CVE Vulnerability Catalog

On affected platforms running Arista EOS with OSPFv2 configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured, can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.

In Apache ZooKeeper, in FIPS mode, peer hostname verification in quorum TLS is not enforced. Despite enabling the relevant options, the connection accepts a CA-trusted certificate even if the SAN does not match the connected host, allowing a malicious certificate to join quorum traffic.

In Apache ZooKeeper, there is an information disclosure via SetWatches reconnect replay due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs.

A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature.

In the Linux kernel, in the ksmbd module, there is a vulnerability to out-of-bounds reads in share config responses. Lack of validation of IPC data sizes before processing variable-length fields can lead to reading beyond the allowed memory area.

A use-after-free vulnerability exists in the Linux kernel perf subsystem when perf mmap() revival races with the last munmap(). perf_mmap_close() drops rb->mmap_count without holding event->mmap_mutex, allowing a concurrent perf_mmap_rb() to reattach a buffer that is then freed while another process still has it mapped.

In the Linux kernel, the gtp_newlink() error path lacks synchronize_net(), leading to a use-after-free. After clearing sk_user_data without waiting for an RCU grace period, concurrent packet reception in gtp_encap_recv() may still use a pointer to freed memory.

A vulnerability was found in the Linux kernel's fs/ntfs3 module due to missing validation of restart table growth during $LogFile replay. When mounting a crafted NTFS image, an entry count exceeding U16_MAX is truncated, causing allocation of a table smaller than required and an out-of-bounds access.

In the Linux kernel NTFS3 filesystem, read_log_rec_buf() reads out of bounds due to an invalid log->record_header_len value from disk. This can lead to reading memory beyond the buffer when mounting a crafted NTFS image.

In the Linux kernel's vfio/pci subsystem, vfio_msi_cap_len() freed vdev->msi_perm on an initialization failure but left the pointer dangling. This led to a use-after-free on the next device open and a double free on device close, potentially causing a kernel panic.

In the Linux kernel's Bluetooth SCO subsystem, sco_conn_ready() dereferences sk without holding conn->lock or a reference, leading to a use-after-free when the socket is closed concurrently. The fix holds an sk refcount and rechecks socket validity after lock_sock().

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation) can trigger the vulnerability.

On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gNMI access to execute arbitrary code with root privileges on the switch.

On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.

On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevated privileges or access beyond what an administrator intended.

On Arista EOS platforms with OpenConfig and a gNMI server, when gNSI Pathz is configured with a policy containing both a group rule and a user rule for the same path, gNMI may fail to enforce the policy correctly. Under certain conditions, an authenticated user may gain unauthorized read or write access to gNMI paths that the Pathz policy intended to restrict.

On Arista EOS platforms with OpenConfig-related services (gNMI, gNSI, RESTCONF, NETCONF), sensitive requests and responses may be unintentionally logged. These logs may be stored locally or sent to remote accounting servers. Examples include sensitive CLI commands and sensitive OpenConfig YANG leafs.

In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, potentially leading to remote code execution in some configurations.

XikeStor Layer3 switches lack authentication for downloading configuration data. An unauthenticated attacker may retrieve configuration data containing network configurations and passwords to operate the device improperly or use it as a jump host.

QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker logged into a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges.