CVE-2022-26125

frrouting: overflow bugs in unpack_tlv_router_cap

Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed

Vendors

Frrouting Redhat

Products

Frrouting Enterprise Linux

CVE-2021-41229

Memory leak in BlueZ

BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can be a very large object, which can be caused by an attacker continuously sending sdp packets and this may cause the service of the target device to crash.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Bluez Debian Redhat

Products

Bluez Debian Linux Enterprise Linux

CVE-2021-33621

ruby/cgi-gem: HTTP response splitting in CGI

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Fedoraproject Redhat Ruby-lang

Products

Fedora Enterprise Linux Rhel Eus and 3 more

CVE-2019-1387

git: Remote code execution in recursive clones with nested submodules

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

CVSS 3.1 · 8.8 High EPSS 4.4% KEV · Not listed

Vendors

Git-scm Redhat

Products

Git Enterprise Linux Rhel E4s and 1 more

CVE-2017-9798

httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.

CVSS 3.1 · 7.5 High EPSS 94.7% KEV · Not listed

Vendors

Apache Debian Redhat

Products

Http Server Debian Linux Enterprise Linux and 5 more

CVE-2017-3167

httpd: ap_get_basic_auth_pw() authentication bypass

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.

CVSS 3.1 · 9.8 Critical EPSS 20.2% KEV · Not listed

Vendors

Apache Apple Debian and 3 more

Products

Http Server Mac Os X Debian Linux and 14 more

CVE-2024-56337

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.

CVSS 3.1 · 9.8 Critical EPSS 9.0% KEV · Not listed

Vendors

Apache Netapp Redhat

Products

Tomcat Bootstrap Os Hci Compute Node and 1 more

CVE-2024-53104

media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.

CVSS 3.1 · 7.8 High EPSS 3.4% KEV · Listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 7 more

CVE-2024-9680

firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill)

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

CVSS 3.1 · 9.8 Critical EPSS 23.2% KEV · Listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 7 more

CVE-2020-6819

Mozilla: Use-after-free while running the nsDocShell destructor

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

CVSS 3.1 · 8.1 High EPSS 3.0% KEV · Listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux and 1 more

CVE-2020-6820

Mozilla: Use-after-free when handling a ReadableStream

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

CVSS 3.1 · 8.1 High EPSS 7.1% KEV · Listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux and 1 more

CVE-2019-17026

Mozilla: IonMonkey type confusion with StoreElementHole and FallibleStoreElement

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.

CVSS 3.1 · 8.8 High EPSS 46.3% KEV · Listed

Vendors

Canonical Mozilla Redhat

Products

Ubuntu Linux Firefox Thunderbird and 2 more

CVE-2016-9079

Mozilla: Firefox SVG Animation Remote Code Execution (MFSA 2016-92)

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

CVSS 3.1 · 7.5 High EPSS 87.4% KEV · Listed

Vendors

Debian Microsoft Mozilla and 2 more

Products

Debian Linux Windows Firefox and 8 more

CVE-2024-9401

firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3

Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 6 more

CVE-2024-9394

firefox: thunderbird: Cross-origin access to JSON contents through multipart responses

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 6 more

CVE-2024-9393

firefox: thunderbird: Cross-origin access to PDF contents through multipart responses

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 6 more

CVE-2024-9392

firefox: thunderbird: Compromised content process can bypass site isolation

A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 6 more

CVE-2024-9026

PHP-FPM logs from children may be altered

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux

CVE-2024-8929

Leak partial content of the heap through heap buffer over-read in mysqlnd

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.

CVSS 3.1 · 5.8 Medium EPSS 2.2% KEV · Not listed

Vendors

Php Php Group Redhat

Products

Php Php Enterprise Linux

CVE-2024-8927

cgi.force_redirect configuration is bypassable due to the environment variable collision

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux