Gnu vulnerabilities

CVE-2019-18276 High · 7.8 CWE-273 Nov 27, 2019

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By...

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

CVE-2019-19126 Low · 3.3 CWE-665 Nov 19, 2019

On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the...

On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

CVE-2019-12290 High · 7.5 CWE-20 Oct 22, 2019

GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2...

GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.

CVE-2019-18224 Critical · 9.8 CWE-787 Oct 21, 2019

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via...

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

CVE-2019-15847 High · 7.5 CWE-331 Sep 2, 2019

The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple...

The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.

CVE-2019-1010180 High · 7.8 CWE-125 Jul 24, 2019

GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is:...

GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet.

CVE-2019-14250 Medium · 5.5 CWE-190 Jul 24, 2019

Integer Overflow or Wraparound in Gnu Binutils

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.

CVE-2019-1010025 Medium · 5.3 CWE-330 Jul 15, 2019

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap...

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.

CVE-2019-1010024 Medium · 5.3 CWE-200 Jul 15, 2019

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using...

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

CVE-2019-1010023 Medium · 5.4 Jul 15, 2019

GNU Libc current is affected by: Re-mapping current loaded libray with malicious ELF file. The...

GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

CVE-2019-1010022 Critical · 9.8 CWE-119 Jul 15, 2019

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack...

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

CVE-2019-12972 Medium · 5.5 CWE-125 Jun 26, 2019

Out-of-bounds Read in Gnu Binutils

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character.

CVE-2018-12886 High · 8.1 CWE-209 May 22, 2019

stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler...

stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.

CVE-2019-9923 High · 7.5 CWE-476 Mar 22, 2019

pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing...

pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.

CVE-2019-9169 Critical · 9.8 CWE-125 Feb 25, 2019

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has...

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

CVE-2019-7309 Medium · 5.5 Feb 3, 2019

In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32...

In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.

CVE-2016-10739 Medium · 5.3 CWE-20 Jan 21, 2019

In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would...

In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.

CVE-2019-6488 High · 7.8 CWE-404 Jan 18, 2019

The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the...

The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32 architecture, incorrectly attempts to use a 64-bit register for size_t in assembly codes, which can lead to a segmentation fault or possibly unspecified other impact, as demonstrated by a crash in __memmove_avx_unaligned_erms in sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S during a memcpy.

CVE-2018-20482 Medium · 4.7 CWE-835 Dec 26, 2018

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which...

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).

CVE-2018-19591 High · 7.5 CWE-20 Dec 4, 2018

In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname...

In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

CVE-2018-18700 Medium · 5.5 CWE-835 Oct 29, 2018

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31....

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions d_name(), d_encoding(), and d_local_name() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.

CVE-2016-10228 Medium · 5.9 CWE-20 Mar 1, 2017

The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with...

The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.

CVE-2015-1197 Low · 1.9 Feb 19, 2015

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to...

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

CVE-2014-6278 High · 8.8 KEV Urgent · 76 Public exploit CWE-78 Sep 30, 2014

GNU Bash OS Command Injection Vulnerability

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.

CVE-2014-7169 Critical · 9.8 KEV Urgent · 77 Public exploit CWE-78 Sep 24, 2014

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.