Fedoraproject Fedora vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Fedoraproject Fedora: 407 record(s), with affected versions and fixes.cpe:2.3:o:fedoraproject:fedora
CVE-2022-2210
High · 7.8
CWE-787 Jun 27, 2022
Out-of-bounds Write in vim/vim
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
CVE-2022-2208
Medium · 5.5
CWE-476 Jun 27, 2022
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163.
CVE-2022-2207
High · 7.8
CWE-122 Jun 27, 2022
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
CVE-2022-2206
High · 7.8
CWE-125 Jun 26, 2022
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
CVE-2022-2183
High · 7.8
CWE-125 Jun 23, 2022
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
CVE-2022-2182
High · 7.8
CWE-122 Jun 23, 2022
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
CVE-2022-33070
Medium · 5.5
Jun 23, 2022
Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function...
Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
CVE-2022-2175
High · 7.8
CWE-125 Jun 23, 2022
Buffer Over-read in vim/vim
Buffer Over-read in GitHub repository vim/vim prior to 8.2.
CVE-2022-2068
High · 7.3
CWE-78 Jun 21, 2022
The c_rehash script allows command injection
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).
CVE-2022-2129
High · 7.8
CWE-787 Jun 19, 2022
Out-of-bounds Write in vim/vim
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
CVE-2022-2126
High · 7.8
CWE-125 Jun 19, 2022
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
CVE-2022-2125
High · 7.8
CWE-122 Jun 19, 2022
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
CVE-2022-2124
High · 7.8
CWE-126 Jun 19, 2022
Buffer Over-read in vim/vim
Buffer Over-read in GitHub repository vim/vim prior to 8.2.
CVE-2022-21166
Medium · 5.5
CWE-459 Jun 15, 2022
Incomplete cleanup in specific special register write operations for some Intel(R)…
Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2022-21125
Medium · 5.5
CWE-459 Jun 15, 2022
Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an...
Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2022-21123
Medium · 5.5
CWE-459 Jun 15, 2022
Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an...
Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2022-31813
Critical · 9.8
CWE-345 Jun 9, 2022
mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
CVE-2022-32511
Critical · 9.8
Jun 6, 2022
jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where…
jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
CVE-2022-32250
High · 7.8
CWE-416 Jun 2, 2022
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to...
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.
CVE-2022-27776
Medium · 6.5
CWE-522 Jun 2, 2022
Insufficiently Protected Credentials in Haxx Curl
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
CVE-2022-1674
Medium · 5.5
CWE-476 May 12, 2022
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in vim/vim
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input.
CVE-2022-1620
High · 7.5
CWE-476 May 8, 2022
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in vim/vim
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input.
CVE-2022-1619
High · 7.8
CWE-122 May 8, 2022
Heap-based Buffer Overflow in function cmdline_erase_chars in vim/vim
Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution
CVE-2022-1616
High · 7.8
CWE-416 May 7, 2022
Use after free in append_command in vim/vim
Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
CVE-2022-1292
High · 7.3
CWE-78 May 3, 2022
The c_rehash script allows command injection
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).