Redhat Enterprise Linux For Power Little Endian Eus vulnerabilities, page 5

97 vulnerabilities

Known vulnerabilities in Redhat Enterprise Linux For Power Little Endian Eus, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.5MediumCVE-2023-4527chainguard · glibc +29 moreGlibc: stack read overflow in getaddrinfo in no-aaaa modeA flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.EPSS1.67%5.9MediumCVE-2023-4806debian · glibc +24 moreGlibc: potential use-after-free in getaddrinfo()A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.EPSS1.61%6.5MediumCVE-2023-38201fedoraproject · fedora +13 moreKeylime: challenge-response protocol bypass during agent registrationA flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.EPSS0.49%7.5HighCVE-2023-38200fedoraproject · fedora +13 moreKeylime: registrar is subject to a dos against ssl connectionsA flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.EPSS1.45%4.4MediumCVE-2023-5870Alpine Linuxalpine · postgresql14 +34 morePostgresql: role pg_signal_backend can signal certain superuser processes.A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.EPSS2.56%7.8HighCVE-2023-5633debian · linux +92 moreKernel: vmwgfx: reference count issue leads to use-after-free in surface handlingThe reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.EPSS0.28%5.9MediumCVE-2023-5992debian · opensc +31 moreOpensc: side-channel leaks while stripping encryption pkcs#1 paddingA vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data.EPSS1.16%7.5HighCVE-2023-5157debian · galera-4 +14 moreMariadb: node crashes with transport endpoint is not connected mysqld got signal 6A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service.EPSS2.26%4.3MediumCVE-2023-5868Alpine Linuxalpine · postgresql14 +33 morePostgresql: memory disclosure in aggregate function callsA memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.EPSS2.77%6.5MediumCVE-2023-5455debian · freeipa +76 moreIpa: invalid csrf protectionA Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.EPSS0.57%8.8HighCVE-2023-5869Alpine Linuxalpine · postgresql14 +82 morePostgresql: buffer overrun from integer overflow in array modificationA flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.EPSS4.32%7.5HighCVE-2023-6356debian · linux +129 moreKernel: null pointer dereference in nvmet_tcp_build_iovecA flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing kernel panic and a denial of service.EPSS1.46%7.5HighCVE-2023-6535chainguard · hyperv-daemons-6.18 +206 moreKernel: null pointer dereference in nvmet_tcp_execute_requestA flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.EPSS1.55%7.5HighCVE-2023-6536debian · linux +129 moreKernel: null pointer dereference in __nvmet_req_completeA flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.EPSS1.55%7.8HighCVE-2023-3972redhat · enterprise_linux +19 moreInsights-client: unsafe handling of temporary files and directoriesA vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local user or attacker could create the /var/tmp/insights-client directory (owning the directory with read, write, and execute permissions) on the system. After the insights-client is registered by root, an attacker could then control the directory content that insights are using by putting malicious scripts into it and executing arbitrary code as root (trivially bypassing SELinux protections because insights processes are allowed to disable SELinux system-wide).EPSS0.27%7.1HighCVE-2023-3758debian · sssd +113 moreSssd: race condition during authorization leads to gpo policies functioning inconsistentlyA race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.EPSS1.03%7.8HighCVE-2023-3899fedoraproject · fedora +41 moreSubscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configurationA vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.EPSS0.24%