Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2011-1154

Summary
Assigner-redhat
Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749
Published At-30 Mar, 2011 | 22:00
Updated At-06 Aug, 2024 | 22:14
Rejected At-
Credits

The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:redhat
Assigner Org ID:53f830b8-0a3f-465b-8143-3b8a9948e749
Published At:30 Mar, 2011 | 22:00
Updated At:06 Aug, 2024 | 22:14
Rejected At:
▼CVE Numbering Authority (CNA)

The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.

Affected Products
Vendor
n/a
Product
n/a
Versions
Affected
  • n/a
Problem Types
TypeCWE IDDescription
textN/An/a
Type: text
CWE ID: N/A
Description: n/a
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
http://openwall.com/lists/oss-security/2011/03/04/19
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/04/16
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/04/25
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/04/30
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/04/26
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/10/3
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/04/28
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/08/5
mailing-list
x_refsource_MLIST
http://secunia.com/advisories/43955
third-party-advisory
x_refsource_SECUNIA
http://openwall.com/lists/oss-security/2011/03/07/5
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/04/31
mailing-list
x_refsource_MLIST
http://www.vupen.com/english/advisories/2011/0961
vdb-entry
x_refsource_VUPEN
http://openwall.com/lists/oss-security/2011/03/04/17
mailing-list
x_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=680796
x_refsource_CONFIRM
http://openwall.com/lists/oss-security/2011/03/10/6
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/06/3
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/04/29
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/07/6
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/05/6
mailing-list
x_refsource_MLIST
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html
vendor-advisory
x_refsource_FEDORA
http://openwall.com/lists/oss-security/2011/03/05/4
mailing-list
x_refsource_MLIST
http://www.vupen.com/english/advisories/2011/0791
vdb-entry
x_refsource_VUPEN
http://www.mandriva.com/security/advisories?name=MDVSA-2011:065
vendor-advisory
x_refsource_MANDRIVA
http://openwall.com/lists/oss-security/2011/03/07/11
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/23/11
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/06/5
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/04/18
mailing-list
x_refsource_MLIST
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html
vendor-advisory
x_refsource_FEDORA
http://openwall.com/lists/oss-security/2011/03/10/2
mailing-list
x_refsource_MLIST
http://www.redhat.com/support/errata/RHSA-2011-0407.html
vendor-advisory
x_refsource_REDHAT
http://openwall.com/lists/oss-security/2011/03/11/3
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/10/7
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/05/8
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/04/22
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/11/5
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/04/27
mailing-list
x_refsource_MLIST
http://www.vupen.com/english/advisories/2011/0872
vdb-entry
x_refsource_VUPEN
http://openwall.com/lists/oss-security/2011/03/04/32
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/14/26
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/04/24
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/06/4
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/06/6
mailing-list
x_refsource_MLIST
http://openwall.com/lists/oss-security/2011/03/04/33
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/19
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/16
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/25
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/30
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/26
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/3
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/28
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/08/5
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://secunia.com/advisories/43955
Resource:
third-party-advisory
x_refsource_SECUNIA
Hyperlink: http://openwall.com/lists/oss-security/2011/03/07/5
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/31
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://www.vupen.com/english/advisories/2011/0961
Resource:
vdb-entry
x_refsource_VUPEN
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/17
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=680796
Resource:
x_refsource_CONFIRM
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/6
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/3
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/29
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/07/6
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/05/6
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html
Resource:
vendor-advisory
x_refsource_FEDORA
Hyperlink: http://openwall.com/lists/oss-security/2011/03/05/4
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://www.vupen.com/english/advisories/2011/0791
Resource:
vdb-entry
x_refsource_VUPEN
Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2011:065
Resource:
vendor-advisory
x_refsource_MANDRIVA
Hyperlink: http://openwall.com/lists/oss-security/2011/03/07/11
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/23/11
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/5
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/18
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html
Resource:
vendor-advisory
x_refsource_FEDORA
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/2
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://www.redhat.com/support/errata/RHSA-2011-0407.html
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: http://openwall.com/lists/oss-security/2011/03/11/3
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/7
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/05/8
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/22
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/11/5
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/27
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://www.vupen.com/english/advisories/2011/0872
Resource:
vdb-entry
x_refsource_VUPEN
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/32
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/14/26
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/24
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/4
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/6
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/33
Resource:
mailing-list
x_refsource_MLIST
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
http://openwall.com/lists/oss-security/2011/03/04/19
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/04/16
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/04/25
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/04/30
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/04/26
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/10/3
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/04/28
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/08/5
mailing-list
x_refsource_MLIST
x_transferred
http://secunia.com/advisories/43955
third-party-advisory
x_refsource_SECUNIA
x_transferred
http://openwall.com/lists/oss-security/2011/03/07/5
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/04/31
mailing-list
x_refsource_MLIST
x_transferred
http://www.vupen.com/english/advisories/2011/0961
vdb-entry
x_refsource_VUPEN
x_transferred
http://openwall.com/lists/oss-security/2011/03/04/17
mailing-list
x_refsource_MLIST
x_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=680796
x_refsource_CONFIRM
x_transferred
http://openwall.com/lists/oss-security/2011/03/10/6
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/06/3
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/04/29
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/07/6
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/05/6
mailing-list
x_refsource_MLIST
x_transferred
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html
vendor-advisory
x_refsource_FEDORA
x_transferred
http://openwall.com/lists/oss-security/2011/03/05/4
mailing-list
x_refsource_MLIST
x_transferred
http://www.vupen.com/english/advisories/2011/0791
vdb-entry
x_refsource_VUPEN
x_transferred
http://www.mandriva.com/security/advisories?name=MDVSA-2011:065
vendor-advisory
x_refsource_MANDRIVA
x_transferred
http://openwall.com/lists/oss-security/2011/03/07/11
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/23/11
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/06/5
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/04/18
mailing-list
x_refsource_MLIST
x_transferred
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html
vendor-advisory
x_refsource_FEDORA
x_transferred
http://openwall.com/lists/oss-security/2011/03/10/2
mailing-list
x_refsource_MLIST
x_transferred
http://www.redhat.com/support/errata/RHSA-2011-0407.html
vendor-advisory
x_refsource_REDHAT
x_transferred
http://openwall.com/lists/oss-security/2011/03/11/3
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/10/7
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/05/8
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/04/22
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/11/5
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/04/27
mailing-list
x_refsource_MLIST
x_transferred
http://www.vupen.com/english/advisories/2011/0872
vdb-entry
x_refsource_VUPEN
x_transferred
http://openwall.com/lists/oss-security/2011/03/04/32
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/14/26
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/04/24
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/06/4
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/06/6
mailing-list
x_refsource_MLIST
x_transferred
http://openwall.com/lists/oss-security/2011/03/04/33
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/19
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/16
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/25
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/30
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/26
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/3
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/28
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/08/5
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://secunia.com/advisories/43955
Resource:
third-party-advisory
x_refsource_SECUNIA
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/07/5
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/31
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://www.vupen.com/english/advisories/2011/0961
Resource:
vdb-entry
x_refsource_VUPEN
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/17
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=680796
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/6
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/3
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/29
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/07/6
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/05/6
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html
Resource:
vendor-advisory
x_refsource_FEDORA
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/05/4
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://www.vupen.com/english/advisories/2011/0791
Resource:
vdb-entry
x_refsource_VUPEN
x_transferred
Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2011:065
Resource:
vendor-advisory
x_refsource_MANDRIVA
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/07/11
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/23/11
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/5
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/18
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html
Resource:
vendor-advisory
x_refsource_FEDORA
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/2
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://www.redhat.com/support/errata/RHSA-2011-0407.html
Resource:
vendor-advisory
x_refsource_REDHAT
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/11/3
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/7
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/05/8
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/22
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/11/5
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/27
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://www.vupen.com/english/advisories/2011/0872
Resource:
vdb-entry
x_refsource_VUPEN
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/32
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/14/26
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/24
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/4
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/6
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/33
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:secalert@redhat.com
Published At:30 Mar, 2011 | 22:55
Updated At:11 Apr, 2025 | 00:51

The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary2.06.9MEDIUM
AV:L/AC:M/Au:N/C:C/I:C/A:C
Primary2.06.9MEDIUM
AV:L/AC:M/Au:N/C:C/I:C/A:C
Type: Primary
Version: 2.0
Base score: 6.9
Base severity: MEDIUM
Vector:
AV:L/AC:M/Au:N/C:C/I:C/A:C
Type: Primary
Version: 2.0
Base score: 6.9
Base severity: MEDIUM
Vector:
AV:L/AC:M/Au:N/C:C/I:C/A:C
CPE Matches
Gentoo Foundation, Inc.
gentoo
>>logrotate>>Versions up to 3.7.9(inclusive)
cpe:2.3:a:gentoo:logrotate:*:*:*:*:*:*:*:*
Gentoo Foundation, Inc.
gentoo
>>logrotate>>3.3
cpe:2.3:a:gentoo:logrotate:3.3:r2:*:*:*:*:*:*
Gentoo Foundation, Inc.
gentoo
>>logrotate>>3.5.9
cpe:2.3:a:gentoo:logrotate:3.5.9:*:*:*:*:*:*:*
Gentoo Foundation, Inc.
gentoo
>>logrotate>>3.5.9
cpe:2.3:a:gentoo:logrotate:3.5.9:r1:*:*:*:*:*:*
Gentoo Foundation, Inc.
gentoo
>>logrotate>>3.6.5
cpe:2.3:a:gentoo:logrotate:3.6.5:*:*:*:*:*:*:*
Gentoo Foundation, Inc.
gentoo
>>logrotate>>3.6.5
cpe:2.3:a:gentoo:logrotate:3.6.5:r1:*:*:*:*:*:*
Gentoo Foundation, Inc.
gentoo
>>logrotate>>3.7
cpe:2.3:a:gentoo:logrotate:3.7:*:*:*:*:*:*:*
Gentoo Foundation, Inc.
gentoo
>>logrotate>>3.7.1
cpe:2.3:a:gentoo:logrotate:3.7.1:*:*:*:*:*:*:*
Gentoo Foundation, Inc.
gentoo
>>logrotate>>3.7.1
cpe:2.3:a:gentoo:logrotate:3.7.1:r1:*:*:*:*:*:*
Gentoo Foundation, Inc.
gentoo
>>logrotate>>3.7.1
cpe:2.3:a:gentoo:logrotate:3.7.1:r2:*:*:*:*:*:*
Gentoo Foundation, Inc.
gentoo
>>logrotate>>3.7.2
cpe:2.3:a:gentoo:logrotate:3.7.2:*:*:*:*:*:*:*
Gentoo Foundation, Inc.
gentoo
>>logrotate>>3.7.6
cpe:2.3:a:gentoo:logrotate:3.7.6:*:*:*:*:*:*:*
Gentoo Foundation, Inc.
gentoo
>>logrotate>>3.7.7
cpe:2.3:a:gentoo:logrotate:3.7.7:*:*:*:*:*:*:*
Gentoo Foundation, Inc.
gentoo
>>logrotate>>3.7.8
cpe:2.3:a:gentoo:logrotate:3.7.8:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-20Primarynvd@nist.gov
CWE ID: CWE-20
Type: Primary
Source: nvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.htmlsecalert@redhat.com
N/A
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.htmlsecalert@redhat.com
Patch
http://openwall.com/lists/oss-security/2011/03/04/16secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/04/17secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/04/18secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/04/19secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/04/22secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/04/24secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/04/25secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/04/26secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/04/27secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/04/28secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/04/29secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/04/30secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/04/31secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/04/32secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/04/33secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/05/4secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/05/6secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/05/8secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/06/3secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/06/4secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/06/5secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/06/6secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/07/11secalert@redhat.com
Patch
http://openwall.com/lists/oss-security/2011/03/07/5secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/07/6secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/08/5secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/10/2secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/10/3secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/10/6secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/10/7secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/11/3secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/11/5secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/14/26secalert@redhat.com
N/A
http://openwall.com/lists/oss-security/2011/03/23/11secalert@redhat.com
N/A
http://secunia.com/advisories/43955secalert@redhat.com
N/A
http://www.mandriva.com/security/advisories?name=MDVSA-2011:065secalert@redhat.com
N/A
http://www.redhat.com/support/errata/RHSA-2011-0407.htmlsecalert@redhat.com
N/A
http://www.vupen.com/english/advisories/2011/0791secalert@redhat.com
Vendor Advisory
http://www.vupen.com/english/advisories/2011/0872secalert@redhat.com
N/A
http://www.vupen.com/english/advisories/2011/0961secalert@redhat.com
N/A
https://bugzilla.redhat.com/show_bug.cgi?id=680796secalert@redhat.com
Patch
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.htmlaf854a3a-2127-422b-91ae-364da2661108
Patch
http://openwall.com/lists/oss-security/2011/03/04/16af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/04/17af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/04/18af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/04/19af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/04/22af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/04/24af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/04/25af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/04/26af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/04/27af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/04/28af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/04/29af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/04/30af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/04/31af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/04/32af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/04/33af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/05/4af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/05/6af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/05/8af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/06/3af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/06/4af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/06/5af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/06/6af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/07/11af854a3a-2127-422b-91ae-364da2661108
Patch
http://openwall.com/lists/oss-security/2011/03/07/5af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/07/6af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/08/5af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/10/2af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/10/3af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/10/6af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/10/7af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/11/3af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/11/5af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/14/26af854a3a-2127-422b-91ae-364da2661108
N/A
http://openwall.com/lists/oss-security/2011/03/23/11af854a3a-2127-422b-91ae-364da2661108
N/A
http://secunia.com/advisories/43955af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.mandriva.com/security/advisories?name=MDVSA-2011:065af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.redhat.com/support/errata/RHSA-2011-0407.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
http://www.vupen.com/english/advisories/2011/0791af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://www.vupen.com/english/advisories/2011/0872af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.vupen.com/english/advisories/2011/0961af854a3a-2127-422b-91ae-364da2661108
N/A
https://bugzilla.redhat.com/show_bug.cgi?id=680796af854a3a-2127-422b-91ae-364da2661108
Patch
Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html
Source: secalert@redhat.com
Resource:
Patch
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/16
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/17
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/18
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/19
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/22
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/24
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/25
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/26
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/27
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/28
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/29
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/30
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/31
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/32
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/33
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/05/4
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/05/6
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/05/8
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/3
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/4
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/5
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/6
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/07/11
Source: secalert@redhat.com
Resource:
Patch
Hyperlink: http://openwall.com/lists/oss-security/2011/03/07/5
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/07/6
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/08/5
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/2
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/3
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/6
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/7
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/11/3
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/11/5
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/14/26
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/23/11
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://secunia.com/advisories/43955
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2011:065
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://www.redhat.com/support/errata/RHSA-2011-0407.html
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://www.vupen.com/english/advisories/2011/0791
Source: secalert@redhat.com
Resource:
Vendor Advisory
Hyperlink: http://www.vupen.com/english/advisories/2011/0872
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://www.vupen.com/english/advisories/2011/0961
Source: secalert@redhat.com
Resource: N/A
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=680796
Source: secalert@redhat.com
Resource:
Patch
Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Patch
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/16
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/17
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/18
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/19
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/22
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/24
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/25
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/26
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/27
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/28
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/29
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/30
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/31
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/32
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/04/33
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/05/4
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/05/6
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/05/8
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/3
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/4
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/5
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/06/6
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/07/11
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Patch
Hyperlink: http://openwall.com/lists/oss-security/2011/03/07/5
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/07/6
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/08/5
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/2
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/3
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/6
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/10/7
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/11/3
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/11/5
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/14/26
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://openwall.com/lists/oss-security/2011/03/23/11
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://secunia.com/advisories/43955
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2011:065
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.redhat.com/support/errata/RHSA-2011-0407.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.vupen.com/english/advisories/2011/0791
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Vendor Advisory
Hyperlink: http://www.vupen.com/english/advisories/2011/0872
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.vupen.com/english/advisories/2011/0961
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=680796
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Patch

Change History

0
Information is not available yet

Similar CVEs

58Records found
CVE-2009-1144
Matching Score-8
Assigner-MITRE Corporation
ShareView Details
Matching Score-8
Assigner-MITRE Corporation
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 26.54%
||
7 Day CHG~0.00%
Published-09 Apr, 2009 | 15:00
Updated-07 Aug, 2024 | 05:04
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Untrusted search path vulnerability in the Gentoo package of Xpdf before 3.02-r2 allows local users to gain privileges via a Trojan horse xpdfrc file in the current working directory, related to an unset SYSTEM_XPDFRC macro in a Gentoo build process that uses the poppler library.

Action-Not Available
Vendor-glyphandcogfoolabsn/aGentoo Foundation, Inc.
Product-xpdfxpdfreadergentoo_linuxn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2008-4394
Matching Score-8
Assigner-MITRE Corporation
ShareView Details
Matching Score-8
Assigner-MITRE Corporation
CVSS Score-6.9||MEDIUM
EPSS-0.06% / 17.72%
||
7 Day CHG~0.00%
Published-10 Oct, 2008 | 10:00
Updated-07 Aug, 2024 | 10:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple untrusted search path vulnerabilities in Portage before 2.1.4.5 include the current working directory in the Python search path, which allows local users to execute arbitrary code via a modified Python module that is loaded by the (1) ys-apps/portage, (2) net-mail/fetchmail, (3) app-editors/leo ebuilds, and other ebuilds.

Action-Not Available
Vendor-n/aGentoo Foundation, Inc.
Product-portagen/a
CVE-2017-14484
Matching Score-8
Assigner-MITRE Corporation
ShareView Details
Matching Score-8
Assigner-MITRE Corporation
CVSS Score-7.3||HIGH
EPSS-0.03% / 6.59%
||
7 Day CHG~0.00%
Published-15 Sep, 2017 | 10:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The Gentoo sci-mathematics/gimps package before 28.10-r1 for Great Internet Mersenne Prime Search (GIMPS) allows local users to gain privileges by creating a hard link under /var/lib/gimps, because an unsafe "chown -R" command is executed.

Action-Not Available
Vendor-n/aGentoo Foundation, Inc.
Product-sci-mathematics-gimpsn/a
CWE ID-CWE-269
Improper Privilege Management
CVE-2008-1734
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-3.6||LOW
EPSS-0.06% / 18.10%
||
7 Day CHG~0.00%
Published-18 Apr, 2008 | 15:00
Updated-07 Aug, 2024 | 08:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Interpretation conflict in PHP Toolkit before 1.0.1 on Gentoo Linux might allow local users to cause a denial of service (PHP outage) and read contents of PHP scripts by creating a file with a one-letter lowercase alphabetic name, which triggers interpretation of a certain unquoted [a-z] argument as a matching shell glob for this name, rather than interpretation as the literal [a-z] regular-expression string, and consequently blocks the launch of the PHP interpreter within the Apache HTTP Server.

Action-Not Available
Vendor-n/aGentoo Foundation, Inc.
Product-linuxphp_toolkitn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2012-2981
Matching Score-6
Assigner-CERT/CC
ShareView Details
Matching Score-6
Assigner-CERT/CC
CVSS Score-6||MEDIUM
EPSS-1.03% / 76.41%
||
7 Day CHG~0.00%
Published-11 Sep, 2012 | 18:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary Perl code via a crafted file associated with the type (aka monitor type name) parameter.

Action-Not Available
Vendor-n/aGentoo Foundation, Inc.
Product-webminn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2008-0386
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-2.55% / 84.89%
||
7 Day CHG~0.00%
Published-04 Feb, 2008 | 22:00
Updated-07 Aug, 2024 | 07:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to (1) xdg-open or (2) xdg-email.

Action-Not Available
Vendor-n/aGentoo Foundation, Inc.Mandriva (Mandrakesoft)
Product-mandrake_linuxxdg-utilsn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2016-5759
Matching Score-4
Assigner-OpenText (formerly Micro Focus)
ShareView Details
Matching Score-4
Assigner-OpenText (formerly Micro Focus)
CVSS Score-7.8||HIGH
EPSS-0.03% / 6.55%
||
7 Day CHG~0.00%
Published-08 Sep, 2017 | 18:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The mkdumprd script called "dracut" in the current working directory "." allows local users to trick the administrator into executing code as root.

Action-Not Available
Vendor-n/aopenSUSENovell
Product-suse_linux_enterprise_desktopsuse_linux_enterprise_serverleapn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2010-1592
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.9||MEDIUM
EPSS-0.04% / 13.04%
||
7 Day CHG-0.10%
Published-28 Apr, 2010 | 23:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

sandra.sys 15.18.1.1 and earlier in the Sandra Device Driver in SiSoftware Sandra 16.10.2010.1 and earlier allows local users to gain privileges or cause a denial of service (system crash) via unspecified vectors involving "Model-Specific Registers."

Action-Not Available
Vendor-sisoftwaren/a
Product-sandran/a
CWE ID-CWE-20
Improper Input Validation
CVE-2018-8339
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-7||HIGH
EPSS-0.33% / 55.23%
||
7 Day CHG~0.00%
Published-15 Aug, 2018 | 17:00
Updated-05 Aug, 2024 | 06:54
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior, aka "Windows Installer Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Action-Not Available
Vendor-Microsoft Corporation
Product-windows_server_2016windows_server_2012windows_8.1windows_rt_8.1windows_7windows_10windows_server_2008Windows Server 2008 R2Windows 10 ServersWindows Server 2012 R2Windows Server 2016Windows 10Windows Server 2012Windows 8.1Windows 7Windows RT 8.1Windows Server 2008
CWE ID-CWE-20
Improper Input Validation
CVE-2016-2143
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-7.8||HIGH
EPSS-0.17% / 38.81%
||
7 Day CHG~0.00%
Published-27 Apr, 2016 | 17:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h.

Action-Not Available
Vendor-n/aLinux Kernel Organization, IncRed Hat, Inc.Debian GNU/LinuxOracle Corporation
Product-enterprise_linuxdebian_linuxlinux_kernellinuxn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2009-3523
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.9||MEDIUM
EPSS-0.16% / 37.26%
||
7 Day CHG~0.00%
Published-01 Oct, 2009 | 16:00
Updated-07 Aug, 2024 | 06:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

aavmKer4.sys in avast! Home and Professional for Windows before 4.8.1356 does not properly validate input to IOCTLs (1) 0xb2d6000c and (2) 0xb2d60034, which allows local users to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption, a different vulnerability than CVE-2008-1625.

Action-Not Available
Vendor-avastn/a
Product-avast_antivirus_homeavast_antivirus_professionaln/a
CWE ID-CWE-20
Improper Input Validation
CVE-2010-2020
Matching Score-4
Assigner-FreeBSD
ShareView Details
Matching Score-4
Assigner-FreeBSD
CVSS Score-6.9||MEDIUM
EPSS-0.31% / 53.94%
||
7 Day CHG-0.10%
Published-28 May, 2010 | 18:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

sys/nfsclient/nfs_vfsops.c in the NFS client in the kernel in FreeBSD 7.2 through 8.1-PRERELEASE, when vfs.usermount is enabled, does not validate the length of a certain fhsize parameter, which allows local users to gain privileges via a crafted mount request.

Action-Not Available
Vendor-n/aFreeBSD Foundation
Product-freebsdn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2009-2516
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-7.1||HIGH
EPSS-1.88% / 82.36%
||
7 Day CHG~0.00%
Published-14 Oct, 2009 | 10:00
Updated-21 Jan, 2025 | 17:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly validate data sent from user mode, which allows local users to gain privileges via a crafted PE .exe file that triggers a NULL pointer dereference during chain traversal, aka "Windows Kernel NULL Pointer Dereference Vulnerability."

Action-Not Available
Vendor-n/aMicrosoft Corporation
Product-windows_server_2003windows_vistawindows_server_2008windows_xpwindows_2000n/a
CWE ID-CWE-476
NULL Pointer Dereference
CWE ID-CWE-20
Improper Input Validation
CVE-2010-1163
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.04% / 12.78%
||
7 Day CHG~0.00%
Published-16 Apr, 2010 | 19:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426.

Action-Not Available
Vendor-todd_millern/a
Product-sudon/a
CWE ID-CWE-20
Improper Input Validation
CVE-2018-18558
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.4||MEDIUM
EPSS-0.04% / 8.60%
||
7 Day CHG~0.00%
Published-13 May, 2019 | 12:49
Updated-05 Aug, 2024 | 11:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered in Espressif ESP-IDF 2.x and 3.x before 3.0.6 and 3.1.x before 3.1.1. Insufficient validation of input data in the 2nd stage bootloader allows a physically proximate attacker to bypass secure boot checks and execute arbitrary code, by crafting an application binary that overwrites a bootloader code segment in process_segment in components/bootloader_support/src/esp_image_format.c. The attack is effective when the flash encryption feature is not enabled, or if the attacker finds a different vulnerability that allows them to write this binary to flash memory.

Action-Not Available
Vendor-espressifn/a
Product-esp-idfn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2018-15431
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-7.3||HIGH
EPSS-0.09% / 27.27%
||
7 Day CHG~0.00%
Published-05 Oct, 2018 | 14:00
Updated-26 Nov, 2024 | 14:27
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

Action-Not Available
Vendor-Cisco Systems, Inc.
Product-webex_meetings_serverwebex_meetings_onlinewebex_business_suite_32Cisco WebEx WRF Player
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-787
Out-of-bounds Write
CVE-2015-1086
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.06% / 17.71%
||
7 Day CHG~0.00%
Published-10 Apr, 2015 | 14:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The Audio Drivers subsystem in Apple iOS before 8.3 and Apple TV before 7.2 does not properly validate IOKit object metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted app.

Action-Not Available
Vendor-n/aApple Inc.
Product-iphone_ostvosn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2015-0717
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 27.03%
||
7 Day CHG~0.00%
Published-16 May, 2015 | 14:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546.

Action-Not Available
Vendor-n/aCisco Systems, Inc.
Product-unified_communications_managern/a
CWE ID-CWE-20
Improper Input Validation
CVE-2014-4973
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.9||MEDIUM
EPSS-0.06% / 19.41%
||
7 Day CHG~0.00%
Published-23 Sep, 2014 | 15:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The ESET Personal Firewall NDIS filter (EpFwNdis.sys) driver in the Firewall Module Build 1183 (20140214) and earlier in ESET Smart Security and ESET Endpoint Security products 5.0 through 7.0 allows local users to gain privileges via a crafted argument to a 0x830020CC IOCTL call.

Action-Not Available
Vendor-n/aESET, spol. s r. o.
Product-smart_securityendpoint_securityn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2014-4401
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.20% / 42.09%
||
7 Day CHG~0.00%
Published-19 Sep, 2014 | 10:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application, a different vulnerability than CVE-2014-4394, CVE-2014-4395, CVE-2014-4396, CVE-2014-4397, CVE-2014-4398, CVE-2014-4399, CVE-2014-4400, and CVE-2014-4416.

Action-Not Available
Vendor-n/aApple Inc.
Product-mac_os_xn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2014-4398
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.26% / 48.88%
||
7 Day CHG~0.00%
Published-19 Sep, 2014 | 10:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application, a different vulnerability than CVE-2014-4394, CVE-2014-4395, CVE-2014-4396, CVE-2014-4397, CVE-2014-4399, CVE-2014-4400, CVE-2014-4401, and CVE-2014-4416.

Action-Not Available
Vendor-n/aApple Inc.
Product-mac_os_xn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2014-4400
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.26% / 48.88%
||
7 Day CHG~0.00%
Published-19 Sep, 2014 | 10:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application, a different vulnerability than CVE-2014-4394, CVE-2014-4395, CVE-2014-4396, CVE-2014-4397, CVE-2014-4398, CVE-2014-4399, CVE-2014-4401, and CVE-2014-4416.

Action-Not Available
Vendor-n/aApple Inc.
Product-mac_os_xn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2014-4416
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.26% / 48.88%
||
7 Day CHG~0.00%
Published-19 Sep, 2014 | 10:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application, a different vulnerability than CVE-2014-4394, CVE-2014-4395, CVE-2014-4396, CVE-2014-4397, CVE-2014-4398, CVE-2014-4399, CVE-2014-4400, and CVE-2014-4401.

Action-Not Available
Vendor-n/aApple Inc.
Product-mac_os_xn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2014-4395
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.20% / 42.09%
||
7 Day CHG~0.00%
Published-19 Sep, 2014 | 10:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application, a different vulnerability than CVE-2014-4394, CVE-2014-4396, CVE-2014-4397, CVE-2014-4398, CVE-2014-4399, CVE-2014-4400, CVE-2014-4401, and CVE-2014-4416.

Action-Not Available
Vendor-n/aApple Inc.
Product-mac_os_xn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2014-4396
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.26% / 48.88%
||
7 Day CHG~0.00%
Published-19 Sep, 2014 | 10:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application, a different vulnerability than CVE-2014-4394, CVE-2014-4395, CVE-2014-4397, CVE-2014-4398, CVE-2014-4399, CVE-2014-4400, CVE-2014-4401, and CVE-2014-4416.

Action-Not Available
Vendor-n/aApple Inc.
Product-mac_os_xn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2018-0868
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-7||HIGH
EPSS-0.62% / 69.14%
||
7 Day CHG~0.00%
Published-14 Mar, 2018 | 17:00
Updated-16 Sep, 2024 | 16:48
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Windows Installer in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to how input is sanitized, aka "Windows Installer Elevation of Privilege Vulnerability".

Action-Not Available
Vendor-Microsoft Corporation
Product-windows_server_2016windows_server_2012windows_8.1windows_rt_8.1windows_7windows_10windows_server_2008Windows Installer
CWE ID-CWE-20
Improper Input Validation
CVE-2014-0038
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.9||MEDIUM
EPSS-60.72% / 98.22%
||
7 Day CHG~0.00%
Published-06 Feb, 2014 | 22:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.

Action-Not Available
Vendor-n/aLinux Kernel Organization, IncopenSUSE
Product-linux_kernelopensusen/a
CWE ID-CWE-20
Improper Input Validation
CVE-2013-6123
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.9||MEDIUM
EPSS-0.04% / 12.58%
||
7 Day CHG~0.00%
Published-14 Jan, 2014 | 02:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple array index errors in drivers/media/video/msm/server/msm_cam_server.c in the MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to gain privileges by leveraging camera device-node access, related to the (1) msm_ctrl_cmd_done, (2) msm_ioctl_server, and (3) msm_server_send_ctrl functions.

Action-Not Available
Vendor-codeauroran/aQualcomm Technologies, Inc.
Product-quic_mobile_station_modem_kernelandroid-msmn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2013-6122
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.9||MEDIUM
EPSS-0.06% / 17.08%
||
7 Day CHG~0.00%
Published-12 Nov, 2013 | 01:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

goodix_tool.c in the Goodix gt915 touchscreen driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly synchronize updates to a global variable, which allows local users to bypass intended access restrictions or cause a denial of service (memory corruption) via crafted arguments to the procfs write handler.

Action-Not Available
Vendor-n/aQualcomm Technologies, Inc.
Product-quic_mobile_station_modem_kerneln/a
CWE ID-CWE-20
Improper Input Validation
CVE-2013-6689
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.06% / 17.19%
||
7 Day CHG~0.00%
Published-16 Nov, 2013 | 02:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier allows local users to bypass file permissions, and read, modify, or create arbitrary files, via an "overload" of the command-line utility, aka Bug ID CSCui58229.

Action-Not Available
Vendor-n/aCisco Systems, Inc.
Product-unified_communications_managern/a
CWE ID-CWE-20
Improper Input Validation
CVE-2017-8714
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-7.8||HIGH
EPSS-1.06% / 76.69%
||
7 Day CHG~0.00%
Published-13 Sep, 2017 | 01:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The Windows Hyper-V component on Microsoft Windows 8.1, Windows Server 2012 Gold and R2,, Windows 10 1607, and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly validate input from an authenticated user on a guest operating system, aka "Remote Desktop Virtual Host Remote Code Execution Vulnerability".

Action-Not Available
Vendor-Microsoft Corporation
Product-windows_server_2012windows_8.1windows_10windows_server_2016Windows Hyper-V
CWE ID-CWE-20
Improper Input Validation
CVE-2013-4254
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.02% / 2.62%
||
7 Day CHG~0.00%
Published-25 Aug, 2013 | 01:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The validate_event function in arch/arm/kernel/perf_event.c in the Linux kernel before 3.10.8 on the ARM platform allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by adding a hardware event to an event group led by a software event.

Action-Not Available
Vendor-n/aLinux Kernel Organization, Inc
Product-linux_kerneln/a
CWE ID-CWE-20
Improper Input Validation
CVE-2013-3954
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.9||MEDIUM
EPSS-0.12% / 31.05%
||
7 Day CHG~0.00%
Published-05 Jun, 2013 | 10:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The posix_spawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not properly validate the data for file actions and port actions, which allows local users to (1) cause a denial of service (panic) via a size value that is inconsistent with a header count field, or (2) obtain sensitive information from kernel heap memory via a certain size value in conjunction with a crafted buffer.

Action-Not Available
Vendor-n/aApple Inc.
Product-iphone_osmac_os_xn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2012-6035
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.9||MEDIUM
EPSS-0.11% / 29.43%
||
7 Day CHG~0.00%
Published-23 Nov, 2012 | 20:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.

Action-Not Available
Vendor-n/aXen Project
Product-xenn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2012-5513
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.14% / 35.04%
||
7 Day CHG~0.00%
Published-13 Dec, 2012 | 11:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The XENMEM_exchange handler in Xen 4.2 and earlier does not properly check the memory address, which allows local PV guest OS administrators to cause a denial of service (crash) or possibly gain privileges via unspecified vectors that overwrite memory in the hypervisor reserved range.

Action-Not Available
Vendor-n/aXen Project
Product-xenn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2014-4399
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.26% / 48.88%
||
7 Day CHG~0.00%
Published-19 Sep, 2014 | 10:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application, a different vulnerability than CVE-2014-4394, CVE-2014-4395, CVE-2014-4396, CVE-2014-4397, CVE-2014-4398, CVE-2014-4400, CVE-2014-4401, and CVE-2014-4416.

Action-Not Available
Vendor-n/aApple Inc.
Product-mac_os_xn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2014-4397
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.26% / 48.88%
||
7 Day CHG~0.00%
Published-19 Sep, 2014 | 10:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application, a different vulnerability than CVE-2014-4394, CVE-2014-4395, CVE-2014-4396, CVE-2014-4398, CVE-2014-4399, CVE-2014-4400, CVE-2014-4401, and CVE-2014-4416.

Action-Not Available
Vendor-n/aApple Inc.
Product-mac_os_xn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2014-4394
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.26% / 48.88%
||
7 Day CHG~0.00%
Published-19 Sep, 2014 | 10:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application, a different vulnerability than CVE-2014-4395, CVE-2014-4396, CVE-2014-4397, CVE-2014-4398, CVE-2014-4399, CVE-2014-4400, CVE-2014-4401, and CVE-2014-4416.

Action-Not Available
Vendor-n/aApple Inc.
Product-mac_os_xn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2012-3497
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.11% / 29.41%
||
7 Day CHG~0.00%
Published-23 Nov, 2012 | 20:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

(1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (NULL pointer dereference or memory corruption and host crash) or possibly have other unspecified impacts via a NULL client id.

Action-Not Available
Vendor-n/aXen Project
Product-xenn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2012-2095
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.58% / 67.94%
||
7 Day CHG~0.00%
Published-07 Apr, 2014 | 15:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The SetWiredProperty function in the D-Bus interface in WICD before 1.7.2 allows local users to write arbitrary configuration settings and gain privileges via a crafted property name in a dbus message.

Action-Not Available
Vendor-david_paleinon/aFedora Project
Product-fedorawicdn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2007-4993
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.16% / 37.57%
||
7 Day CHG~0.00%
Published-27 Sep, 2007 | 17:00
Updated-07 Aug, 2024 | 15:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

pygrub (tools/pygrub/src/GrubConf.py) in Xen 3.0.3, when booting a guest domain, allows local users with elevated privileges in the guest domain to execute arbitrary commands in domain 0 via a crafted grub.conf file whose contents are used in exec statements.

Action-Not Available
Vendor-xensource_incn/a
Product-xenn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2013-1828
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.20% / 42.43%
||
7 Day CHG~0.00%
Published-22 Mar, 2013 | 10:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The sctp_getsockopt_assoc_stats function in net/sctp/socket.c in the Linux kernel before 3.8.4 does not validate a size value before proceeding to a copy_from_user operation, which allows local users to gain privileges via a crafted application that contains an SCTP_GET_ASSOC_STATS getsockopt system call.

Action-Not Available
Vendor-n/aLinux Kernel Organization, Inc
Product-linux_kerneln/a
CWE ID-CWE-20
Improper Input Validation
CVE-2020-0118
Matching Score-4
Assigner-Android (associated with Google Inc. or Open Handset Alliance)
ShareView Details
Matching Score-4
Assigner-Android (associated with Google Inc. or Open Handset Alliance)
CVSS Score-7.8||HIGH
EPSS-0.01% / 1.46%
||
7 Day CHG~0.00%
Published-10 Jun, 2020 | 17:11
Updated-04 Aug, 2024 | 05:47
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In addListener of RegionSamplingThread.cpp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-150904694

Action-Not Available
Vendor-n/aGoogle LLC
Product-androidAndroid
CWE ID-CWE-787
Out-of-bounds Write
CWE ID-CWE-20
Improper Input Validation
CVE-2011-2022
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.9||MEDIUM
EPSS-0.04% / 12.04%
||
7 Day CHG~0.00%
Published-09 May, 2011 | 19:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The agp_generic_remove_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 does not validate a certain start parameter, which allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_UNBIND agp_ioctl ioctl call, a different vulnerability than CVE-2011-1745.

Action-Not Available
Vendor-n/aLinux Kernel Organization, IncRed Hat, Inc.
Product-linux_kernelenterprise_linuxenterprise_linux_workstationenterprise_linux_serverenterprise_linux_desktopenterprise_linux_ausenterprise_linux_eusn/a
CWE ID-CWE-20
Improper Input Validation
CVE-2017-12223
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-6.4||MEDIUM
EPSS-0.09% / 26.53%
||
7 Day CHG~0.00%
Published-07 Sep, 2017 | 21:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability in the ROM Monitor (ROMMON) code of Cisco IR800 Integrated Services Router Software could allow an unauthenticated, local attacker to boot an unsigned Hypervisor on an affected device and compromise the integrity of the system. The vulnerability is due to insufficient sanitization of user input. An attacker who can access an affected router via the console could exploit this vulnerability by entering ROMMON mode and modifying ROMMON variables. A successful exploit could allow the attacker to execute arbitrary code and install a malicious version of Hypervisor firmware on an affected device. Cisco Bug IDs: CSCvb44027.

Action-Not Available
Vendor-n/aCisco Systems, Inc.
Product-ir800_integrated_services_router_firmwareir800_integrated_services_routerCisco IR800 Integrated Services Router
CWE ID-CWE-20
Improper Input Validation
CVE-2011-0017
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.14% / 34.25%
||
7 Day CHG~0.00%
Published-02 Feb, 2011 | 00:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.

Action-Not Available
Vendor-n/aExim
Product-eximn/a
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-59
Improper Link Resolution Before File Access ('Link Following')
CVE-2016-8273
Matching Score-4
Assigner-Huawei Technologies
ShareView Details
Matching Score-4
Assigner-Huawei Technologies
CVSS Score-7.8||HIGH
EPSS-0.01% / 2.02%
||
7 Day CHG~0.00%
Published-02 Apr, 2017 | 20:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Huawei PC client software HiSuite 4.0.5.300_OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise the PC.

Action-Not Available
Vendor-n/aHuawei Technologies Co., Ltd.
Product-hisuiteHiSuite 4.0.5.300_OVE
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-284
Improper Access Control
CVE-2016-4960
Matching Score-4
Assigner-NVIDIA Corporation
ShareView Details
Matching Score-4
Assigner-NVIDIA Corporation
CVSS Score-7.3||HIGH
EPSS-0.05% / 14.13%
||
7 Day CHG~0.00%
Published-08 Nov, 2016 | 20:37
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

For the NVIDIA Quadro, NVS, and GeForce products, the NVIDIA NVStreamKMS.sys service component is improperly validating user-supplied data through its API entry points causing an elevation of privilege.

Action-Not Available
Vendor-n/aNVIDIA Corporation
Product-geforce_gtx_965mquadro_m600mgeforce_gt_710quadro_k420geforce_945mquadro_m2000mquadro_m500mquadro_m6000quadro_m1000mgeforce_930mquadro_m5000mquadro_p5000geforce_gtx_950mnvs_315geforce_gt_730geforce_gtx_960mquadro_m4000mquadro_m4000quadro_m3000mgeforce_gtx_1060geforce_930mxgeforce_940mgeforce_experiencegeforce_gtx_1050nvs_510quadro_k620quadro_k1200quadro_m2000geforce_920mxquadro_p6000geforce_920mgeforce_910mnvs_810quadro_m5500quadro_m5000titan_xgeforce_940mxgeforce_gtx_1070geforce_gtx_1080nvs_310Quadro, NVS, GeForce (all versions)
CWE ID-CWE-20
Improper Input Validation
CVE-2016-4332
Matching Score-4
Assigner-CERT/CC
ShareView Details
Matching Score-4
Assigner-CERT/CC
CVSS Score-8.6||HIGH
EPSS-0.07% / 22.72%
||
7 Day CHG~0.00%
Published-18 Nov, 2016 | 20:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The library's failure to check if certain message types support a particular flag, the HDF5 1.8.16 library will cast the structure to an alternative structure and then assign to fields that aren't supported by the message type and the library will write outside the bounds of the heap buffer. This can lead to code execution under the context of the library.

Action-Not Available
Vendor-n/aThe HDF Group
Product-hdf5n/a
CWE ID-CWE-20
Improper Input Validation
CVE-2022-30330
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.6||MEDIUM
EPSS-0.07% / 22.27%
||
7 Day CHG~0.00%
Published-07 May, 2022 | 03:25
Updated-03 Aug, 2024 | 06:48
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In the KeepKey firmware before 7.3.2,Flaws in the supervisor interface can be exploited to bypass important security restrictions on firmware operations. Using these flaws, malicious firmware code can elevate privileges, permanently make the device inoperable or overwrite the trusted bootloader code to compromise the hardware wallet across reboots or storage wipes.

Action-Not Available
Vendor-keepkeyn/a
Product-keepkey_firmwarekeepkeyn/a
CWE ID-CWE-20
Improper Input Validation
  • Previous
  • 1
  • 2
  • Next
Details not found