Vulnerabilidades de Debian

CVE-2022-0530 Média · 5.5 09/02/2022

A flaw was found in unzip 6.0. The vulnerability occurs during the conversion of an utf-8 string...

A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

CVE-2022-0529 Média · 5.5 CWE-787 09/02/2022

A flaw was found in unzip 6.0. The vulnerability occurs during the conversion of wide string to...

A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

CVE-2022-23990 Alta · 7.5 CWE-190 26/01/2022

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

CVE-2021-22600 Alta · 7.0 KEV Alta · 61 Exploit público CWE-415 26/01/2022

Linux Kernel Privilege Escalation Vulnerability

A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755

CVE-2022-0351 Alta · 7.8 CWE-119 25/01/2022

Access of Memory Location Before Start of Buffer in vim/vim

Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.

CVE-2022-23852 Crítica · 9.8 CWE-190 23/01/2022

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for...

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

CVE-2022-0235 Média · 6.1 CWE-200 16/01/2022

Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

CVE-2022-0213 Média · 6.6 CWE-122 14/01/2022

Heap-based Buffer Overflow in vim/vim

vim is vulnerable to Heap-based Buffer Overflow

CVE-2022-23219 Crítica · 9.8 CWE-120 14/01/2022

The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka...

The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

CVE-2022-23218 Crítica · 9.8 CWE-120 14/01/2022

The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library ...

The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

CVE-2022-23134 Média · 5.3 KEV Alta · 63 Exploit público CWE-287 13/01/2022

Zabbix Frontend Improper Access Control Vulnerability

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

CVE-2022-22827 Alta · 8.8 CWE-190 10/01/2022

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVE-2022-22826 Alta · 8.8 CWE-190 10/01/2022

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVE-2022-22825 Alta · 8.8 CWE-190 10/01/2022

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVE-2022-22824 Crítica · 9.8 CWE-190 10/01/2022

defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVE-2022-22823 Crítica · 9.8 CWE-190 10/01/2022

build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVE-2022-22822 Crítica · 9.8 CWE-190 10/01/2022

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVE-2021-45960 Alta · 8.8 CWE-682 01/01/2022

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts...

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).

CVE-2021-45949 Média · 5.5 CWE-787 31/12/2021

Out-of-bounds Write em Artifex Ghostscript

Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).

CVE-2021-4166 Alta · 7.1 CWE-125 25/12/2021

Out-of-bounds Read in vim/vim

vim is vulnerable to Out-of-bounds Read

CVE-2021-23450 Crítica · 9.8 CWE-1321 17/12/2021

Prototype Pollution

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

CVE-2021-0920 Média · 6.4 KEV Alta · 47 CWE-362 15/12/2021

Android Kernel Race Condition Vulnerability

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel

CVE-2021-45046 Crítica · 9.0 KEV Urgente · 90 Exploit público Ransomware CWE-917 14/12/2021

Apache Log4j2 Deserialization of Untrusted Data Vulnerability

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

CVE-2021-44228 Crítica · 10.0 KEV Urgente · 100 Exploit público Ransomware CWE-20 10/12/2021

Apache Log4j2 Remote Code Execution Vulnerability

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

CVE-2021-43797 Média · 6.5 CWE-444 09/12/2021

HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.