Fedoraproject Extra Packages For Enterprise Linux vulnerabilities, page 4
76 vulnerabilities
Known vulnerabilities in Fedoraproject Extra Packages For Enterprise Linux, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2023-5543ubuntumoodle+3
EPSS score0.25%
When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting.CVE-2023-5764debianansible+11EPSS score0.54%
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.CVE-2023-5341chainguardimagemagick-6+18EPSS score0.48%
A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.CVE-2023-32627debiansox+5EPSS score0.28%
A floating point exception vulnerability was found in sox, in the read_samples function at sox/src/voc.c:334:18. This flaw can lead to a denial of service.CVE-2023-30943ubuntumoodle+3EPSS score6.83%
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.CVE-2023-30944ubuntumoodle+3EPSS score1.14%
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database.CVE-2023-6395ubuntumock+4EPSS score1.55%
The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges. This weakness stems from the absence of proper sandboxing during the expansion and execution of Jinja2 templates, which may be included in certain configuration parameters. While the Mock documentation advises treating users added to the mock group as privileged, certain build systems invoking mock on behalf of users might inadvertently permit less privileged users to define configuration tags. These tags could then be passed as parameters to mock during execution, potentially leading to the utilization of Jinja2 templates for remote privilege escalation and the execution of arbitrary code as the root user on the build server.CVE-2023-3195debianimagemagick+8EPSS score0.50%
A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service.CVE-2023-3428chainguardimagemagick-6+6EPSS score0.31%
A heap-based buffer overflow vulnerability was found in coders/tiff.c in ImageMagick. This issue may allow a local attacker to trick the user into opening a specially crafted file, resulting in an application crash and denial of service.CVE-2023-34432debiansox+4EPSS score0.39%
A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure.CVE-2023-34475chainguardimagemagick-6+3EPSS score0.35%
A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c. An attacker could trick user to open a specially crafted file to convert, triggering an heap-use-after-free write error, allowing an application to crash, resulting in a denial of service.CVE-2023-34474chainguardimagemagick-6+9EPSS score0.37%
A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could trick the user in opening specially crafted file, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.CVE-2023-34152chainguardimagemagick-6+6EPSS score8.01%
A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured.CVE-2023-34318debiansox+4EPSS score0.27%
A heap buffer overflow vulnerability was found in sox, in the startread function at sox/src/hcom.c:160:41. This flaw can lead to a denial of service, code execution, or information disclosure.CVE-2023-34151chainguardimagemagick-6+13EPSS score0.95%
A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546).CVE-2023-34153chainguardimagemagick-6+4EPSS score3.14%
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.