CVE Vulnerability Catalog

In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

OpenSSL has internal defaults for OPENSSLDIR, where it finds its configuration file and certificates used for TLS verification. For versions 1.1.0 and 1.1.1, mingw configuration targets assume a Unix-like environment with prefix '/usr/local', which on Windows points to 'C:/usr/local' that may be world-writable, enabling untrusted users to modify OpenSSL's default configuration, insert CA certificates, or replace engine modules.

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 through 7.64.1.

Buffer leakage in igdkm64.sys in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 may allow an authenticated user to potentially enable information disclosure via local access.

Insufficient input validation in the Kernel Mode Driver of Intel(R) Graphics Driver for Windows allows an unprivileged user to cause an out-of-bounds memory read via local access.

Unhandled exception in the User Mode Driver of Intel(R) Graphics Driver for Windows allows an unprivileged user to cause a memory leak via local access.

Insufficient access control in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 potentially enables a privileged user to read device configuration information via local access.

Insufficient access control in User Mode Driver in Intel(R) Graphics Driver for Windows before versions 10.18.x.5059, 10.18.x.5057, 20.19.x.5063, 21.20.x.5064, and 24.20.100.6373 potentially enables an unprivileged user to read device configuration information via local access.

Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to installation.

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JSSE.

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names created when unpacking archives.

A flaw was found in Grinder, a component of Red Hat CloudForms, where incorrect world-writable permissions on the `/var/lib/pulp/cache/grinder/` directory allow a local user to modify Grinder's cache files. This could lead to unauthorized data tampering within the application's cache.

Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 has a vulnerability in NioEndpoint.java when the NIO connector is used with sendfile and HTTPS. A remote attacker can cause an infinite loop (denial of service) by terminating the connection during response reading.

Multiple cross-site scripting (XSS) vulnerabilities were found in the Lingotek module 6.x-1.x before 6.x-1.40 for Drupal. Remote authenticated users can inject arbitrary web script or HTML when creating or editing page content.

Cross-site scripting (XSS) vulnerability in scp/ajax.php of osTicket before version 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php.

Metamail before 2.7-7.2 allows remote attackers to overwrite arbitrary files via an email message containing a uuencoded attachment that specifies the full pathname of the file to be modified, processed by uuencode in Metamail scripts such as sun-audio-file.