| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Use after free in Windows System Events Broker allows an authorized attacker to disclose information locally. |
| Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.
These conversions store each wide input character into the caller's char array as a multibyte sequence. The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte. A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end. The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process. An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.
The narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon. This issue affects all architectures and ABIs supported by the GNU C Library. |
| Missing authorization in the JSON-RPC web services interface
of Extreme Networks Switch Engine (EXOS) allows an authenticated,
low-privileged (read-only) user to execute CLI show commands that are
restricted to that role through the command line interface. Successful
exploitation results in disclosure of sensitive information, including the
device configuration and the password hashes of local accounts. Configuration,
enable, and debug commands are not affected. Disclosed password hashes can be
attacked offline, and a weak password could lead to administrative access to
the device. This issue is fixed in Switch Engine 33.7.1-patch1-11,
33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.
Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure. |
| Double free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally. |
| An elevation of privilege vulnerability exists when the Windows Cryptography Next Generation (CNG) Key Isolation service improperly handles memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.
The security update addresses the vulnerability by correcting how the Windows CNG Key Isolation Service handles memory. |
| Affected versions of Git have a heap buffer overflow in the three-way merge
code (xdiff), which an attacker can trigger through a repository they
control.
When Git merges a file, it first adds up the size of the merged
output, allocates a buffer of that size, and then writes the output into
it. That total was kept in a 32-bit signed integer. The
conflict-marker-size attribute, which can be set from a committed
.gitattributes file, accepts any positive integer, and the markers are
written several times for every conflict. A small file with a huge marker
size and many separate conflicts can therefore push the total past 4 GiB,
so the integer wraps to a small value and Git writes attacker-controlled
merge output past the end of a buffer that is too small. At minimum this
crashes Git, and because the overflow is large and its contents are largely
attacker-controlled, worse heap corruption is possible.
Any command that does a textual three-way merge can trigger it, such
as git-merge(1), git-rebase(1), git-cherry-pick(1), and
git-merge-tree(1). The latter is most likely a target for Git forges,
which might use git-merge-tree(1) on the server-side to check
mergeability. When the server reads attributes from trees in the
repository (for example through attr.tree or --attr-source), any
user who can push branches and request that they be merged (for
example by opening a pull or merge request) can trigger the overflow
without anyone else doing anything, and the data they push is small
because the oversized output only appears during the merge.
The problem has been patched by computing the size as size_t and
checking every addition for overflow, so Git stops with an error
instead of overflowing.
Servers that cannot upgrade right away can add
* conflict-marker-size=7
to each repository's info/attributes as a workaround, which overrides
any in-tree .gitattributes, or turn off server-side mergeability checks for
untrusted repositories. |
| In event_set_sub of acropora_event.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation. |
| In handle_rx_msg of tipc_virtio_dev, there is a possible Double Fetch TOCTOU due to Double Fetch. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation. |
| Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| Operation on a resource after expiration or release in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to swap out a guest device without the guest's knowledge, potentially resulting in a loss of confidentiality and integrity. |
| Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| Stack-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| Double free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. |
| An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.
To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.
The security update addresses the vulnerability by ensuring the Windows Kernel properly handles objects in memory. |
