Vulnerabilidades do Red Hat Enterprise Linux Server Eus

CVE-2021-4034 Alta · 7.8 KEV Urgente · 86 Exploit público Ransomware CWE-125 28/01/2022

Red Hat Polkit Out-of-Bounds Read and Write Vulnerability

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

CVE-2019-5544 Crítica · 9.8 KEV Urgente · 77 Exploit público Ransomware CWE-787 06/12/2019

VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

CVE-2019-3857 Alta · 8.8 CWE-190 25/03/2019

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2...

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVE-2019-3856 Alta · 8.8 CWE-190 25/03/2019

An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2...

An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVE-2019-3863 Alta · 8.8 CWE-787 25/03/2019

A flaw was found in libssh2 before 1.8.1. A server could send a multiple keyboard interactive...

A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.

CVE-2019-9948 Crítica · 9.1 CWE-22 23/03/2019

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for...

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

CVE-2019-3855 Alta · 8.8 CWE-190 21/03/2019

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2...

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVE-2019-9636 Crítica · 9.8 CWE-173 08/03/2019

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode...

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVE-2018-5407 Média · 4.7 Exploit público CWE-203 15/11/2018

Observable Discrepancy em Canonical Ubuntu Linux

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

CVE-2018-11784 Média · 4.3 CWE-601 04/10/2018

Apache Tomcat Open Redirect vulnerability

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

CVE-2018-14634 Alta · 7.8 KEV Alta · 63 Exploit público CWE-190 25/09/2018

Linux Kernel Integer Overflow Vulnerability

An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.

CVE-2016-9079 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-416 11/06/2018

Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

CVE-2018-1000007 Crítica · 9.8 24/01/2018

libcurl: vazamento de cabeçalhos de autenticação em redirecionamentos

libcurl 7.1 até 7.57.0 pode vazar acidentalmente dados de autenticação para terceiros. Quando solicitado a enviar cabeçalhos personalizados em suas requisições HTTP, o libcurl envia esse conjunto de cabeçalhos primeiro ao host da URL inicial, mas também, se solicitado a seguir redirecionamentos e uma resposta HTTP 30X for retornada, ao host mencionado na URL no valor do cabeçalho de resposta Location:. Enviar o mesmo conjunto de cabeçalhos a hosts subsequentes é um problema particular para aplicações que repassam cabeçalhos Authorization: personalizados, já que esse cabeçalho frequentemente contém informações sensíveis de privacidade ou dados que podem permitir que outros se passem pela requisição do cliente que usa libcurl.

CVE-2017-5645 Crítica · 9.8 Exploit público CWE-502 17/04/2017

Deserialization of Untrusted Data em Apache Software Foundation Log4j

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

CVE-2016-10165 Alta · 7.1 CWE-125 03/02/2017

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to...

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

CVE-2016-5388 Alta · 8.1 CWE-284 18/07/2016

Improper Access Control in Apache Tomcat

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.

CVE-2016-1839 Média · 5.5 Exploit público CWE-125 20/05/2016

The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X...

The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

CVE-2016-3427 Crítica · 9.8 KEV Alta · 63 CWE-284 21/04/2016

Oracle Java SE and JRockit Unspecified Vulnerability

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVE-2015-5123 Crítica · 9.8 KEV Alta · 60 CWE-416 14/07/2015

Adobe Flash Player Use-After-Free Vulnerability

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

CVE-2015-5122 Crítica · 9.8 KEV Urgente · 80 Exploit público CWE-416 14/07/2015

Adobe Flash Player Use-After-Free Vulnerability

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

CVE-2014-0196 Média · 5.5 KEV Alta · 61 Exploit público CWE-362 07/05/2014

Linux Kernel Race Condition Vulnerability

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.

CVE-2014-0160 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-125 07/04/2014

OpenSSL Information Disclosure Vulnerability

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.