Fedoraproject Extra Packages For Enterprise Linux vulnerabilities, page 2
76 vulnerabilities
Known vulnerabilities in Fedoraproject Extra Packages For Enterprise Linux, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2022-2163debianchromium+4
EPSS score0.84%
Use after free in Cast UI and Toolbar in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via UI interaction.CVE-2022-2158debianchromium+4EPSS score1.06%
Type confusion in V8 in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2022-2296debianchromium+4EPSS score1.15%
Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 103.0.5060.114 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via direct UI interactions.CVE-2022-2294appleipados+20KEVRansomwareEPSS score70.83%
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2022-2719chainguardimagemagick-6+3EPSS score0.34%
In ImageMagick, a crafted file could trigger an assertion failure when a call to WriteImages was made in MagickWand/operation.c, due to a NULL image list. This could potentially cause a denial of service. This was fixed in upstream ImageMagick version 7.1.0-30.CVE-2022-2295debianchromium+4EPSS score1.46%
Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2022-0571ubuntuphoronix-test-suite+4EPSS score1.31%
Cross-site Scripting (XSS) - Reflected in GitHub repository phoronix-test-suite/phoronix-test-suite prior to 10.8.2.CVE-2022-0546blenderblender+5EPSS score1.17%
A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause denial of service, memory corruption or potentially code execution.CVE-2022-0367debianlibmodbus+7EPSS score0.46%
A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.CVE-2022-0725ubuntukeepass2+3EPSS score2.82%
A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs.CVE-2022-0983ubuntumoodle+3EPSS score0.91%
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.CVE-2022-4144debianqemu+238EPSS score0.29%
An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.CVE-2022-4318fedoraprojectextra_packages_for_enterprise_linux+10EPSS score0.29%
A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.CVE-2022-4170debianrxvt-unicode+10EPSS score2.22%
The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set.CVE-2022-25648debianruby-git+7EPSS score4.91%
The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.CVE-2022-27191chainguarddex-k8s-authenticator+64EPSS score3.93%
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.CVE-2022-24882debianfreerdp2+5EPSS score2.85%
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.CVE-2022-45152ubuntumoodle+3EPSS score1.44%
A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.CVE-2022-28327ubuntugolang-1.17+5EPSS score4.16%
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.CVE-2022-32546debianimagemagick+5EPSS score1.40%
A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.