DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Red Hat Enterprise Linux: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-11-07
Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen oder beliebigen Code auszuführen.
01
beschreibt (25)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-32665US | medium5.5 | — | ||
A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of servic… | ||||
| CVE-2023-32611US | medium5.5 | — | ||
A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service. | ||||
| CVE-2023-29499US | high7.5 | — | ||
A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service. | ||||
| CVE-2023-38712US | medium6.5 | — | ||
An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies th… | ||||
| CVE-2023-38711US | medium6.5 | — | ||
An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL poi… | ||||
| CVE-2023-38710US | medium6.5 | — | ||
An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent ba… | ||||
| CVE-2023-4016US | low3.3 | — | ||
Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the… | ||||
| CVE-2023-1672US | medium5.3 | — | ||
A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by ot… | ||||
| CVE-2023-33460US | medium6.5 | — | ||
There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash. | ||||
| CVE-2023-28370US | medium6.1 | — | ||
Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack… | ||||
| CVE-2023-33204US | high7.8 | — | ||
sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377. | ||||
| CVE-2023-31486US | high8.1OT erhöht | — | ||
HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. | ||||
| CVE-2023-1786US | medium5.5 | — | ||
Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege. | ||||
| CVE-2022-48468US | medium5.5 | — | ||
protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member. | ||||
| CVE-2023-28625US | high7.5 | — | ||
mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 thro… | ||||
| CVE-2023-28101US | medium4.3 | — | ||
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publish… | ||||
| CVE-2023-28100US | medium6.5 | — | ||
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability si… | ||||
| CVE-2023-26769US | high7.5 | — | ||
Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a denial of service via the resolveSubtable function at compileTranslationTabel… | ||||
| CVE-2023-26768US | high7.5 | — | ||
Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the compileTranslationTable.c and lou_setDataPath functions. | ||||
| CVE-2023-26767US | high7.5 | — | ||
Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the lou_logFile function at logginc.c endpoint. | ||||
20 von 25 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Oracle Linux Security Advisory ELSA-2024-2033 vom 2024-04-25external
- RedHatSecurity Advisory vom 2023-11-07external
- RedHatSecurity Advisory vom 2023-11-07external
- RedHatSecurity Advisory vom 2023-11-07external
- RedHatSecurity Advisory vom 2023-11-07external
- RedHatSecurity Advisory vom 2023-11-07external
- RedHatSecurity Advisory vom 2023-11-07external
- RedHatSecurity Advisory vom 2023-11-07external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan