3 | CVE-2020-14145 | The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected. |
6.9.3 | CVE-2020-22916 | An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase. |
6.9.3 | CVE-2022-47011 | An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. |
6.9.3 | CVE-2024-24758 | Overview node is a JavaScript runtime built on Chrome's V8 JavaScript engine. Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains due to not clearing |
6.9.3 | CVE-2023-29383 | In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account. |
6.9.3 | CVE-2021-4189 | A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible. |
6.9.3 | CVE-2024-20926 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). |
6.9.3 | CVE-2020-36325 | An issue was discovered in Jansson through 2.13.1. Due to a parsing error in json_loads, there's an out-of-bounds read-access bug. NOTE: the vendor reports that this only occurs when a programmer fails to follow the API specification |
6.9.3 | CVE-2024-2961 | The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable. |
6.9.3 | CVE-2023-6237 | This vulnerability has not been analyzed by NVD yet. |
6.9.3 | CVE-2024-26461 | Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. |
6.9.3 | CVE-2023-46809 | Overview node is a JavaScript runtime built on Chrome's V8 JavaScript engine. Affected versions of this package are vulnerable to Observable Timing Discrepancy due to the implementation of PKCS#1 v1.5 padding. An attacker can infer the private key used in the cryptographic operation by observing the time taken to execute cryptographic operations (Marvin). ## Remediation Upgrade |
6.9.3 | CVE-2023-6129 | The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. |
6.9.3 | CVE-2023-4421 | The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS < 3.61. |
6.9.3 | CVE-2018-20673 | The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm. |
6.9.3 | CVE-2023-6879 | Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc(). |
6.9.3 | CVE-2024-22019 | Overview node is a JavaScript runtime built on Chrome's V8 JavaScript engine. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a lack of safeguards on chunk extension bytes. The server may read an unbounded number of bytes from a single connection, which allows an attacker to cause denial of service via CPU and network bandwidth exhaustion. ## Details Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users. Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime. One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines. When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries. Two common types of DoS vulnerabilities: * High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload. * Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm |
6.9.3 | CVE-2013-4235 | shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees. |
6.9.3 | CVE-2023-1916 | A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x. |
6.9.3 | CVE-2023-45918 | ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c. |
6.9.3 | CVE-2023-48161 | Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c |
6.9.3 | CVE-2023-45853 | MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API. |
6.9.3 | CVE-2023-6918 | A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection. |
6.9.3 | CVE-2024-2511 | Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions. |
6.9.3 | CVE-2024-20945 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). |
6.9.3 | CVE-2023-32570 | VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit. |
6.9.3 | CVE-2023-3164 | A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file. |
6.9.3 | CVE-2024-22667 | Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions. |
6.9.3 | CVE-2024-21892 | Overview node is a JavaScript runtime built on Chrome's V8 JavaScript engine. Affected versions of this package are vulnerable to Code Injection due to the incorrect handling of environment variables on Linux when the process is running with elevated privileges that the current user lacks (does not apply to |
6.9.3 | CVE-2024-26462 | Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c. |
6.9.3 | CVE-2023-26965 | loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image. |
6.9.3 | CVE-2024-0727 | Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack |
6.9.3 | CVE-2021-45261 | An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service. |
6.9.3 | CVE-2023-6277 | An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB. |
6.9.3 | CVE-2024-20921 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). |
6.9.3 | CVE-2024-25269 | libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack. |
6.9.3 | CVE-2024-20952 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). |
6.9.3 | CVE-2017-9117 | In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff. |
6.9.3 | CVE-2024-28757 | libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate). |
6.9.3 | CVE-2022-4899 | A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun. |
6.9.3 | CVE-2023-39130 | GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap buffer overflow via the function pe_as16() at /gdb/coff-pe-read.c. |
6.9.3 | CVE-2017-11164 | In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression. |
6.9.3 | CVE-2020-15719 | libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux. |
6.9.3 | CVE-2021-40633 | A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file. |
6.9.3 | CVE-2022-3857 | A flaw was found in libpng 1.6.38. A crafted PNG image can lead to a segmentation fault and denial of service in png_setup_paeth_row() function. |
6.9.3 | CVE-2021-33574 | The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact. |
6.9.3 | CVE-2024-2236 | A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts. |
6.9.3 | CVE-2023-26966 | libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian. |
6.9.3 | CVE-2024-26458 | Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c. |
6.9.3 | CVE-2023-7008 | A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records. |
6.9.3 | CVE-2024-28834 | A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel. |
6.9.3 | CVE-2022-47008 | An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. |
6.9.3 | CVE-2024-27982 | Overview node is a JavaScript runtime built on Chrome's V8 JavaScript engine. Affected versions of this package are vulnerable to HTTP Request Smuggling via content length ofuscation. An attacker can smuggle an HTTP request by including a space before a Content-Length header. ## Remediation Upgrade |
6.9.3 | CVE-2022-28506 | There is a heap-buffer-overflow in GIFLIB 5.2.1 function DumpScreen2RGB() in gif2rgb.c:298:45. |
6.9.3 | CVE-2024-22365 | linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. |
6.9.3 | CVE-2023-5678 | Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. |
6.9.3 | CVE-2016-2568 | pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer. |
6.9.3 | CVE-2024-0553 | A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981. |
6.9.3 | CVE-2011-4116 | _is_safe in the File::Temp module for Perl does not properly handle symlinks. |
6.9.3 | CVE-2022-3219 | GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB. |
6.9.3 | CVE-2023-3618 | A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service. |
6.9.3 | CVE-2023-50495 | NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry(). |
6.9.3 | CVE-2023-2953 | A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function. |
6.9.3 | CVE-2007-5686 | initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers. |
6.9.3 | CVE-2023-34969 | D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6. |
6.9.3 | CVE-2022-45703 | Heap buffer overflow vulnerability in binutils readelf before 2.40 via function display_debug_section in file readelf.c. |
6.9.3 | CVE-2010-4756 | The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632. |
6.9.2 | CVE-2009-4487 | nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. |
6.9.2 | CVE-2019-8457 | SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables. |
6.9.2 | CVE-2017-7245 | Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file. |
6.9.2 | CVE-2019-20838 | libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454. |
6.9.2 | CVE-2021-31239 | An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function. |
6.9.2 | CVE-2023-39615 | Xmlsoft Libxml2 v2.11.0 was discovered to contain an out of bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input. |
6.9.2 | CVE-2021-36085 | The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map). |
6.9.2 | CVE-2023-5981 | A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. |
6.9.2 | CVE-2023-39804 | This vulnerability has not been analyzed by NVD yet. |
6.9.2 | CVE-2016-3709 | Possible cross-site scripting vulnerability in libxml after commit 960f0e2. |
6.9.2 | CVE-2023-36054 | lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count. |
6.9.2 | CVE-2023-4911 | A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges. |
6.9.2 | CVE-2023-3817 | Checking excessively long DH keys or parameters may be very slow. |
6.9.2 | CVE-2022-35737 | SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. |
6.9.2 | CVE-2021-36690 | A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library. |
6.9.2 | CVE-2022-2309 | NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered. |
6.9.2 | CVE-2021-36086 | The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list). |
6.9.2 | CVE-2017-16231 | In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used. |
6.9.2 | CVE-2023-29491 | ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable. |
6.9.2 | CVE-2023-3446 | Checking excessively long DH keys or parameters may be very slow. |
6.9.2 | CVE-2021-36087 | The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block. |
6.9.2 | CVE-2020-13529 | An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server. |
6.9.2 | CVE-2023-46218 | This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. |
6.9.2 | CVE-2023-4806 | A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss_gethostbyname2_r and nss_getcanonname_r hooks without implementing the nss*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags. |
6.9.2 | CVE-2017-7246 | Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file. |
6.9.2 | CVE-2023-4813 | A flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge. |
6.9.2 | CVE-2022-48303 | GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. |
6.9.2 | CVE-2013-0337 | The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files. |
6.9.2 | CVE-2022-1304 | An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem. |
6.9.2 | CVE-2024-20932 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 17.0.9; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 21.3.8 and 22.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). |
6.9.2 | CVE-2023-47038 | A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer. |
6.9.2 | CVE-2015-9019 | In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs. |
6.9.2 | CVE-2021-36084 | The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper). |
6.9.2 | CVE-2024-0567 | A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack. |
6.9.2 | CVE-2023-44487 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
6.9.2 | CVE-2020-16156 | CPAN 2.28 allows Signature Verification Bypass. |
6.9.2 | CVE-2023-46219 | When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. |
6.9.2 | CVE-2023-45322 | libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail." |
6.9.2 | CVE-2021-33560 | Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP. |
6.9.1 | CVE-2024-21626 | AWS is aware of CVE-2024-21626, an issue affecting the runc component of several open source container management systems. Under certain conditions, an actor could leverage a specially crafted container or container configuration to access files or directories outside the container's file system namespace. An updated version of runc that addresses the issue is available for Amazon Linux 1 (runc-1.1.11-1.0.amzn1), Amazon Linux 2 (runc-1.1.11-1.amzn2) and for Amazon Linux 2023 (runc-1.1.11-1.amzn2023). AWS recommends that customers using runc or any container-related software apply those updates or a newer version. |
6.9.1 | CVE-2023-6606 | An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. |
6.9.1 | CVE-2023-49569 | A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.Applications are only affected if they are using the ChrootOS "https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS" , which is th default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS "https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS" or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli. |
6.9.1 | CVE-2023-50447 | Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). |
6.9.1 | CVE-2023-6817 | A use-after-free vulnerability in the Linux kernel's netfilter nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free. We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a. |
6.9.1 | CVE-2024-0193 | A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system. |
6.9.1 | CVE-2023-6932 | A use-after-free vulnerability in the Linux kernel's ipv4 igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread. We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. |
6.9.1 | CVE-2024-1086 | A use-after-free vulnerability in the Linux kernel's netfilter nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660. |
6.9.1 | CVE-2023-6931 | A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b. |
6.9.1 | CVE-2023-7104 | A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.NOTE https://sqlite.org/forum/forumpost/5bcbf4571cNOTE Fixed by https://sqlite.org/src/info/0e4e7a05c4204b47 |
6.9.1 | CVE-2023-6040 | An out-of-bounds access vulnerability involving netfilter was reported and fixed as f1082dd31fe4 (netfilter nf_tables Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within |
6.9.1 | CVE-2023-39198 | A race condition leading to a use-after-free issue was found in the QXL driver in the Linux kernel. |
6.9.1 | CVE-2023-52340 | When a router encounters an IPv6 packet too big to transmit to the next-hop, it returns an ICMP6 "Packet Too Big" (PTB) message to the sender. The sender caches this updated Maximum Transmission Unit (MTU) so it knows not to exceed this value when subsequently routing to the same host. In Linux kernels prior to 6.3, garbage collection is run on the IPv6 Destination Route Cache if the number of entries exceeds a threshold when adding the destination to the cache. This garbage collection examines every entry in the cache while holding a lock. In these affected kernel versions, a flood of the IPv6 ICMP6 PTB messages could cause high lock contention and increased CPU usage, leading to a Denial-of-Service. The fix backports the garbage collection improvements from Linux kernel 6.3 by bringing the IPv6 code closer to the IPv4 code, which does not have this issue. Patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=af6d10345ca76670c1b7c37799f0d5576ccef277 |
6.9.1 | CVE-2023-39325 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
6.9.1 | CVE-2022-32149 | An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. |
6.9.1 | CVE-2020-36773 | Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature). |
6.9.1 | CVE-2024-20932 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component Security). Supported versions that are affected are Oracle Java SE 17.0.9; Oracle GraalVM for JDK 17.0.9; Oracle GraalVM Enterprise Edition 21.3.8 and 22.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). |
6.9.1 | CVE-2023-46751 | An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer. |
6.9.1 | CVE-2023-51764 | Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports |
6.9.1 | CVE-2023-47108 | OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels |
6.9.1 | CVE-2023-29406 | The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value. |
6.9.1 | CVE-2024-23849 | In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access. |
6.9.1 | CVE-2024-20952 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component Security). Supported versions that are affected are Oracle Java SE 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note This vulnerability applies to Java deployments, typically in clients running. |
6.9.1 | CVE-2024-20918 | A vulnerability that allows an attacker to execute arbitrary java code from the javascript engine even though the option "--no-java" was set. |
6.9.1 | CVE-2024-0565 | An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service. |
6.9.1 | CVE-2023-6531 | A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on. |
6.9.1 | CVE-2023-42465 | Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit. |
6.9.1 | CVE-2024-0646 | An out-of-bounds memory write flaw was found in the Linux kernel's Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system. |
6.9.1 | CVE-2020-19187 | Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. |
6.9.1 | CVE-2020-19185 | Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. |
6.9.1 | CVE-2020-19186 | Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. |
6.9.1 | CVE-2016-0775 | Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file. |
6.9.1 | CVE-2020-19188 | Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. |
6.9.1 | CVE-2020-19189 | Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. |
6.9.1 | CVE-2023-6915 | A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return. |
6.9.1 | CVE-2023-46838 | A flaw has been found in Xen. An unprivileged guest can cause Denial of Service (DoS) of the host by sending network packets to the backend, causing the backend to crash. |
6.9.1 | CVE-2023-46218 | This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with domain=co.UK when the URL used a lowercase hostname curl.co.uk, even though co.uk is listed as a PSL domain. |
6.9.1 | CVE-2024-0584 | A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an igmp query packet, leading to a kernel information leak. |
6.9.1 | CVE-2023-38473 | A reachable assertion was found in avahi_alternative_host_name. |
6.9.1 | CVE-2023-43786 | A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition. |
6.9.1 | CVE-2023-34969 | D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6. |
6.9.1 | CVE-2023-38472 | A reachable assertion was found in avahi_rdata_parse. |
6.9.1 | CVE-2023-25153 | Containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images. |
6.9.1 | CVE-2023-30630 | Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. |
6.9.1 | CVE-2024-0607 | netfilter nf_tables fix pointer math issue in nft_byteorder_eval(). |
6.9.1 | CVE-2023-5388 | It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are zero. This information can be used to mount a Bleichenbacher or Manger like attack against all RSA decryption operations. As the leak happens before any padding operations, it affects all padding modes PKCS#1 v1.5, OAEP, and RSASVP. Both API level calls and TLS server operation are affected. |
6.9.1 | CVE-2022-48566 | An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest. |
6.9.1 | CVE-2024-20921 | Loop optimizations are not correct when induction variable overflows. |
6.9.1 | CVE-2023-6135 | Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121. |
6.9.1 | CVE-2023-48795 | AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A protocol extension has been introduced by OpenSSH which needs to be applied to both the client and the server in order to address this issue. We recommend customers update to the latest version of SSH. |
6.9.1 | CVE-2024-20919 | With carefully crafted custom bytecodes, arbitrary unverified bytecodes could be executed. |
6.9.1 | CVE-2022-41721 | A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests. |
6.9.1 | CVE-2022-47007 | An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. |
6.9.1 | CVE-2022-47008 | An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. |
6.9.1 | CVE-2024-22667 | Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions. |
6.9.1 | CVE-2022-47010 | An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. |
6.9.1 | CVE-2021-46174 | Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37. |
6.9.1 | CVE-2016-9189 | Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.map_buffer in map.c component. |
6.9.1 | CVE-2022-35205 | An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause a denial of service. |
6.9.1 | CVE-2023-46862 | An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur. |
6.9.1 | CVE-2020-19724 | A memory consumption issue in get_data function in binutils/nm.c in GNU nm before 2.34 allows attackers to cause a denial of service via crafted command. |
6.9.1 | CVE-2022-48064 | GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack. |
6.9.1 | CVE-2023-3978 | Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. |
6.9.1 | CVE-2019-17595 | There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012. |
6.9.1 | CVE-2024-22195 | Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja |
6.9.1 | CVE-2023-25173 | containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well. This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the |
6.9.1 | CVE-2019-17594 | There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012. |
6.9.1 | CVE-2023-29409 | Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable. |
6.9.1 | CVE-2023-50495 | NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry(). |
6.9.1 | CVE-2023-1972 | Potential heap based buffer overflow found in _bfd_elf_slurp_version_tables() in bfd/elf.c. |
6.9.1 | CVE-2024-20945 | Crypto key may be leaked via debug logging in some cases. |
6.9.1 | CVE-2023-39326 | A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small. |
6.9.1 | CVE-2023-6121 | An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg). |
6.9.1 | CVE-2023-45803 | urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like |
6.9.1 | CVE-2020-19190 | Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. |
6.9.1 | CVE-2023-46219 | When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. |
6.9.1 | CVE-2023-48706 | Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a |
6.9.1 | CVE-2022-41409 | Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. |
6.9.1 | CVE-2024-22365 | A vulnerability was found in Linux PAM. An unprivileged user that is not yet in a corresponding mount namespace with ~/tmp mounted as a polyinstantiated dir can place a FIFO there, and a subsequent attempt to login as this user with |
6.9.1 | CVE-2023-46316 | In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines. |
6.9.1 | CVE-2024-20925 | There are several integer overflows in the media handling. |
6.9.1 | CVE-2024-20923 | Missing validation may cause unexpected issues. |
6.9.1 | CVE-2023-39804 | It was discovered that tar incorrectly handled extended attributes in PAX archives. An attacker could supply a specially crafted file and cause tar to crash, resulting in a denial of service. |
6.9.1 | CVE-2024-20922 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component JavaFX). Supported versions that are affected are Oracle Java SE 8u391; Oracle GraalVM Enterprise Edition 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). |
6.9.1 | CVE-2022-40090 | An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file. |
6.9.1 | CVE-2021-38115 | read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file. |
6.9.1 | CVE-2024-0985 | Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. As part of exploiting this vulnerability, the attacker creates functions that use CREATE RULE to convert the internally-built temporary table to a view. Versions before PostgreSQL 15.6, 14.11, 13.14, and 12.18 are affected. The only known exploit does not work in PostgreSQL 16 and later. For defense in depth, PostgreSQL 16.2 adds the protections that older branches are using to fix their vulnerability. |
6.9.1 | CVE-2022-1056 | Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd. |
6.9.1 | CVE-2023-30775 | A vulnerability was found in the libtiff library. This security flaw causes a heap buffer overflow in extractContigSamples32bits, tiffcrop.c. |
6.9.1 | CVE-2022-31782 | ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow. |
6.9.1 | CVE-2019-6129 | DISPUTED png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE a third party has stated "I don't think it is libpng's job to free this buffer." |
6.9.1 | CVE-2021-40145 | DISPUTED gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes." |
6.9.1 | CVE-2021-46822 | The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c. |
6.9.1 | CVE-2013-0340 | expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. |
6.9.1 | CVE-2021-40812 | The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks. |
6.9.1 | CVE-2020-36309 | ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header. |
6.9.0 | CVE-2017-8291 | Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017. |
6.9.0 | CVE-2017-8779 | rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb. |
6.9.0 | CVE-2017-1000117 | A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability. |
6.9.0 | CVE-2017-14492 | Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request. |
6.9.0 | CVE-2017-12615 | When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. |
6.9.0 | CVE-2017-12617 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. |
6.9.0 | CVE-2017-17405 | Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution. |
6.9.0 | CVE-2018-1111 | DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. |
6.9.0 | CVE-2018-16509 | An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. |
6.9.0 | CVE-2018-17456 | Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character. |
6.9.0 | CVE-2020-1938 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. |
6.9.0 | CVE-2020-8617 | Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results. |
6.9.0 | CVE-2023-3576 | A memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes this memory leak issue, resulting an application crash, eventually leading to a denial of service. |
6.9.0 | CVE-2022-1725 | NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959. |
6.9.0 | CVE-2023-48237 | Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit |
6.9.0 | CVE-2020-19726 | An issue was discovered in binutils libbfd.c 2.36 relating to the auxiliary symbol data allows attackers to read or write to system memory or cause a denial of service. |
6.9.0 | CVE-2022-1771 | Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975. |
6.9.0 | CVE-2023-47471 | Buffer Overflow vulnerability in strukturag libde265 v1.10.12 allows a local attacker to cause a denial of service via the slice_segment_header function in the slice.cc component. |
6.9.0 | CVE-2022-2042 | Use After Free in GitHub repository vim/vim prior to 8.2. |
6.9.0 | CVE-2023-5868 | A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory. |
6.9.0 | CVE-2023-48235 | Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the overflow. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit |
6.9.0 | CVE-2023-39417 | IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. |
6.9.0 | CVE-2022-35205 | An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause a denial of service. |
6.9.0 | CVE-2023-48236 | Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has been addressed in commit |
6.9.0 | CVE-2023-43887 | Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and num_tile_row parameters in the function pic_parameter_set::dump. |
6.9.0 | CVE-2023-48231 | Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit |
6.9.0 | CVE-2023-46246 | Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function |
6.9.0 | CVE-2021-46174 | Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37. |
6.9.0 | CVE-2022-2000 | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. |
6.9.0 | CVE-2023-27102 | Libde265 v1.0.11 was discovered to contain a segmentation violation via the function decoder_context::process_slice_segment_header at decctx.cc. |
6.9.0 | CVE-2023-48234 | Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit |
6.9.0 | CVE-2023-5870 | A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack. |
6.9.0 | CVE-2023-48233 | Vim is an open source command line text editor. If the count after the 😒 command is larger than what fits into a (signed) long variable, abort with e_value_too_large. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit |
6.9.0 | CVE-2023-5869 | A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory. |
6.9.0 | CVE-2022-1897 | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. |
6.9.0 | CVE-2023-40745 | LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow. |
6.9.0 | CVE-2023-27103 | Libde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at motion.cc. |
6.9.0 | CVE-2023-28531 | ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9. |
6.9.0 | CVE-2023-41175 | A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow. |
6.8.0 | CVE-2023-35945 | Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving |
6.8.0 | CVE-2023-2975 | The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. |
6.8.0 | CVE-2023-38545 | This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. |
6.8.0 | CVE-2022-48174 | There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. |
6.8.0 | CVE-2023-2603 | A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB. |
6.8.0 | CVE-2023-2602 | A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory. |
6.8.0 | CVE-2023-38039 | When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. |
6.8.0 | CVE-2022-41862 | In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes. |
6.8.0 | CVE-2023-38546 | This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. |
6.8.0 | CVE-2022-23491 | Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion. |
6.8.0 | CVE-2023-32803 | This vulnerability has not been analyzed by NVD yet. |
6.8.0 | CVE-2023-2650 | Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. |
6.7.0 | CVE-2015-20107 | In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 |
6.7.0 | CVE-2020-10735 | A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability. |
6.7.0 | CVE-2020-19185 | Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. |
6.7.0 | CVE-2020-19186 | Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. |
6.7.0 | CVE-2020-19187 | Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. |
6.7.0 | CVE-2020-19188 | Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. |
6.7.0 | CVE-2020-19189 | Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. |
6.7.0 | CVE-2020-19190 | Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. |
6.7.0 | CVE-2020-27619 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. |
6.7.0 | CVE-2020-35448 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. |
6.7.0 | CVE-2021-20197 | There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink. |
6.7.0 | CVE-2021-20284 | A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The highest threat from this vulnerability is to system availability. |
6.7.0 | CVE-2021-29921 | In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses. |
6.7.0 | CVE-2021-33294 | In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) via crafted file. |
6.7.0 | CVE-2021-3426 | There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7. |
6.7.0 | CVE-2021-3487 | There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system availability by way of excessive memory consumption. |
6.7.0 | CVE-2021-3530 | A flaw was discovered in GNU libiberty within demangle_path() in rust-demangle.c, as distributed in GNU Binutils version 2.36. A crafted symbol can cause stack memory to be exhausted leading to a crash. |
6.7.0 | CVE-2021-3549 | An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability. |
6.7.0 | CVE-2021-36368 | DISPUTED An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE the vendor's position is "this is not an authentication bypass, since nothing is being bypassed. |
6.7.0 | CVE-2021-3733 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability. |
6.7.0 | CVE-2021-3737 | A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability. |
6.7.0 | CVE-2021-3826 | Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol. |
6.7.0 | CVE-2021-41617 | sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. |
6.7.0 | CVE-2021-45078 | stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE this issue exists because of an incorrect fix for CVE-2018-12699. |
6.7.0 | CVE-2021-46195 | GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources. |
6.7.0 | CVE-2022-2208 | NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163. |
6.7.0 | CVE-2022-2210 | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. |
6.7.0 | CVE-2022-2257 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. |
6.7.0 | CVE-2022-2264 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. |
6.7.0 | CVE-2022-2284 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. |
6.7.0 | CVE-2022-2285 | Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0. |
6.7.0 | CVE-2022-2286 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. |
6.7.0 | CVE-2022-2287 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. |
6.7.0 | CVE-2022-2289 | Use After Free in GitHub repository vim/vim prior to 9.0. |
6.7.0 | CVE-2022-2598 | Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100. |
6.7.0 | CVE-2022-3016 | Use After Free in GitHub repository vim/vim prior to 9.0.0286. |
6.7.0 | CVE-2022-3037 | Use After Free in GitHub repository vim/vim prior to 9.0.0322. |
6.7.0 | CVE-2022-3099 | Use After Free in GitHub repository vim/vim prior to 9.0.0360. |
6.7.0 | CVE-2022-37454 | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface. |
6.7.0 | CVE-2022-38533 | In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file. |
6.7.0 | CVE-2022-40433 | An issue was discovered in function ciMethodBlocks::make_block_at in Oracle JDK (HotSpot VM) 11, 17 and OpenJDK (HotSpot VM) 8, 11, 17, allows attackers to cause a denial of service. |
6.7.0 | CVE-2022-4285 | An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599. |
6.7.0 | CVE-2022-42919 | Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine. Pickles can execute arbitrary code. Thus, this allows for local user privilege escalation to the user that any forkserver process is running as. Setting multiprocessing.util.abstract_sockets_supported to False is a workaround. The forkserver start method for multiprocessing is not the default start method. This issue is Linux specific because only Linux supports abstract namespace sockets. CPython before 3.9 does not make use of Linux abstract namespace sockets by default. Support for users manually specifying an abstract namespace socket was added as a bugfix in 3.7.8 and 3.8.3, but users would need to make specific uncommon API calls in order to do that in CPython before 3.9. |
6.7.0 | CVE-2022-45061 | An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. |
6.7.0 | CVE-2022-47673 | An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out of bound reads which may cause a denial of service or other unspecified impacts. |
6.7.0 | CVE-2022-47696 | An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols. |
6.7.0 | CVE-2023-1579 | Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in bfd_getl64. |
6.7.0 | CVE-2023-2222 | This vulnerability has not been analyzed by NVD yet. |
6.7.0 | CVE-2023-22603 | ConsultIDs none. Reason This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes none. |
6.7.0 | CVE-2023-22604 | ConsultIDs- none. Reason-This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes- none. |
6.7.0 | CVE-2023-22605 | ConsultIDs- none. Reason- This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes- none |
6.7.0 | CVE-2023-22606 | ConsultIDs- none. Reason- This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes- none |
6.7.0 | CVE-2023-22609 | ConsultIDs- none. Reason- This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes- none |
6.7.0 | CVE-2023-24535 | Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic. |
6.7.0 | CVE-2023-25584 | An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils. |
CVE-2023-25585 | A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service. | |
CVE-2023-25586 | A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service. | |
6.7.0 | CVE-2023-25588 | A flaw was found in Binutils. The field |
6.7.0 | CVE-2023-32002 | The use of |
6.7.0 | CVE-2023-32006 | The use of |
6.7.0 | CVE-2023-32559 | A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines- 16.x, 18.x and, 20.x. The use of the deprecated API |
6.7.0 | CVE-2023-38408 | The PKCS 11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE this issue exists because of an incomplete fix for CVE-2016-10009. |
6.7.0 | CVE-2023-40217 | An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.) |
6.7.0 | CVE-2023-4863 | Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity- Critical) |
6.7.0 | CVE-2023-5129 | This CVE- ID has been rejected or withdrawn by its CVE- Numbering Authority. Duplicate of CVE-2023-4863. |
6.7.0 | CVE-2023-5156 | A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash. |
6.5.0 | CVE-2023-2650 | Possible DoS translating ASN.1 object identifiers |
6.5.0 | CVE-2023-2975 | AES-SIV implementation ignores empty associated data entries |
6.5.0 | CVE-2023-3446 | Excessive time spent checking DH keys and parameters |
6.5.0 | CVE-2023-3817 | Excessive time spent checking DH q parameter value |
6.5.0 | CVE-2023-35945 | Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec |
6.5.0 | CVE-2022-29458 | ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library. |
6.5.0 | CVE-2022-3715 | A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems. |
6.5.0 | CVE-2022-41409 | Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. |
6.5.0 | CVE-2022-4899 | A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun. |
6.5.0 | CVE-2016-1585 | In all versions of AppArmor mount rules are accidentally widened when compiled. |
6.5.0 | CVE-2016-2568 | pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer. |
6.5.0 | CVE-2023-34969 | D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. |
Parent topic:Yellowbrick Documentation