SSA-794697

csafDEsiemens_psirt

SSA-794697: Vulnerabilities in the Additional GNU/Linux Subsystem of the SIMATIC S7-1500 TM MFP Before V1.1

view advisory published 2023-06-13

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.0. Siemens has released a new version for SIMATIC S7-1500 TM MFP - GNU/Linux subsystem and recommends to update to the latest version. SIMATIC S7-1500 TM MFP V1.0 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version. This advisory lists vulnerabilities for firmware version V1.0 only; for V1.1 refer to Siemens Security Advisory SSA-265688 (https://cert-portal.siemens.com/productcert/html/ssa-265688.html).

01

describes (168)

Related CVEs.

IDseverity exploitable
CVE-2022-21505US——
In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable…
CVE-2024-0684USmedium5.5Exploit
A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function,…
CVE-2024-22365USmedium5.5—
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
CVE-2024-25062UShigh7.5—
An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafte…
CVE-2024-0584US——
Rejected reason: Do not use this CVE as it is duplicate of CVE-2023-6932
CVE-2024-0567UShigh7.5—
A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain w…
CVE-2024-0232USmedium5.5—
A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass speci…
CVE-2024-0553UShigh7.5—
A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5…
CVE-2022-2602UShigh7.0Exploit
io_uring UAF, Unix SCM garbage collection
CVE-2022-2588UShigh7.8Exploit
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0.
CVE-2022-2586UShigh7.8OT criticalKEV
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.
CVE-2023-7104UShigh7.3—
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of t…
CVE-2023-51767UShigh7.0—
OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpas…
CVE-2023-7008USmedium5.9—
A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-th…
CVE-2023-6932UShigh7.0—
A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a time…
CVE-2023-6931UShigh7.0Exploit
A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_si…
CVE-2023-51385USmedium6.5Exploit
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain si…
CVE-2023-51384USmedium5.5—
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted privat…
CVE-2023-48795USmedium5.9OT highExploit
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packet…
CVE-2023-50495USmedium6.5—
NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().
showing 20 of 168
02

references

External citations — patches, advisories, analysis.

03

remediations (336)

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan