deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-35309
Published: 2023-08-22
Description: An issue discovered in Samsung SyncThru Web Service SPL 5.93 06-09-2014 allows attackers to gain escalated privileges via MITM attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://github.com/mustafa-turgut/cve-subscriptions/tree/main/samsung-stws; https://security.samsungmobile.com/securityUpdate.smsb; https://github.com/mustafa-turgut/cve-subscriptions/tree/main/samsung-stws
CVE: CVE-2021-40211
Published: 2023-08-22
Description: An issue was discovered with ImageMagick 7.1.0-4 via Division by zero in function ReadEnhMetaFile of coders/emf.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369
References: https://github.com/ImageMagick/ImageMagick/issues/4097; https://github.com/ImageMagick/ImageMagick/issues/4097
CVE: CVE-2021-40262
Published: 2023-08-22
Description: A stack exhaustion issue was discovered in FreeImage before 1.18.0 via the Validate function in PluginRAW.cpp.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://sourceforge.net/p/freeimage/bugs/338/; https://sourceforge.net/p/freeimage/bugs/338/
CVE: CVE-2021-40263
Published: 2023-08-22
Description: A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad function in PluginTIFF.cpp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFRQ76ZDPSWT7OH6FJDLSFWBXVBE6JDN/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6GKMK74POW3RU7F4HLUJE7XEFLQDO35/; https://sourceforge.net/p/freeimage/bugs/336/
CVE: CVE-2021-40264
Published: 2023-08-22
Description: NULL pointer dereference vulnerability in FreeImage before 1.18.0 via the FreeImage_CloneTag function inFreeImageTag.cpp.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://sourceforge.net/p/freeimage/bugs/335/; https://sourceforge.net/p/freeimage/bugs/335/
CVE: CVE-2021-40265
Published: 2023-08-22
Description: A heap overflow bug exists FreeImage before 1.18.0 via ofLoad function in PluginJPEG.cpp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://sourceforge.net/p/freeimage/bugs/337/; https://sourceforge.net/p/freeimage/bugs/337/
CVE: CVE-2021-40266
Published: 2023-08-22
Description: FreeImage before 1.18.0, ReadPalette function in PluginTIFF.cpp is vulnerabile to null pointer dereference.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFRQ76ZDPSWT7OH6FJDLSFWBXVBE6JDN/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6GKMK74POW3RU7F4HLUJE7XEFLQDO35/; https://sourceforge.net/p/freeimage/bugs/334/
CVE: CVE-2021-43171
Published: 2023-08-22
Description: Improper verification of applications' cryptographic signatures in the /e/OS app store client App Lounge before 0.19q allows attackers in control of the application server to install malicious applications on user's systems by altering the server's API response.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-347
References: https://gitlab.e.foundation/e/os/releases/-/releases/v0.19-q#sparkles-we-embedded-other-improvements; https://nervuri.net/e/apps; https://gitlab.e.foundation/e/os/releases/-/releases/v0.19-q#sparkles-we-embedded-other-improvements
CVE: CVE-2021-46174
Published: 2023-08-22
Description: Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://sourceware.org/bugzilla/show_bug.cgi?id=28753; https://sourceware.org/bugzilla/show_bug.cgi?id=28753
CVE: CVE-2021-46179
Published: 2023-08-22
Description: Reachable Assertion vulnerability in upx before 4.0.0 allows attackers to cause a denial of service via crafted file passed to the the readx function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/upx/upx/issues/545; https://github.com/upx/upx/issues/545
CVE: CVE-2021-46310
Published: 2023-08-22
Description: An issue was discovered IW44Image.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4APFAWR7QE27GXQMRKR6XKNZWWUJ5YMH/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HN4JOIBNMJMW2NQSGT6DCDCQZJ2ROFM7/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEEGAR4WUF6LTOJEHSON7I2MBTPFTVR5/
CVE: CVE-2021-46312
Published: 2023-08-22
Description: An issue was discovered IW44EncodeCodec.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4APFAWR7QE27GXQMRKR6XKNZWWUJ5YMH/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HN4JOIBNMJMW2NQSGT6DCDCQZJ2ROFM7/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEEGAR4WUF6LTOJEHSON7I2MBTPFTVR5/
CVE: CVE-2022-25024
Published: 2023-08-22
Description: The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://github.com/vinitkumar/json2xml/issues/106; https://github.com/vinitkumar/json2xml/pull/107; https://github.com/vinitkumar/json2xml/pull/107/files
CVE: CVE-2022-26592
Published: 2023-08-22
Description: Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::has_real_parent_ref function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/sass/libsass/issues/3174; https://github.com/sass/libsass/issues/3174
CVE: CVE-2022-28068
Published: 2023-08-22
Description: A heap buffer overflow in r_sleb128 function in radare2 5.4.2 and 5.4.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/radareorg/radare2/commit/637f4bd1af6752e28e0a9998e954e2e9ce6fa992; https://github.com/radareorg/radare2/commit/637f4bd1af6752e28e0a9998e954e2e9ce6fa992
CVE: CVE-2022-28069
Published: 2023-08-22
Description: A heap buffer overflow in vax_opfunction in radare2 5.4.2 and 5.4.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/radareorg/radare2/commit/49b0cebfdf0db9704e36f8a5533f1df6d3e2ed3a; https://github.com/radareorg/radare2/commit/49b0cebfdf0db9704e36f8a5533f1df6d3e2ed3a
CVE: CVE-2022-28070
Published: 2023-08-22
Description: A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/radareorg/radare2/commit/4aff1bb00224de4f5bc118f987dfd5d2fe3450d0; https://github.com/radareorg/radare2/commit/4aff1bb00224de4f5bc118f987dfd5d2fe3450d0
CVE: CVE-2022-28071
Published: 2023-08-22
Description: A use after free in r_reg_get_name_idx function in radare2 5.4.2 and 5.4.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/radareorg/radare2/commit/65448811e5b9582a19cf631e03cfcaa025a92ef5; https://github.com/radareorg/radare2/commit/65448811e5b9582a19cf631e03cfcaa025a92ef5
CVE: CVE-2022-28072
Published: 2023-08-22
Description: A heap buffer overflow in r_read_le32 function in radare25.4.2 and 5.4.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/radareorg/radare2/commit/027cd9b7274988bb1af866539ba6c2fa2ff63e45; https://github.com/radareorg/radare2/commit/027cd9b7274988bb1af866539ba6c2fa2ff63e45
CVE: CVE-2022-28073
Published: 2023-08-22
Description: A use after free in r_reg_set_value function in radare2 5.4.2 and 5.4.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/radareorg/radare2/commit/59a9dfb60acf8b5c0312061cffd9693fc9526053; https://github.com/radareorg/radare2/commit/59a9dfb60acf8b5c0312061cffd9693fc9526053
CVE: CVE-2022-29654
Published: 2023-08-22
Description: Buffer overflow vulnerability in quote_for_pmake in asm/nasm.c in nasm before 2.15.05 allows attackers to cause a denial of service via crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html; https://gist.github.com/naihsin/b96e2c5c2c81621b46557fd7aacd165f; https://www.nasm.us/pub/nasm/releasebuilds/2.15.05/
CVE: CVE-2022-34038
Published: 2023-08-22
Description: Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/etcd-io/etcd/pull/14022; https://github.com/etcd-io/etcd/pull/14452; https://github.com/golang/vulndb/issues/2016#issuecomment[PII_REDACTED]
CVE: CVE-2022-35205
Published: 2023-08-22
Description: An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://sourceware.org/bugzilla/show_bug.cgi?id=29289; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-35206
Published: 2023-08-22
Description: Null pointer dereference vulnerability in Binutils readelf 2.38.50 via function read_and_display_attr_value in file dwarf.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://sourceware.org/bugzilla/show_bug.cgi?id=29290; https://sourceware.org/bugzilla/show_bug.cgi?id=29290
CVE: CVE-2022-36648
Published: 2023-08-22
Description: The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS. Note: This has been disputed by multiple third parties as not a valid vulnerability due to the rocker device not falling within the virtualization use case.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-476
References: https://lists.nongnu.org/archive/html/qemu-devel/2022-06/msg04469.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://lists.nongnu.org/archive/html/qemu-devel/2022-06/msg04469.html
CVE: CVE-2022-37050
Published: 2023-08-22
Description: In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://gitlab.freedesktop.org/poppler/poppler/-/commit/dcd5bd8238ea448addd102ff045badd0aca1b990; https://gitlab.freedesktop.org/poppler/poppler/-/issues/1274; https://lists.debian.org/debian-lts-announce/2023/10/msg00022.html
CVE: CVE-2022-37051
Published: 2023-08-22
Description: An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://gitlab.freedesktop.org/poppler/poppler/-/commit/[PII_REDACTED]c1e4f0482ffe0491c2f38d2231337b; https://gitlab.freedesktop.org/poppler/poppler/-/issues/1276; https://lists.debian.org/debian-lts-announce/2023/10/msg00022.html
CVE: CVE-2022-37052
Published: 2023-08-22
Description: A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://gitlab.freedesktop.org/poppler/poppler/-/commit/[PII_REDACTED]fc2548fa816b619580c2c07915a98c; https://gitlab.freedesktop.org/poppler/poppler/-/issues/1278; https://gitlab.freedesktop.org/poppler/poppler/-/commit/[PII_REDACTED]fc2548fa816b619580c2c07915a98c
CVE: CVE-2022-38349
Published: 2023-08-22
Description: An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://gitlab.freedesktop.org/poppler/poppler/-/commit/4564a002bcb6094cc460bc0d5ddff9423fe6dd28; https://gitlab.freedesktop.org/poppler/poppler/-/issues/1282; https://gitlab.freedesktop.org/poppler/poppler/-/commit/4564a002bcb6094cc460bc0d5ddff9423fe6dd28
CVE: CVE-2022-40090
Published: 2023-08-22
Description: An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://gitlab.com/libtiff/libtiff/-/issues/455; https://gitlab.com/libtiff/libtiff/-/merge_requests/386; https://gitlab.com/libtiff/libtiff/-/issues/455
CVE: CVE-2022-40433
Published: 2023-08-22
Description: Rejected reason: ** REJECT ** This CVE ID has been rejected by its CNA as it was not a security issue.
CVE: CVE-2022-41444
Published: 2023-08-22
Description: Cross Site Scripting (XSS) vulnerability in Cacti 1.2.21 via crafted POST request to graphs_new.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/enferas/[PII_REDACTED]e4f4ff2c1d2ce1c099d4c2; https://gist.github.com/enferas/[PII_REDACTED]e4f4ff2c1d2ce1c099d4c2; https://lists.debian.org/debian-lts-announce/2024/09/msg00027.html
CVE: CVE-2022-43357
Published: 2023-08-22
Description: Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:3.6.5-8-g210218, which can be exploited by attackers to causea denial of service (DoS). Also affects the command line driver for libsass, sassc 3.6.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://drive.google.com/file/d/1aC5q3czen0atI91fuBIoCBFkS30_OSWX/; https://github.com/sass/libsass; https://github.com/sass/libsass/issues/3177
CVE: CVE-2022-43358
Published: 2023-08-22
Description: Stack overflow vulnerability in ast_selectors.cpp: in function Sass::ComplexSelector::has_placeholder in libsass:3.6.5-8-g210218, which can be exploited by attackers to cause a denial of service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://drive.google.com/file/d/1j5fkPjWH9zQeTdO_4dMcZ-FpOBzP0MaI/; https://github.com/sass/libsass; https://github.com/sass/libsass/issues/3178
CVE: CVE-2022-44215
Published: 2023-08-22
Description: There is an open redirect vulnerability in Titan FTP server 19.0 and below. Users are redirected to any target URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://drive.google.com/file/d/1oLJaqs5RRNQLT1Hyy-tgEzzhGLB0506J/view?usp=sharing; https://github.com/JBalanza/CVE-2022-44215; https://drive.google.com/file/d/1oLJaqs5RRNQLT1Hyy-tgEzzhGLB0506J/view?usp=sharing
CVE: CVE-2022-44729
Published: 2023-08-22
Description: Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.

On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
CVSS Score: 7.1 (HIGH)
CWE: CWE-918
References: http://www.openwall.com/lists/oss-security/2023/08/22/2; http://www.openwall.com/lists/oss-security/2023/08/22/4; https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2
CVE: CVE-2022-44730
Published: 2023-08-22
Description: Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.

A malicious SVG can probe user profile / data and send it directly as parameter to a URL.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: http://www.openwall.com/lists/oss-security/2023/08/22/3; http://www.openwall.com/lists/oss-security/2023/08/22/5; https://lists.apache.org/thread/58m5817jr059f4v1zogh0fngj9pwjyj0
CVE: CVE-2022-44840
Published: 2023-08-22
Description: Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://sourceware.org/bugzilla/show_bug.cgi?id=29732; https://sourceware.org/bugzilla/show_bug.cgi?id=29732
CVE: CVE-2022-45582
Published: 2023-08-22
Description: Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://bugs.launchpad.net/horizon/+bug/1982676; https://github.com/openstack/horizon/blob/master/horizon/workflows/views.py#L96-L102; https://lists.debian.org/debian-lts-announce/2023/11/msg00033.html
CVE: CVE-2022-45611
Published: 2023-08-22
Description: An issue was discovered in Fresenius Kabi PharmaHelp 5.1.759.0 allows attackers to gain escalated privileges via via capture of user login information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://www.fresenius-kabi.com/de-at/produkte/pharmahelp-compounder; https://www.fresenius.com/sites/default/files/2023-11/Fresenius%20-%20CVE-2022-45611.pdf; https://www.fresenius.com/sites/default/files/2023-12/Fresenius%20-%20CVE-2022-45611.pdf
CVE: CVE-2022-45703
Published: 2023-08-22
Description: Heap buffer overflow vulnerability in binutils readelf before 2.40 via function display_debug_section in file readelf.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://sourceware.org/bugzilla/show_bug.cgi?id=29799; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-47007
Published: 2023-08-22
Description: An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://sourceware.org/bugzilla/show_bug.cgi?id=29254; https://sourceware.org/bugzilla/show_bug.cgi?id=29254
CVE: CVE-2022-47008
Published: 2023-08-22
Description: An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://sourceware.org/bugzilla/show_bug.cgi?id=29255%20; https://sourceware.org/bugzilla/show_bug.cgi?id=29255%20
CVE: CVE-2022-47010
Published: 2023-08-22
Description: An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://sourceware.org/bugzilla/show_bug.cgi?id=29262; https://sourceware.org/bugzilla/show_bug.cgi?id=29262
CVE: CVE-2022-47011
Published: 2023-08-22
Description: An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://sourceware.org/bugzilla/show_bug.cgi?id=29261; https://sourceware.org/bugzilla/show_bug.cgi?id=29261
CVE: CVE-2022-47022
Published: 2023-08-22
Description: An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476
References: https://github.com/open-mpi/hwloc/issues/544; https://github.com/open-mpi/hwloc/issues/544
CVE: CVE-2022-47069
Published: 2023-08-22
Description: p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCd(bool) at CPP/7zip/Archive/Zip/ZipIn.cpp. NOTE: the Supplier has found that this is not a buffer overflow; at most an out-of-bounds read can occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://sourceforge.net/p/p7zip/bugs/241/; https://sourceforge.net/p/p7zip/bugs/241/
CVE: CVE-2022-47673
Published: 2023-08-22
Description: An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out of bound reads which may cause a denial of service or other unspecified impacts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://sourceware.org/bugzilla/show_bug.cgi?id=29876; https://sourceware.org/bugzilla/show_bug.cgi?id=29876
CVE: CVE-2022-47695
Published: 2023-08-22
Description: An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_mach_o_get_synthetic_symtab in match-o.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-400
References: https://sourceware.org/bugzilla/show_bug.cgi?id=29846; https://sourceware.org/bugzilla/show_bug.cgi?id=29846
CVE: CVE-2022-47696
Published: 2023-08-22
Description: An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols.
CVSS Score: 7.8 (HIGH)
CWE: CWE-400
References: https://sourceware.org/bugzilla/show_bug.cgi?id=29677; https://sourceware.org/bugzilla/show_bug.cgi?id=29677
CVE: CVE-2022-48063
Published: 2023-08-22
Description: GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://sourceware.org/bugzilla/show_bug.cgi?id=29924; https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=75393a2d54bcc40053e5262a3de9d70c5ebfbbfd
CVE: CVE-2022-48064
Published: 2023-08-22
Description: GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3XKYUAIORNQ32IZUOZFURECZKEXOHX7Z/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KGSKF4GH7425S6XFDQMWTJGD5U47BAZN/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSUNHSOWWLLNGHRM5TUBNCJHEYHPDX2M/
CVE: CVE-2022-48065
Published: 2023-08-22
Description: GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLZXZXFX2ZWTDU2QZUSZG36LZZVTKUVG/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KGSKF4GH7425S6XFDQMWTJGD5U47BAZN/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-48174
Published: 2023-08-22
Description: There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.busybox.net/show_bug.cgi?id=15216; https://bugs.busybox.net/show_bug.cgi?id=15216; https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html
CVE: CVE-2022-48522
Published: 2023-08-22
Description: In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Perl/perl5/blob/79a7b254d85a10b65126ad99bf10e70480569d68/sv.c#L16336-L16345; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/Perl/perl5/blob/79a7b254d85a10b65126ad99bf10e70480569d68/sv.c#L16336-L16345