Base de CVEs

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Attackers can send a client probe that fails the SOCKS version check to trigger a reply containing uninitialized bytes from the sin structure, exposing high bytes of a userspace pointer that weakens ASLR protections.

Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user.

Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.

Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to disclose information over a network.

Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory contents.

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stun_init_error_response_common_str() function in src/client/ns_turn_msg.c, which fails to zero-initialize the avalue buffer before computing its length with strlen() and copying leaked stack bytes into the ERROR-CODE reason phrase, exposing pointer fragments that weaken ASLR and enable precise version fingerprinting.