Skip to content

6.9.3 Yellowbrick Release Notes

Release Version: 6.9.3-8785.f60b9318
Release Date: 8/28/2024

Yellowbrick Data Warehouse Version 6.9.3 is supported for AWS and Microsoft Azure cloud deployments. This version of Yellowbrick Data Warehouse is installed on Cloud Data Warehouse Manager (CDWM) Version 3.69.3.

Cloud ProviderCDWM VersionYellowbrick Data Warehouse VersionKubernetes Version
AWS3.69.3-1433.07baae086.9.3-8558.0e5a282cEKS 1.28
Azure3.69.3-1433.07baae086.9.3-8558.0e5a282cAKS 1.28

Upgrade Requirements

Read the following information before beginning an upgrade to Version 6.9.3:

  1. Contact Customer Support to review the process and schedule the upgrade.
  2. Only upgrades from Version 6.9.2 to 6.9.3 are supported. These upgrades apply to both CDWM and data warehouse instances.
  3. YBD Instances and cluster must be running and not suspended before being upgraded.
  4. Existing installations using the standard installation method can only be upgraded using the standard method. Similarly, installations using the offline method must be upgraded using the same offline method. Cross-method upgrades are not supported.

Note: The default cluster must be up and running before attempting to upgrade data warehouse instances. You cannot upgrade suspended instances.

AWS Upgrades from Version 6.9.2

For version 6.9.3, EKS version has been changed from 1.27 to 1.28.

  1. Before beginning the CDWM upgrade, suspend all instances managed by the CDWM.

  2. Push the CDWM and YBD images to the AWS ECR and check that the required files are in the S3 bucket.

Note: The following step is done for EKS upgrade as well as CDWM upgrade. Before upgrading EKS, On Demand Capacity Reservation (ODCR) must be completed. ODCR is necessary whenever there is an EKS upgrade or a node image change. As the EKS version is changing and we are updating the node image for the current release, ODCR is required.

  1. In AWS CloudFormation > Stacks, search for your root stack for your installation; click update and then

    Select Replace current template and update the Amazon S3 URL to point to the location of the yb-cdw.template.yaml file for the 3.69.3-1433.07baae08 build.

  2. Update and verify information on stack details page.

  3. In the Yellowbrick software section, the URL for the chart repository and CloudFormation S3 key prefix must be updated.

    On the final review page, confirm that the only changes or overrides will be to the CFS3KeyPrefix and ChartRepository values. All other key values remain the same.

    Note: If in the user's environment, the user has created a Scaled Instance, then the user should select Scaled in the Shared Services Type.

  4. Submit to start the deployment process and once it completes verify that the CDWM is reporting the correct version of 3.69.3-1433.07baae08 in the Yellowbrick manager UI, Configuration->Warehouse Manager section.

  5. Once the upgrade of the CDWM to version 3.69.3-1433.07baae08 is completed each of the YBD instances will also need to be upgraded to 6.9.3-8558.0e5a282c using the Upgrade option in the Configuration->Instances page on the Yellowbrick manager UI.

Azure Upgrades from Version 6.9.2

Upgrade from versions prior to 6.9.2 are not supported. Please follow instructions to upgrade to 6.9.2 prior to proceeding with this upgrade. Note that version 6.9.2 includes AKS version 1.28.

Note: Please update variables and settings for your environment including URL to the files.

  1. Before beginning the CDWM upgrade, suspend all instances managed by the CDWM. Ensure that all the worker nodes are not running.

  2. Push the CDWM and YBD images to the Azure ACR and check that the required files are in the Azure Storage Account Container. Azure upgrade involves:

Note: The manual scaling of nodepools will cause the configuration of the nodepool to get reset, and break the ability to spin up worker clusters. This is not supported and must not be attempted.

Upgrades from Version 5.x (Not Supported)

You cannot upgrade from Version 5.x to Version 6. However, you can replicate databases from some older releases to Version 6; see BAR2 and Replication Compatibility.

Changes in Behavior in This Version

  • 6.9.0

    SMC global retention feature removed in favor of individual SQL policy

    The global retention setting in System Management Console has been removed. Retention settings can still be changed via SQL on a per-table basis. See Retention Policies for System Relations for more details.

  • 6.8.0

    RETENTION_AGE and RETENTION_SIZE are now reserved words

    With the new feature regarding Retention Policy on System Objects, RETENTION_AGE and RETENTION_SIZE had to be added as reserved words.

    To use them as identifiers in SQL statements, they will need to be quoted. See the Reserved Words for the complete list.

  • 6.7.0

    Azure has new limits on node group maximums

    This change from Azure will reduce the maximum number of nodes as follows:

    Type Maximum
    inst32 10
    inst48 10
    compiler 10
    bulk 50
    large worker 125
    small worker 125
    controller 10(default)
    system 10(default)
  • 6.3.0

    Default Time Zone for Data Warehouse Instances

    In Version 6.3.0, the timezone and log_timezone configuration settings default to UTC for all new data warehouse instances.

  • 6.3.0

    Behavior of the CHAR Data Type

    The CHAR data type implementation has changed in Version 6.x. The pg_char_compatibility_mode parameter is now set to FULL and cannot be set to any other value. See Upcoming Behavioral Changes to the CHAR Data Type.

  • 6.3.0

    Default Behavior of WLM Restart Rules

    By default, a subset of recoverable error codes triggers an attempted restart, and an attempted restart occurs only once per query. For details, see Restarting Queries.

Changes in Compatibility in This Version

  • 6.7.0

    Client tools tzdata compatibility

    When executing ybload and load table SQL, the outcome of loading a timestamp with timezone data to a timestamp column may vary based on the tzdata version. Differences between the JRE’s tzdata version and the Yellowbrick database’s tzdata version can lead to inconsistencies between timestamp directly inserted into the database and those loaded using ybload or load table SQL.

    For example, in the case of JRE with tzdata version 2022b, Chile's Daylight Saving Time (DST) transition is delayed by a week in September 2022. As a result, a timestamp such as 04-09-2022 12:00:00 Chile/Continental might be directly inserted into the database as 2022-04-09 15:00:00+00 while being loaded as 2022-04-09 16:00:00+00 due to differences in timezone conversions.

    It is recommended to check tzdata version used JRE in the environment, using the tzupdater tool provided by Oracle.

  • 6.7.0

    ybtools Compatibility 

    Yellowbrick recommends that you always upgrade ybtools to match the Yellowbrick server version you are running (for example, upgrade to ybtools Version 6.7 before connecting to a Version 6.7 data warehouse). In most cases, using an older version of ybtools, such as 6.6, to connect to a Version 6.7 Data Warehouse will work but is not recommended.

    Using Version 6.7 of ybtools with an older server version (such as Version 6.6) may result in error messages for some commands or a mismatch between client and server features.

    Important:
    On CentOS and Red Hat client platforms, you must first remove any existing 5.x version of ybtools. Then you can proceed with the installation of the Version 6.0 ybtools. You cannot upgrade directly from an earlier 5.x version of ybtools to Version 6.0.

  • 6.7.0

    BAR2 and Replication Compatibility

    Important: The source and target systems used for database backup and restore (BAR2) and database replication must be compatible. To support full functionality, the source and target systems should both be running a 6.7 version of Yellowbrick software.

    Nonetheless, you can back up and restore a database, or replicate a database, from:

    • 5.2.x to 6.5.x
    • 5.4.3 or later to 6.5.x
    • 6.1.x to 6.5.x
    • 6.2.x to 6.5.x
    • 6.3.x to 6.5.x
    • 6.4.x to 6.5.x
    • 6.5.x to 6.6.x

    Although you can start replication from a 5.2, 5.4, 6.1, 6.2... or 6.6 source to a 6.7 target, and you can fail over to the 6.7 target, you cannot fail back to the 5.2, 5.4, 6.1, 6.2, 6.3, 6.4 or 6.6 source. In general, you cannot fail back to a Yellowbrick version with a catalog version that is earlier than the current catalog version.

What's New in This Version

  • 6.9.3

    Federal Information Processing Standard (FIPS)

    To enable FIPS for Yellowbrick software, please contact support team.

  • 6.9.0

    Use network data compression techniques to minimize the data distributed between compute nodes

    Reduce the amount of data distributed between compute nodes via network data compression techniques. Workloads that result in heavy distribution of data across compute nodes might benefit from this feature. This can be enabled via a new boolean GUC “enable_rowpacket_compression_in_distribution”.

  • 6.9.0

    Ybunload Option (--header) to Include Column Headers in CSV/TEXT Mode

    Ybunload client tool supports new option --header that includes column headers in generated CSV/TEXT.

    • Support sql column aliases.
    • Support customization options with --quote, --quote-escape and --delimiter.
    • Support uncompressed and gzip block compression modes (gzip_stream is not yet supported).
    • Advanced conflict resolution for column names with --column-prefix, --disable-column-aliases, --disable-column-names.

    Yellowbrick database must be updated to version 5.4.0 or above to use this feature

  • 6.9.0

    Increase the column limit for views and select queries to 8000

    Views and SELECT queries can now have up to 8000 columns, from 2000. Other database limits are still the same, notably:

    • the maximum number of columns in a table is still 2000.
    • the maximum row size is still 64231 bytes.
  • 6.8.0

    Retention Policy for System Relations

    Retention policies can be applied on some of the growing system relations to limit their maximum size.

    See Retention Policies for System Relations for more details.

  • 6.8.0

    Parquet support to INT96 timestamp values

    Interpret INT96 data (without a logical type) as a timestamp to provide compatibility with third-party systems, such as Impala, Hive and Spark. New option to ybload:

    console
    --int96-as-timestamp (default)
    --no-int96-as-timestamp
  • 6.8.0

    Automatic download of diagnostics bundles

    The diagnostics bundles are now available to download automatically from the YB manager UI, once the job is completed.

  • 6.8.0

    Various view changes


    New storage for views

    Starting with 6.8.0 the exact statement used is saved when creating a view. Views have now two possible representation format:

    • TEXT introduced in 6.8.0: store the exact statement used to create the view.
    • BINARY former one: store an intermediate binary representation of the view.

    Frontend view

    Views can now use fronted tables and views. The restriction for mixed queries are now the same for views and selects statements.

    console
    yellowbrick=# create view v as select u.name owner_name, s.name schema_name from sys.schema s join sys.user u on s.owner_id = u.user_id;
    CREATE VIEW
    yellowbrick=# select * from v;
            owner_name            |          schema_name
    ----------------------------------+--------------------------------
    yellowbrick                      | sc1
    yellowbrick                      | sc2

    Describe functions

    The following functions now use the new representation if available:

    • pg_get_viewdef
    • \d
    • describe with ddl
    • ybdumpschema

    The full statement used to create a view can now be displayed using the new function pg_get_viewddl.

    console
    yellowbrick=# select pg_get_viewdef('v');
                                                  pg_get_viewdef
    -----------------------------------------------------------------------------------------------------------
    select u.name owner_name, s.name schema_name from sys.schema s join sys.user u on s.owner_id = u.user_id;
    (1 row)
    
    yellowbrick=# select pg_get_viewddl('v');
                                                          pg_get_viewddl
    ----------------------------------------------------------------------------------------------------------------------------
    create view v as select u.name owner_name, s.name schema_name from sys.schema s join sys.user u on s.owner_id = u.user_id;
    (1 row)
    
    yellowbrick=#

    New type checking

    Views created within the new format will now raise an error if the column output type does not match the one stored in the view definition when used.

    Format change

    Views created before 6.8.0 are only stored in binary format. Views created after 6.8.0 use the new text format by default but can be reverted to the old representation using ALTER VIEW.

    Correct latebounded behavior for string to oid literal casts

    String to oid casts ( 'table_name'::regclass) are now evaluated at view usage instead of view creation.

  • 6.7.0

    Java version update to Java 11, bug fixes

    Version 6.7.0 provides critical bug fixes. Java 11 is the minimum required java version for Java based client tools. Please refer to Installing JRE. Please see issues fixed in this version.

  • 6.6.0

    Offline Installer

    This provides an installer that allows customers installing into networks with no public internet access.

    Commands

    load

    This command must first be ran to load all the container images into the local docker registry from the images.tgz file.

    ./ybdsw load

    This should result in all containers in images.tgz to be loaded into local docker registry.

    push

    This command will push the resources into the specified customer locations ready for install

    Options

    AWS

    Instructions for Amazon Web Services cloud environments

    -a auto create the s3 bucket
    -c aws ecr s3-bucket region
    ./ybdsw push -a -c aws 123456789.dkr.ecr.us-east-2.amazonaws.com ybd-data us-east-2
    Azure

    Instructions for Microsoft Azure cloud environments

    -a auto create the storage account
    -c azure acr storage-container region resource-group
    ./ybdsw push -a -c azure 123456789.azurecr.io ybd-data eastus my-resource-group

    Example

    The result of this would appear as:

    S3 Bucket contents:
      2023-08-23 20:26:45 11350 cdw/3-65-12-527-06079e02/functions/LICENSE.txt
      2023-08-23 20:26:45 549 cdw/3-65-12-527-06079e02/functions/NOTICE.txt
      2023-08-28 17:16:28 503 cdw/3-65-12-527-06079e02/functions/packages/CleanupLambdas/lambda.zip
      2023-08-28 17:16:29 1797 cdw/3-65-12-527-06079e02/functions/packages/CleanupLoadBalancers/lambda.zip
      2023-08-28 17:16:29 1209 cdw/3-65-12-527-06079e02/functions/packages/CleanupSecurityGroupDependencies/lambda.zip
      2023-08-28 17:16:31 17003610 cdw/3-65-12-527-06079e02/functions/packages/awscliLayer/lambda.zip
      .
      .
      .
      Repositories:
      "repositoryUri": "123456789.dkr.ecr.us-east-2.amazonaws.com/yellowbrick/ybd-worker",
      "repositoryUri": "123456789.dkr.ecr.us-east-2.amazonaws.com/grafana/loki",
      "repositoryUri": "123456789.dkr.ecr.us-east-2.amazonaws.com/yellowbrick/ybd-mgr",
      .
      .
      .
      "repositoryUri": "123456789.dkr.ecr.us-east-2.amazonaws.com/csi-secrets-store/driver",
      "repositoryUri": "123456789.dkr.ecr.us-east-2.amazonaws.com/kiwigrid/k8s-sidecar",

    Use the http URL for the cdw/3-65-12-527-06079e02/templates/yb-cdw.template.yaml in the Cloud Formation install

  • 6.3.0

    Standard or Scaled Shared Services

    Version 6.3 on AWS gives customers the flexibility to install Yellowbrick into a smaller cloud hardware footprint. The Standard Shared Services option creates fewer AWS node groups to run Yellowbrick software. The Scaled Shared Services option is intended for larger data warehouse environments that anticipate more than 100 active users and need more than 5TB of primary data storage.

    This feature is supported on AWS only; it is not yet supported for Azure deployments.

  • 6.3.0

    Proxy Support for Azure Deployments

    During Yellowbrick deployment on Azure, you can set options to route AKS-required network traffic through HTTP/HTTPS proxies.

  • 6.3.0

    ybtools Clients on Ubuntu

    Version 6.3.0 supports ybtools on Ubuntu 16.04 LTS, 18.04 LTS, and 20.04 LTS.

Known Issues in This Version

You may encounter the following issues in Version 6.9.3. Use the workarounds provided in the description and contact Customer Support for additional information.

Issue #Description
26340

Aborted or cancelled executions of ybload or LOAD TABLE against an Azure Storage may leave parts from multi-part uploads on the storage account.

31195

sys.log_query and historical query data in yellowbrick manager doesn't get updated, data keeps growing

31293

Query details requires default cluster to be up and running; inability to use arbitrary cluster from the dropdown.

31290

Query history information may not get rendered if there isn't a default cluster running.

34570

Kubelet does not respect container-log-max-size on time, during heavy log writes from container.

Issues Fixed in This Version

The following issues are addressed in this version:

ReleaseIssue #Description
6.9.336374

Fixed the WriteKRI RPC call to support KRI lists greater than 2 MB. Prior to this fix, sending such a large list would cause the worker to terminate, killing all running queries. This issue typically arose from deleting or updating a significant number of shards in a single statement.

6.9.336259, 36799

Fixed a DB frontend crash related to the usage of an incorrect memory context after aborting a query execution.

6.9.336863

Fixed an issue with CREATE REMOTE SERVER that ignore NOHOSTNAMECHECK option.

6.9.236511

Fixed an issue when running a single table restore for a table DDL with the cluster on.

6.9.236691

Upgraded ybtoken’s logging from log4j-1.2.17 to log4j2, which is used by ybtoken, to address several high priority CVEs.

6.9.236262

Fixed an issue with native memory leak held by ssl connection callbacks. This affects databases that establish many ssl connections for replication, backup or restore and load or unload.

6.9.134587

Support for NPGSQL 7.x and 8.x.

6.9.135025

In some cases of data reconstruction using parity, inter-query race conditions would lead to compute workers crashing because the parity solution employed overly stringent conditions for correctness verification. These conditions have now been relaxed to match the actual requirements.

6.9.135403

Resolved an issue on Azure where certain compute nodes failed to initialize properly. The problem stemmed from a race condition related to the specific number of network interfaces not being fully up and ready when the node was marked as available. This led to a failure in configuring the network setup, rendering the node correctly available but incapable of running the compute worker. The fix involves addressing the race condition by implementing a mechanism to ensure we wait for all interfaces to be up before completing the setup process.

6.9.133814

Fixed an error condition in the usage of the extended DB protocol that caused DROP DATABASE statements to rollback after the files had been removed from disk.

6.9.135774

Fixed a rare crash for SELECT statements, involving a large VARCHAR column of specific size.

6.9.035704

Fixed an issue where Ybunload could not complete multipart upload, when unloading parquet to Azure Data Lake Storage Gen2.

6.9.034140

Improved support for decorrelating operators mixing correlated and uncorrelated expressions on both sides. For instance:

select 0 = (select down.b from down where down.b = up.b + down.a) from up;
6.9.034286

Fixed case when a semi join being converted into an unique inner join would make the query fail with variable not found in subplan target lists

6.9.033162

The issue of YB backup failing when executed on a Disaster Recovery system concurrently with a replication cycle has been fixed.

6.9.035241

Fixed issue where an internal cache could grow above the defined capacity, resulting in potential memory issues and timing differences between query executions.

6.9.033228

Fixed issue with the values of the columns io_client_read_bytes & io_client_write_bytes, from the sys.log_query table, where the values were reversed.

6.9.027006

Fixed issue where manually stopping the lime service may fail because of low memory resources.

6.9.033988

The crash caused by an excessive number of open files or exceeding direct memory has been fixed.

6.9.034537

Fixed an issue by simplifying away explicit cast to same type when using operations on the decimal type that would cause the wrong precision/scale for the output.

6.9.034243

Adhere to IEEE754 standard when comparing floats against NaN values.

6.9.033343

Improved force cancellation of queries containing regular expressions that affect system stability.

6.8.135059

Create configurable truststore for keycloak with default cacerts as initial content.

6.8.13496

Fix the base diags to speed up collection of the node-specific logs.

6.8.034187

Diagnostics collection may fail if the selected time window is large.

6.8.034599

Improved the performance of auto analyze queries in order to reduce execution time in the system pool.

6.8.033239

Fixed a rare query deadlock when handling an aborted transaction during cleanup of written data.

6.8.030809

Utility queries (like CREATE USER and GRANT statements) were not persisted when using some drivers (e.g. JDBC).

6.8.032725

Utility queries (like CREATE USER and GRANT statements) were not persisted when run from procedures.

6.8.034128

CREATE/ALTER CLUSTER queries could not be used in procedures.

6.8.034064

Fixed an issue in ybunload when unloading parquet to s3 using output path with trailing slash.

6.8.034553

Fixed --max-file-size in ybunload when unloading compressed csv to s3.

6.8.034043

Fixed exception in ybbackup when backup path contain space.

6.8.034065

Fixed support for AWS SSO login with --object-store-profile in all java-based client tools.

6.8.034092

Fixed an issue in json_lookup() when lookup key contain special characters from latin9 or utf8. Note: this does not affect json_ingest(), no need to reindex existing data.

6.8.034174

Some backups could error out with: Abandoned due to client inactivity. This issue is rare and caused by a great number of backup chains in a single database that could delay the backup initialization phase.

6.7.033739

When using the Cloudformation installer to create a VPC network, the option CreateNATGateways must be set to “true” under all network conditions.

6.7.033799

Azure installation on full private/ UDR fails AKS 1.25 creation due to node count limit. Cluster's upper limit node count is 452 which exceeds the limit for Kubenet 400. If Autoscaler is enabled, the max-count from each node pool is counted towards this total.

6.7.029590

Restore may fail if backup media was moved. e.g. from on-premise to s3 or Azure.

6.7.033577

Use of LEFT(varchar f() , N) or RIGHT(varchar f(), N), N < 30 in a CTAS can cause system instability and possible outage.

6.7.033374

Duplicated targetList entries result in errors for distribution

6.7.033092

Issue was caused by the evaluation of a very deep expression comprised of thousands of OR expressions during the storage engine pushdown phase. This caused the corruption of internal data structures thus leading to a crash. Resolution - Cap the number of OR expressions during storage engine pushdown.

6.7.032529

Some types of correlated sub-queries could lead to DB error. In some rare circumstances, it could cause a DB restart. Queries of this type will now error out with - "This form of correlated subquery is not supported"

6.7.029487

Support Neteeza built-in functions LE_DST() (LEvenshtein DiSTance) and DLE_DST() (Damerau-LEvenshtein DiSTance).

6.7.031381

PostgreSQL CVE-2202-2625

6.7.029549

In some instances, the planner significantly underestimated LEFT joins containing a WHERE clause condition, resulting in poor planning and performance during execution.

6.7.028851

Sometimes on a busy cluster, we could timeout one of the sockets while sending data which caused error KE037 Something went wrong try again later. Fixed by recording and returning the known PG status (00000 or P0003)

6.7.016535

The issue where a TO_CHAR function call with a string casted to a timestamp with time zone as an argument would incorrectly return nothing has been fixed.

6.6.022160

Upgraded server side log4j.jar file to version 2.17.1

6.6.033592

Upgrade without administrative privileges

6.5.132571, 32542

The Java-based client tools (ybload, ybunload, ybbackup, ybrestore) do not support the --auth-token connection option. Support for this option is added in this release.

6.5.129045

BAR2: Could not create temp directory for caching of metadata for use with ybbar

6.5.131970

Could not handle object store path containing spaces on YbFileInfo/Ybload

6.5.132533

Could not support JSON lookup for not null column

6.5.132538

Unable to connect using --auth-token on all java based client tools (i.e. ybload)

6.5.132721

Accomodate user specified start/end time for diagnostics

6.4.031836

During AWS deployment, the Kubernetes external-dns software attempts to create DNS records in the most-specific variant when multiple Route 53 zones are present in a hierarchy. The documentation now states that you must either specify values for the most-specific variant, or values for a different DNS zone that does not have overlaps.

6.4.029683

In Version 6.4.0, the database row store alert message has been improved to indicate that it is the catalog row store that is becoming full.

6.3.032092

The GETBIT function returned wrong results when used with BIGINT columns.

6.3.031831

The YBCLUSTER environment variable was not supported for ybsql connections. This variable is now supported for all ybtools clients.

6.3.031747

The description of the contents of a backup bundle was improved in the Version 6.3.0 documentation.

6.3.031180

TIMEZONE, TIMEZONE_HOUR, and TIMEZONE_MINUTE date parts were not supported in EXTRACT and DATE_PART functions applied to TIMESTAMPTZ data types. These date parts are now supported.

6.3.025808

The Yellowbrick Manager Query Editor returned incorrect time zone information for casts to TIMESTAMP and TIMESTAMPTZ.

CVE Fixes in This Version

The following CVEs are addressed in this version:

ReleaseCVE FixDescription
6.9.3CVE-2024-27983

Overview node is a JavaScript runtime built on Chrome's V8 JavaScript engine. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a race condition in Http2Session when nghttp2 data is left in memory after a connection is reset while processing HTTP/2 CONTINUATION frames. An attacker can cause denial of service by sending such frames then triggering the Http2Session destructor. # Details Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users. Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime. One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines. When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries. Two common types of DoS vulnerabilities: * High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload. * Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package ## Remediation Upgrade node to version 18.20.1, 20.12.1, 21.7.2 or higher. ## References - CERT/CC Advisory - GitHub Commit - GitHub Commit - GitHub Commit - Node.js Release Notes - RedHat Bugzilla Bug - Vulnerability Report

6.9.3CVE-2018-5709

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

6.9.3CVE-2022-47007

An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

6.9.3CVE-2018-20657

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.

6.9.3CVE-2023-52356

A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.

6.9.3CVE-2007-2243

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483

6.9.3CVE-2020-14145

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

6.9.3CVE-2020-22916

An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase.

6.9.3CVE-2022-47011

An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

6.9.3CVE-2024-24758

Overview node is a JavaScript runtime built on Chrome's V8 JavaScript engine. Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains due to not clearing Proxy-Authentication headers on cross-origin redirects. An attacker can intercept the improperly cleared headers. ## Remediation Upgrade node to version 18.19.1, 20.11.1, 21.6.2 or higher. ## References - GitHub Commit - GitHub Commit - GitHub Commit - GitHub Commit - GitHub Commit

6.9.3CVE-2023-29383

In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

6.9.3CVE-2021-4189

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

6.9.3CVE-2024-20926

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

6.9.3CVE-2020-36325

An issue was discovered in Jansson through 2.13.1. Due to a parsing error in json_loads, there's an out-of-bounds read-access bug. NOTE: the vendor reports that this only occurs when a programmer fails to follow the API specification

6.9.3CVE-2024-2961

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

6.9.3CVE-2023-6237

This vulnerability has not been analyzed by NVD yet.

6.9.3CVE-2024-26461

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

6.9.3CVE-2023-46809

Overview node is a JavaScript runtime built on Chrome's V8 JavaScript engine. Affected versions of this package are vulnerable to Observable Timing Discrepancy due to the implementation of PKCS#1 v1.5 padding. An attacker can infer the private key used in the cryptographic operation by observing the time taken to execute cryptographic operations (Marvin). ## Remediation Upgrade node to version 18.19.1, 20.11.1, 21.6.2 or higher. ## References - GitHub Commit - GitHub Commit - GitHub Commit - RedHat Bugzilla Bug - Vulnerability Report

6.9.3CVE-2023-6129

The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions.

6.9.3CVE-2023-4421

The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS < 3.61.

6.9.3CVE-2018-20673

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm.

6.9.3CVE-2023-6879

Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc().

6.9.3CVE-2024-22019

Overview node is a JavaScript runtime built on Chrome's V8 JavaScript engine. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a lack of safeguards on chunk extension bytes. The server may read an unbounded number of bytes from a single connection, which allows an attacker to cause denial of service via CPU and network bandwidth exhaustion. ## Details Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users. Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime. One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines. When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries. Two common types of DoS vulnerabilities: * High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload. * Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package ## Remediation Upgrade node to version 18.19.1, 20.11.1, 21.6.2 or higher. ## References - GitHub Commit - GitHub Commit - GitHub Commit - RedHat Bugzilla Bug

6.9.3CVE-2013-4235

shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees.

6.9.3CVE-2023-1916

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.

6.9.3CVE-2023-45918

ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c.

6.9.3CVE-2023-48161

Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c

6.9.3CVE-2023-45853

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

6.9.3CVE-2023-6918

A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

6.9.3CVE-2024-2511

Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions.

6.9.3CVE-2024-20945

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).

6.9.3CVE-2023-32570

VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.

6.9.3CVE-2023-3164

A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.

6.9.3CVE-2024-22667

Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.

6.9.3CVE-2024-21892

Overview node is a JavaScript runtime built on Chrome's V8 JavaScript engine. Affected versions of this package are vulnerable to Code Injection due to the incorrect handling of environment variables on Linux when the process is running with elevated privileges that the current user lacks (does not apply to CAP_NET_BIND_SERVICE). ## Remediation Upgrade node to version 18.19.1, 20.11.1, 21.6.2 or higher. ## References - GitHub Commit - GitHub Commit - GitHub Commit - RedHat Bugzilla Bug

6.9.3CVE-2024-26462

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.

6.9.3CVE-2023-26965

loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image.

6.9.3CVE-2024-0727

Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack

6.9.3CVE-2021-45261

An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.

6.9.3CVE-2023-6277

An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB.

6.9.3CVE-2024-20921

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

6.9.3CVE-2024-25269

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack.

6.9.3CVE-2024-20952

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

6.9.3CVE-2017-9117

In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.

6.9.3CVE-2024-28757

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

6.9.3CVE-2022-4899

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

6.9.3CVE-2023-39130

GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap buffer overflow via the function pe_as16() at /gdb/coff-pe-read.c.

6.9.3CVE-2017-11164

In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

6.9.3CVE-2020-15719

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

6.9.3CVE-2021-40633

A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.

6.9.3CVE-2022-3857

A flaw was found in libpng 1.6.38. A crafted PNG image can lead to a segmentation fault and denial of service in png_setup_paeth_row() function.

6.9.3CVE-2021-33574

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

6.9.3CVE-2024-2236

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

6.9.3CVE-2023-26966

libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian.

6.9.3CVE-2024-26458

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

6.9.3CVE-2023-7008

A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.

6.9.3CVE-2024-28834

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

6.9.3CVE-2022-47008

An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

6.9.3CVE-2024-27982

Overview node is a JavaScript runtime built on Chrome's V8 JavaScript engine. Affected versions of this package are vulnerable to HTTP Request Smuggling via content length ofuscation. An attacker can smuggle an HTTP request by including a space before a Content-Length header. ## Remediation Upgrade node to version 18.20.1, 20.12.1, 21.7.2 or higher. ## References - GitHub Commit - GitHub Commit - GitHub Commit - Node.js Release Notes - Vulnerability Report

6.9.3CVE-2022-28506

There is a heap-buffer-overflow in GIFLIB 5.2.1 function DumpScreen2RGB() in gif2rgb.c:298:45.

6.9.3CVE-2024-22365

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

6.9.3CVE-2023-5678

Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow.

6.9.3CVE-2016-2568

pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

6.9.3CVE-2024-0553

A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.

6.9.3CVE-2011-4116

_is_safe in the File::Temp module for Perl does not properly handle symlinks.

6.9.3CVE-2022-3219

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

6.9.3CVE-2023-3618

A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.

6.9.3CVE-2023-50495

NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().

6.9.3CVE-2023-2953

A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.

6.9.3CVE-2007-5686

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

6.9.3CVE-2023-34969

D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.

6.9.3CVE-2022-45703

Heap buffer overflow vulnerability in binutils readelf before 2.40 via function display_debug_section in file readelf.c.

6.9.3CVE-2010-4756

The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.

6.9.2CVE-2009-4487

nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

6.9.2CVE-2019-8457

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.

6.9.2CVE-2017-7245

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.

6.9.2CVE-2019-20838

libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.

6.9.2CVE-2021-31239

An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.

6.9.2CVE-2023-39615

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out of bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.

6.9.2CVE-2021-36085

The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).

6.9.2CVE-2023-5981

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.

6.9.2CVE-2023-39804

This vulnerability has not been analyzed by NVD yet.

6.9.2CVE-2016-3709

Possible cross-site scripting vulnerability in libxml after commit 960f0e2.

6.9.2CVE-2023-36054

lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.

6.9.2CVE-2023-4911

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

6.9.2CVE-2023-3817

Checking excessively long DH keys or parameters may be very slow.

6.9.2CVE-2022-35737

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

6.9.2CVE-2021-36690

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library.

6.9.2CVE-2022-2309

NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.

6.9.2CVE-2021-36086

The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).

6.9.2CVE-2017-16231

In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used.

6.9.2CVE-2023-29491

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

6.9.2CVE-2023-3446

Checking excessively long DH keys or parameters may be very slow.

6.9.2CVE-2021-36087

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

6.9.2CVE-2020-13529

An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.

6.9.2CVE-2023-46218

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.

6.9.2CVE-2023-4806

A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss_gethostbyname2_r and nss_getcanonname_r hooks without implementing the nss*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

6.9.2CVE-2017-7246

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.

6.9.2CVE-2023-4813

A flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

6.9.2CVE-2022-48303

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

6.9.2CVE-2013-0337

The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.

6.9.2CVE-2022-1304

An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.

6.9.2CVE-2024-20932

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 17.0.9; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 21.3.8 and 22.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

6.9.2CVE-2023-47038

A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.

6.9.2CVE-2015-9019

In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.

6.9.2CVE-2021-36084

The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).

6.9.2CVE-2024-0567

A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.

6.9.2CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

6.9.2CVE-2020-16156

CPAN 2.28 allows Signature Verification Bypass.

6.9.2CVE-2023-46219

When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.

6.9.2CVE-2023-45322

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

6.9.2CVE-2021-33560

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

6.9.1CVE-2024-21626

AWS is aware of CVE-2024-21626, an issue affecting the runc component of several open source container management systems. Under certain conditions, an actor could leverage a specially crafted container or container configuration to access files or directories outside the container's file system namespace. An updated version of runc that addresses the issue is available for Amazon Linux 1 (runc-1.1.11-1.0.amzn1), Amazon Linux 2 (runc-1.1.11-1.amzn2) and for Amazon Linux 2023 (runc-1.1.11-1.amzn2023). AWS recommends that customers using runc or any container-related software apply those updates or a newer version.

6.9.1CVE-2023-6606

An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

6.9.1CVE-2023-49569

A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.Applications are only affected if they are using the ChrootOS "https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS" , which is th default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS "https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS" or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.

6.9.1CVE-2023-50447

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

6.9.1CVE-2023-6817

A use-after-free vulnerability in the Linux kernel's netfilter nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free. We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a.

6.9.1CVE-2024-0193

A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.

6.9.1CVE-2023-6932

A use-after-free vulnerability in the Linux kernel's ipv4 igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread. We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.

6.9.1CVE-2024-1086

A use-after-free vulnerability in the Linux kernel's netfilter nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

6.9.1CVE-2023-6931

A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

6.9.1CVE-2023-7104

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.NOTE https://sqlite.org/forum/forumpost/5bcbf4571cNOTE Fixed by https://sqlite.org/src/info/0e4e7a05c4204b47

6.9.1CVE-2023-6040

An out-of-bounds access vulnerability involving netfilter was reported and fixed as f1082dd31fe4 (netfilter nf_tables Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within nf_tables_newtable function enables an attacker to achieve out-of-bounds access.

6.9.1CVE-2023-39198

A race condition leading to a use-after-free issue was found in the QXL driver in the Linux kernel.

6.9.1CVE-2023-52340

When a router encounters an IPv6 packet too big to transmit to the next-hop, it returns an ICMP6 "Packet Too Big" (PTB) message to the sender. The sender caches this updated Maximum Transmission Unit (MTU) so it knows not to exceed this value when subsequently routing to the same host. In Linux kernels prior to 6.3, garbage collection is run on the IPv6 Destination Route Cache if the number of entries exceeds a threshold when adding the destination to the cache. This garbage collection examines every entry in the cache while holding a lock. In these affected kernel versions, a flood of the IPv6 ICMP6 PTB messages could cause high lock contention and increased CPU usage, leading to a Denial-of-Service. The fix backports the garbage collection improvements from Linux kernel 6.3 by bringing the IPv6 code closer to the IPv4 code, which does not have this issue. Patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=af6d10345ca76670c1b7c37799f0d5576ccef277

6.9.1CVE-2023-39325

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

6.9.1CVE-2022-32149

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

6.9.1CVE-2020-36773

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).

6.9.1CVE-2024-20932

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component Security). Supported versions that are affected are Oracle Java SE 17.0.9; Oracle GraalVM for JDK 17.0.9; Oracle GraalVM Enterprise Edition 21.3.8 and 22.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).

6.9.1CVE-2023-46751

An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer.

6.9.1CVE-2023-51764

Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports . but some other popular e-mail servers do not. To prevent attack variants (by always disallowing without ), a different solution is required the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.

6.9.1CVE-2023-47108

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.

6.9.1CVE-2023-29406

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

6.9.1CVE-2024-23849

In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access.

6.9.1CVE-2024-20952

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component Security). Supported versions that are affected are Oracle Java SE 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note This vulnerability applies to Java deployments, typically in clients running.

6.9.1CVE-2024-20918

A vulnerability that allows an attacker to execute arbitrary java code from the javascript engine even though the option "--no-java" was set.

6.9.1CVE-2024-0565

An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.

6.9.1CVE-2023-6531

A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.

6.9.1CVE-2023-42465

Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.

6.9.1CVE-2024-0646

An out-of-bounds memory write flaw was found in the Linux kernel's Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.

6.9.1CVE-2020-19187

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

6.9.1CVE-2020-19185

Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

6.9.1CVE-2020-19186

Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

6.9.1CVE-2016-0775

Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.

6.9.1CVE-2020-19188

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

6.9.1CVE-2020-19189

Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

6.9.1CVE-2023-6915

A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.

6.9.1CVE-2023-46838

A flaw has been found in Xen. An unprivileged guest can cause Denial of Service (DoS) of the host by sending network packets to the backend, causing the backend to crash.

6.9.1CVE-2023-46218

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with domain=co.UK when the URL used a lowercase hostname curl.co.uk, even though co.uk is listed as a PSL domain.

6.9.1CVE-2024-0584

A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an igmp query packet, leading to a kernel information leak.

6.9.1CVE-2023-38473

A reachable assertion was found in avahi_alternative_host_name.

6.9.1CVE-2023-43786

A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.

6.9.1CVE-2023-34969

D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.

6.9.1CVE-2023-38472

A reachable assertion was found in avahi_rdata_parse.

6.9.1CVE-2023-25153

Containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

6.9.1CVE-2023-30630

Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible.

6.9.1CVE-2024-0607

netfilter nf_tables fix pointer math issue in nft_byteorder_eval().

6.9.1CVE-2023-5388

It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are zero. This information can be used to mount a Bleichenbacher or Manger like attack against all RSA decryption operations. As the leak happens before any padding operations, it affects all padding modes PKCS#1 v1.5, OAEP, and RSASVP. Both API level calls and TLS server operation are affected.

6.9.1CVE-2022-48566

An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.

6.9.1CVE-2024-20921

Loop optimizations are not correct when induction variable overflows.

6.9.1CVE-2023-6135

Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121.

6.9.1CVE-2023-48795

AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A protocol extension has been introduced by OpenSSH which needs to be applied to both the client and the server in order to address this issue. We recommend customers update to the latest version of SSH.

6.9.1CVE-2024-20919

With carefully crafted custom bytecodes, arbitrary unverified bytecodes could be executed.

6.9.1CVE-2022-41721

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

6.9.1CVE-2022-47007

An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

6.9.1CVE-2022-47008

An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

6.9.1CVE-2024-22667

Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.

6.9.1CVE-2022-47010

An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

6.9.1CVE-2021-46174

Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37.

6.9.1CVE-2016-9189

Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.map_buffer in map.c component.

6.9.1CVE-2022-35205

An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause a denial of service.

6.9.1CVE-2023-46862

An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur.

6.9.1CVE-2020-19724

A memory consumption issue in get_data function in binutils/nm.c in GNU nm before 2.34 allows attackers to cause a denial of service via crafted command.

6.9.1CVE-2022-48064

GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.

6.9.1CVE-2023-3978

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

6.9.1CVE-2019-17595

There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

6.9.1CVE-2024-22195

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja xmlattr filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.

6.9.1CVE-2023-25173

containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well. This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the "USER $USERNAME" Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to ENTRYPOINT ["su", "-", "user"] to allow su to properly set up supplementary groups.

6.9.1CVE-2019-17594

There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

6.9.1CVE-2023-29409

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.

6.9.1CVE-2023-50495

NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().

6.9.1CVE-2023-1972

Potential heap based buffer overflow found in _bfd_elf_slurp_version_tables() in bfd/elf.c.

6.9.1CVE-2024-20945

Crypto key may be leaked via debug logging in some cases.

6.9.1CVE-2023-39326

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.

6.9.1CVE-2023-6121

An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).

6.9.1CVE-2023-45803

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like POST) to GET as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with redirects=False and disable automatic redirects with redirects=False and handle 301, 302, and 303 redirects manually by stripping the HTTP request body.

6.9.1CVE-2020-19190

Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

6.9.1CVE-2023-46219

When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.

6.9.1CVE-2023-48706

Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a :s command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive :s call causes free-ing of memory which may later then be accessed by the initial :s command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first 😒 command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue.

6.9.1CVE-2022-41409

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

6.9.1CVE-2024-22365

A vulnerability was found in Linux PAM. An unprivileged user that is not yet in a corresponding mount namespace with ~/tmp mounted as a polyinstantiated dir can place a FIFO there, and a subsequent attempt to login as this user with pam_namespace configured will cause the openat() in protect_dir() to block the attempt, causing a local denial of service.

6.9.1CVE-2023-46316

In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines.

6.9.1CVE-2024-20925

There are several integer overflows in the media handling.

6.9.1CVE-2024-20923

Missing validation may cause unexpected issues.

6.9.1CVE-2023-39804

It was discovered that tar incorrectly handled extended attributes in PAX archives. An attacker could supply a specially crafted file and cause tar to crash, resulting in a denial of service.

6.9.1CVE-2024-20922

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component JavaFX). Supported versions that are affected are Oracle Java SE 8u391; Oracle GraalVM Enterprise Edition 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).

6.9.1CVE-2022-40090

An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.

6.9.1CVE-2021-38115

read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.

6.9.1CVE-2024-0985

Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. As part of exploiting this vulnerability, the attacker creates functions that use CREATE RULE to convert the internally-built temporary table to a view. Versions before PostgreSQL 15.6, 14.11, 13.14, and 12.18 are affected. The only known exploit does not work in PostgreSQL 16 and later. For defense in depth, PostgreSQL 16.2 adds the protections that older branches are using to fix their vulnerability.

6.9.1CVE-2022-1056

Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd.

6.9.1CVE-2023-30775

A vulnerability was found in the libtiff library. This security flaw causes a heap buffer overflow in extractContigSamples32bits, tiffcrop.c.

6.9.1CVE-2022-31782

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.

6.9.1CVE-2019-6129

DISPUTED png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE a third party has stated "I don't think it is libpng's job to free this buffer."

6.9.1CVE-2021-40145

DISPUTED gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes."

6.9.1CVE-2021-46822

The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c.

6.9.1CVE-2013-0340

expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

6.9.1CVE-2021-40812

The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks.

6.9.1CVE-2020-36309

ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.

6.9.0CVE-2017-8291

Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

6.9.0CVE-2017-8779

rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.

6.9.0CVE-2017-1000117

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.

6.9.0CVE-2017-14492

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.

6.9.0CVE-2017-12615

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

6.9.0CVE-2017-12617

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

6.9.0CVE-2017-17405

Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.

6.9.0CVE-2018-1111

DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.

6.9.0CVE-2018-16509

An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.

6.9.0CVE-2018-17456

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.

6.9.0CVE-2020-1938

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising.

6.9.0CVE-2020-8617

Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.

6.9.0CVE-2023-3576

A memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes this memory leak issue, resulting an application crash, eventually leading to a denial of service.

6.9.0CVE-2022-1725

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959.

6.9.0CVE-2023-48237

Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit 6bf131888 which has been included in version 9.0.2112. Users are advised to upgrade. There are no known workarounds for this vulnerability.

6.9.0CVE-2020-19726

An issue was discovered in binutils libbfd.c 2.36 relating to the auxiliary symbol data allows attackers to read or write to system memory or cause a denial of service.

6.9.0CVE-2022-1771

Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.

6.9.0CVE-2023-47471

Buffer Overflow vulnerability in strukturag libde265 v1.10.12 allows a local attacker to cause a denial of service via the slice_segment_header function in the slice.cc component.

6.9.0CVE-2022-2042

Use After Free in GitHub repository vim/vim prior to 8.2.

6.9.0CVE-2023-5868

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.

6.9.0CVE-2023-48235

Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the overflow. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit 060623e which has been included in release version 9.0.2110. Users are advised to upgrade. There are no known workarounds for this vulnerability.

6.9.0CVE-2023-39417

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

6.9.0CVE-2022-35205

An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause a denial of service.

6.9.0CVE-2023-48236

Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has been addressed in commit 73b2d379 which has been included in release version 9.0.2111. Users are advised to upgrade. There are no known workarounds for this vulnerability.

6.9.0CVE-2023-43887

Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and num_tile_row parameters in the function pic_parameter_set::dump.

6.9.0CVE-2023-48231

Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit 25aabc2b which has been included in release version 9.0.2106. Users are advised to upgrade. There are no known workarounds for this vulnerability.

6.9.0CVE-2023-46246

Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function ga_grow_inner in in the file src/alloc.c at line 748, which is freed in the file src/ex_docmd.c in the function do_cmdline at line 1010 and then used again in src/cmdhist.c at line 759. When using the :history command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.

6.9.0CVE-2021-46174

Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37.

6.9.0CVE-2022-2000

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.

6.9.0CVE-2023-27102

Libde265 v1.0.11 was discovered to contain a segmentation violation via the function decoder_context::process_slice_segment_header at decctx.cc.

6.9.0CVE-2023-48234

Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit 58f9befca1 which has been included in release version 9.0.2109. Users are advised to upgrade. There are no known workarounds for this vulnerability.

6.9.0CVE-2023-5870

A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.

6.9.0CVE-2023-48233

Vim is an open source command line text editor. If the count after the 😒 command is larger than what fits into a (signed) long variable, abort with e_value_too_large. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit ac6378773 which has been included in release version 9.0.2108. Users are advised to upgrade. There are no known workarounds for this vulnerability.

6.9.0CVE-2023-5869

A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.

6.9.0CVE-2022-1897

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.

6.9.0CVE-2023-40745

LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.

6.9.0CVE-2023-27103

Libde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at motion.cc.

6.9.0CVE-2023-28531

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

6.9.0CVE-2023-41175

A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.

6.8.0CVE-2023-35945

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RST_STREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWAY frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to GOAWAY frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.

6.8.0CVE-2023-2975

The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence.

6.8.0CVE-2023-38545

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.

6.8.0CVE-2022-48174

There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.

6.8.0CVE-2023-2603

A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB.

6.8.0CVE-2023-2602

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

6.8.0CVE-2023-38039

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.

6.8.0CVE-2022-41862

In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.

6.8.0CVE-2023-38546

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

6.8.0CVE-2022-23491

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

6.8.0CVE-2023-32803

This vulnerability has not been analyzed by NVD yet.

6.8.0CVE-2023-2650

Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow.

6.7.0CVE-2015-20107

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

6.7.0CVE-2020-10735

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

6.7.0CVE-2020-19185

Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

6.7.0CVE-2020-19186

Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

6.7.0CVE-2020-19187

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

6.7.0CVE-2020-19188

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

6.7.0CVE-2020-19189

Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

6.7.0CVE-2020-19190

Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

6.7.0CVE-2020-27619

In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.

6.7.0CVE-2020-35448

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.

6.7.0CVE-2021-20197

There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

6.7.0CVE-2021-20284

A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The highest threat from this vulnerability is to system availability.

6.7.0CVE-2021-29921

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.

6.7.0CVE-2021-33294

In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) via crafted file.

6.7.0CVE-2021-3426

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.

6.7.0CVE-2021-3487

There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system availability by way of excessive memory consumption.

6.7.0CVE-2021-3530

A flaw was discovered in GNU libiberty within demangle_path() in rust-demangle.c, as distributed in GNU Binutils version 2.36. A crafted symbol can cause stack memory to be exhausted leading to a crash.

6.7.0CVE-2021-3549

An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.

6.7.0CVE-2021-36368

DISPUTED An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE the vendor's position is "this is not an authentication bypass, since nothing is being bypassed.

6.7.0CVE-2021-3733

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

6.7.0CVE-2021-3737

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

6.7.0CVE-2021-3826

Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.

6.7.0CVE-2021-41617

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

6.7.0CVE-2021-45078

stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE this issue exists because of an incorrect fix for CVE-2018-12699.

6.7.0CVE-2021-46195

GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.

6.7.0CVE-2022-2208

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163.

6.7.0CVE-2022-2210

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.

6.7.0CVE-2022-2257

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.

6.7.0CVE-2022-2264

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.

6.7.0CVE-2022-2284

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.

6.7.0CVE-2022-2285

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.

6.7.0CVE-2022-2286

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.

6.7.0CVE-2022-2287

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.

6.7.0CVE-2022-2289

Use After Free in GitHub repository vim/vim prior to 9.0.

6.7.0CVE-2022-2598

Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100.

6.7.0CVE-2022-3016

Use After Free in GitHub repository vim/vim prior to 9.0.0286.

6.7.0CVE-2022-3037

Use After Free in GitHub repository vim/vim prior to 9.0.0322.

6.7.0CVE-2022-3099

Use After Free in GitHub repository vim/vim prior to 9.0.0360.

6.7.0CVE-2022-37454

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

6.7.0CVE-2022-38533

In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file.

6.7.0CVE-2022-40433

An issue was discovered in function ciMethodBlocks::make_block_at in Oracle JDK (HotSpot VM) 11, 17 and OpenJDK (HotSpot VM) 8, 11, 17, allows attackers to cause a denial of service.

6.7.0CVE-2022-4285

An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599.

6.7.0CVE-2022-42919

Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine. Pickles can execute arbitrary code. Thus, this allows for local user privilege escalation to the user that any forkserver process is running as. Setting multiprocessing.util.abstract_sockets_supported to False is a workaround. The forkserver start method for multiprocessing is not the default start method. This issue is Linux specific because only Linux supports abstract namespace sockets. CPython before 3.9 does not make use of Linux abstract namespace sockets by default. Support for users manually specifying an abstract namespace socket was added as a bugfix in 3.7.8 and 3.8.3, but users would need to make specific uncommon API calls in order to do that in CPython before 3.9.

6.7.0CVE-2022-45061

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

6.7.0CVE-2022-47673

An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out of bound reads which may cause a denial of service or other unspecified impacts.

6.7.0CVE-2022-47696

An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols.

6.7.0CVE-2023-1579

Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in bfd_getl64.

6.7.0CVE-2023-2222

This vulnerability has not been analyzed by NVD yet.

6.7.0CVE-2023-22603

ConsultIDs none. Reason This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes none.

6.7.0CVE-2023-22604

ConsultIDs- none. Reason-This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes- none.

6.7.0CVE-2023-22605

ConsultIDs- none. Reason- This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes- none

6.7.0CVE-2023-22606

ConsultIDs- none. Reason- This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes- none

6.7.0CVE-2023-22609

ConsultIDs- none. Reason- This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes- none

6.7.0CVE-2023-24535

Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.

6.7.0CVE-2023-25584

An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.

CVE-2023-25585

A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service.

CVE-2023-25586

A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service.

6.7.0CVE-2023-25588

A flaw was found in Binutils. The field the_bfd of asymbolstruct is uninitialized in the bfd_mach_o_get_synthetic_symtab function, which may lead to an application crash and local denial of service.

6.7.0CVE-2023-32002

The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines- 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

6.7.0CVE-2023-32006

The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines- 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

6.7.0CVE-2023-32559

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines- 16.x, 18.x and, 20.x. The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the limits defined in a policy.json file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

6.7.0CVE-2023-38408

The PKCS 11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE this issue exists because of an incomplete fix for CVE-2016-10009.

6.7.0CVE-2023-40217

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)

6.7.0CVE-2023-4863

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity- Critical)

6.7.0CVE-2023-5129

This CVE- ID has been rejected or withdrawn by its CVE- Numbering Authority. Duplicate of CVE-2023-4863.

6.7.0CVE-2023-5156

A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.

6.5.0CVE-2023-2650

Possible DoS translating ASN.1 object identifiers

6.5.0CVE-2023-2975

AES-SIV implementation ignores empty associated data entries

6.5.0CVE-2023-3446

Excessive time spent checking DH keys and parameters

6.5.0CVE-2023-3817

Excessive time spent checking DH q parameter value

6.5.0CVE-2023-35945

Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec

6.5.0CVE-2022-29458

ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.

6.5.0CVE-2022-3715

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.

6.5.0CVE-2022-41409

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

6.5.0CVE-2022-4899

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

6.5.0CVE-2016-1585

In all versions of AppArmor mount rules are accidentally widened when compiled.

6.5.0CVE-2016-2568

pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

6.5.0CVE-2023-34969

D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon.

Parent topic:Yellowbrick Documentation