Vulnerability report for Docker centos:7

Vulnerabilities	1161 via 1161 paths
Dependencies	148
Source	Docker
Target OS	centos:7

Test your Docker Hub image against our market leading vulnerability database Sign up for free

Severity

Critical
3
High
54
Medium
517
Low
587

Status

Open
1161
Patched
0
Ignored
0

critical severity

Buffer Overflow

Vulnerable module: nss
Introduced through: nss@3.53.1-3.el7_9
Fixed in: 0:3.67.0-4.el7_9

Detailed paths

Introduced through: centos@7 › nss@3.53.1-3.el7_9

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.

Remediation

Upgrade Centos:7 nss to version 0:3.67.0-4.el7_9 or higher.

References

Buffer Overflow vulnerability report

critical severity

Buffer Overflow

Vulnerable module: nss-sysinit
Introduced through: nss-sysinit@3.53.1-3.el7_9
Fixed in: 0:3.67.0-4.el7_9

Detailed paths

Introduced through: centos@7 › nss-sysinit@3.53.1-3.el7_9

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.67.0-4.el7_9 or higher.

References

Buffer Overflow vulnerability report

critical severity

Buffer Overflow

Vulnerable module: nss-tools
Introduced through: nss-tools@3.53.1-3.el7_9
Fixed in: 0:3.67.0-4.el7_9

Detailed paths

Introduced through: centos@7 › nss-tools@3.53.1-3.el7_9

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.67.0-4.el7_9 or higher.

References

Buffer Overflow vulnerability report

high severity

Inappropriate Encoding for Output Context

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7
Fixed in: 0:2.1.0-14.el7_9

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

Inappropriate Encoding for Output Context vulnerability report

high severity

Incorrect Behavior Order: Early Validation

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7
Fixed in: 0:2.1.0-14.el7_9

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

Incorrect Behavior Order: Early Validation vulnerability report

high severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7
Fixed in: 0:2.1.0-14.el7_9

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

Integer Overflow or Wraparound vulnerability report

high severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7
Fixed in: 0:2.1.0-14.el7_9

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

Integer Overflow or Wraparound vulnerability report

high severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7
Fixed in: 0:2.1.0-14.el7_9

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

Integer Overflow or Wraparound vulnerability report

high severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7
Fixed in: 0:2.1.0-14.el7_9

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

Integer Overflow or Wraparound vulnerability report

high severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7
Fixed in: 0:2.1.0-14.el7_9

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

Integer Overflow or Wraparound vulnerability report

high severity

Integer Overflow or Wraparound

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7
Fixed in: 0:2.56.1-9.el7_9

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption.

Remediation

Upgrade Centos:7 glib2 to version 0:2.56.1-9.el7_9 or higher.

References

Integer Overflow or Wraparound vulnerability report

high severity

Use After Free

Vulnerable module: systemd
Introduced through: systemd@219-78.el7
Fixed in: 0:219-78.el7_9.7

Detailed paths

Introduced through: centos@7 › systemd@219-78.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.

Remediation

Upgrade Centos:7 systemd to version 0:219-78.el7_9.7 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

Vulnerable module: systemd-libs
Introduced through: systemd-libs@219-78.el7
Fixed in: 0:219-78.el7_9.7

Detailed paths

Introduced through: centos@7 › systemd-libs@219-78.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

Upgrade Centos:7 systemd-libs to version 0:219-78.el7_9.7 or higher.

References

Use After Free vulnerability report

high severity

SQL Injection

Vulnerable module: cyrus-sasl-lib
Introduced through: cyrus-sasl-lib@2.1.26-23.el7
Fixed in: 0:2.1.26-24.el7_9

Detailed paths

Introduced through: centos@7 › cyrus-sasl-lib@2.1.26-23.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream cyrus-sasl-lib package and not the cyrus-sasl-lib package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.

Remediation

Upgrade Centos:7 cyrus-sasl-lib to version 0:2.1.26-24.el7_9 or higher.

References

SQL Injection vulnerability report

high severity

Incorrect Calculation

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7
Fixed in: 0:2.1.0-14.el7_9

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

Incorrect Calculation vulnerability report

high severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7
Fixed in: 0:2.1.0-14.el7_9

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

Integer Overflow or Wraparound vulnerability report

high severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7
Fixed in: 0:2.1.0-14.el7_9

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

Integer Overflow or Wraparound vulnerability report

high severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7
Fixed in: 0:2.1.0-14.el7_9

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

Integer Overflow or Wraparound vulnerability report

high severity

Out-of-bounds Write

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7
Fixed in: 0:2.17-326.el7_9.3

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

Remediation

Upgrade Centos:7 glibc to version 0:2.17-326.el7_9.3 or higher.

References

Out-of-bounds Write vulnerability report

high severity

Out-of-bounds Write

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7
Fixed in: 0:2.17-326.el7_9.3

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

Upgrade Centos:7 glibc-common to version 0:2.17-326.el7_9.3 or higher.

References

Out-of-bounds Write vulnerability report

high severity

Incorrect Behavior Order: Early Validation

Vulnerable module: gzip
Introduced through: gzip@1.5-10.el7
Fixed in: 0:1.5-11.el7_9

Detailed paths

Introduced through: centos@7 › gzip@1.5-10.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream gzip package and not the gzip package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.

Remediation

Upgrade Centos:7 gzip to version 0:1.5-11.el7_9 or higher.

References

Incorrect Behavior Order: Early Validation vulnerability report

high severity

Integer Overflow or Wraparound

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.15.1-50.el7
Fixed in: 0:1.15.1-55.el7_9

Detailed paths

Introduced through: centos@7 › krb5-libs@1.15.1-50.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

Remediation

Upgrade Centos:7 krb5-libs to version 0:1.15.1-55.el7_9 or higher.

References

Integer Overflow or Wraparound vulnerability report

high severity

Out-of-Bounds

Vulnerable module: nss
Introduced through: nss@3.53.1-3.el7_9
Fixed in: 0:3.79.0-5.el7_9

Detailed paths

Introduced through: centos@7 › nss@3.53.1-3.el7_9

NVD Description

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Remediation

Upgrade Centos:7 nss to version 0:3.79.0-5.el7_9 or higher.

References

Out-of-Bounds vulnerability report

high severity

Out-of-Bounds

Vulnerable module: nss-sysinit
Introduced through: nss-sysinit@3.53.1-3.el7_9
Fixed in: 0:3.79.0-5.el7_9

Detailed paths

Introduced through: centos@7 › nss-sysinit@3.53.1-3.el7_9

NVD Description

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.79.0-5.el7_9 or higher.

References

Out-of-Bounds vulnerability report

high severity

Out-of-Bounds

Vulnerable module: nss-tools
Introduced through: nss-tools@3.53.1-3.el7_9
Fixed in: 0:3.79.0-5.el7_9

Detailed paths

Introduced through: centos@7 › nss-tools@3.53.1-3.el7_9

NVD Description

Remediation

Upgrade Centos:7 nss-tools to version 0:3.79.0-5.el7_9 or higher.

References

Out-of-Bounds vulnerability report

high severity

Incorrect Behavior Order: Early Validation

Vulnerable module: xz
Introduced through: xz@5.2.2-1.el7
Fixed in: 0:5.2.2-2.el7_9

Detailed paths

Introduced through: centos@7 › xz@5.2.2-1.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream xz package and not the xz package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

Upgrade Centos:7 xz to version 0:5.2.2-2.el7_9 or higher.

References

Incorrect Behavior Order: Early Validation vulnerability report

high severity

Incorrect Behavior Order: Early Validation

Vulnerable module: xz-libs
Introduced through: xz-libs@5.2.2-1.el7
Fixed in: 0:5.2.2-2.el7_9

Detailed paths

Introduced through: centos@7 › xz-libs@5.2.2-1.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream xz-libs package and not the xz-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

Upgrade Centos:7 xz-libs to version 0:5.2.2-2.el7_9 or higher.

References

Incorrect Behavior Order: Early Validation vulnerability report

high severity

Authentication Bypass by Primary Weakness

Vulnerable module: python
Introduced through: python@2.7.5-89.el7
Fixed in: 0:2.7.5-94.el7_9

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)

Remediation

Upgrade Centos:7 python to version 0:2.7.5-94.el7_9 or higher.

References

Authentication Bypass by Primary Weakness vulnerability report

high severity

Authentication Bypass by Primary Weakness

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7
Fixed in: 0:2.7.5-94.el7_9

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-94.el7_9 or higher.

References

Authentication Bypass by Primary Weakness vulnerability report

high severity

Out-of-Bounds

Vulnerable module: zlib
Introduced through: zlib@1.2.7-18.el7
Fixed in: 0:1.2.7-20.el7_9

Detailed paths

Introduced through: centos@7 › zlib@1.2.7-18.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

Remediation

Upgrade Centos:7 zlib to version 0:1.2.7-20.el7_9 or higher.

References

Out-of-Bounds vulnerability report

high severity

Out-of-Bounds

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7
Fixed in: 32:9.11.4-26.P2.el7_9.4

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.4 or higher.

References

Out-of-Bounds vulnerability report

high severity

Use After Free

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7
Fixed in: 0:2.1.0-15.el7_9

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-15.el7_9 or higher.

References

Use After Free vulnerability report

high severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7
Fixed in: 0:2.1.0-14.el7_9

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

Integer Overflow or Wraparound vulnerability report

high severity

Out-of-Bounds

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7
Fixed in: 0:2.17-326.el7_9.3

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

nscd: Stack-based buffer overflow in netgroup cache

If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Centos:7 glibc to version 0:2.17-326.el7_9.3 or higher.

References

Out-of-Bounds vulnerability report

high severity

Out-of-Bounds

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7
Fixed in: 0:2.17-326.el7_9.3

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

nscd: Stack-based buffer overflow in netgroup cache

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Centos:7 glibc-common to version 0:2.17-326.el7_9.3 or higher.

References

Out-of-Bounds vulnerability report

high severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7
Fixed in: 32:9.11.4-26.P2.el7_9.14

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

Every named instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the max-cache-size statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit.

It has been discovered that the effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.14 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

high severity

Improper Input Validation

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7
Fixed in: 32:9.11.4-26.P2.el7_9.15

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing named to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.15 or higher.

References

Improper Input Validation vulnerability report

high severity

Memory Leak

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7
Fixed in: 32:9.11.4-26.P2.el7_9.10

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.10 or higher.

References

Memory Leak vulnerability report

high severity

Memory Leak

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7
Fixed in: 32:9.11.4-26.P2.el7_9.10

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.10 or higher.

References

Memory Leak vulnerability report

high severity

Reachable Assertion

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7
Fixed in: 32:9.11.4-26.P2.el7_9.5

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.5 or higher.

References

Reachable Assertion vulnerability report

high severity

Resource Exhaustion

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7
Fixed in: 32:9.11.4-26.P2.el7_9.16

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected named instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.16 or higher.

References

Resource Exhaustion vulnerability report

high severity

Resource Exhaustion

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7
Fixed in: 32:9.11.4-26.P2.el7_9.16

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.16 or higher.

References

Resource Exhaustion vulnerability report

high severity

Resource Exhaustion

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7
Fixed in: 32:9.11.4-26.P2.el7_9.16

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.16 or higher.

References

Resource Exhaustion vulnerability report

high severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7
Fixed in: 1:1.0.2k-25.el7_9

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-25.el7_9 or higher.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

high severity

Improper Input Validation

Vulnerable module: python
Introduced through: python@2.7.5-89.el7
Fixed in: 0:2.7.5-93.el7_9

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-93.el7_9 or higher.

References

Improper Input Validation vulnerability report

high severity

Improper Input Validation

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7
Fixed in: 0:2.7.5-93.el7_9

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-93.el7_9 or higher.

References

Improper Input Validation vulnerability report

high severity

Incorrect Type Conversion or Cast

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7
Fixed in: 1:1.0.2k-26.el7_9

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.

When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-26.el7_9 or higher.

References

Incorrect Type Conversion or Cast vulnerability report

high severity

NULL Pointer Dereference

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7
Fixed in: 1:1.0.2k-21.el7_9

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-21.el7_9 or higher.

References

NULL Pointer Dereference vulnerability report

high severity

NULL Pointer Dereference

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7
Fixed in: 0:2.17-326.el7_9.3

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

nscd: Null pointer crashes after notfound response

If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Centos:7 glibc to version 0:2.17-326.el7_9.3 or higher.

References

NULL Pointer Dereference vulnerability report

high severity

NULL Pointer Dereference

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7
Fixed in: 0:2.17-326.el7_9.3

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

nscd: Null pointer crashes after notfound response

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Centos:7 glibc-common to version 0:2.17-326.el7_9.3 or higher.

References

NULL Pointer Dereference vulnerability report

high severity

Not Failing Securely ('Failing Open')

Vulnerable module: nss
Introduced through: nss@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss@3.53.1-3.el7_9

NVD Description

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

Remediation

There is no fixed version for Centos:7 nss.

References

Not Failing Securely ('Failing Open') vulnerability report

high severity

Not Failing Securely ('Failing Open')

Vulnerable module: nss-sysinit
Introduced through: nss-sysinit@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-sysinit@3.53.1-3.el7_9

NVD Description

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

Not Failing Securely ('Failing Open') vulnerability report

high severity

Not Failing Securely ('Failing Open')

Vulnerable module: nss-tools
Introduced through: nss-tools@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-tools@3.53.1-3.el7_9

NVD Description

Remediation

There is no fixed version for Centos:7 nss-tools.

References

Not Failing Securely ('Failing Open') vulnerability report

high severity

Improper Check or Handling of Exceptional Conditions

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7
Fixed in: 0:2.17-326.el7_9.3

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

nscd: netgroup cache may terminate daemon on memory allocation failure

The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Centos:7 glibc to version 0:2.17-326.el7_9.3 or higher.

References

Improper Check or Handling of Exceptional Conditions vulnerability report

high severity

Improper Check or Handling of Exceptional Conditions

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7
Fixed in: 0:2.17-326.el7_9.3

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

nscd: netgroup cache assumes NSS callback uses in-buffer strings

The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Centos:7 glibc to version 0:2.17-326.el7_9.3 or higher.

References

Improper Check or Handling of Exceptional Conditions vulnerability report

high severity

Improper Check or Handling of Exceptional Conditions

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7
Fixed in: 0:2.17-326.el7_9.3

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

nscd: netgroup cache may terminate daemon on memory allocation failure

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Centos:7 glibc-common to version 0:2.17-326.el7_9.3 or higher.

References

Improper Check or Handling of Exceptional Conditions vulnerability report

high severity

Improper Check or Handling of Exceptional Conditions

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7
Fixed in: 0:2.17-326.el7_9.3

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

nscd: netgroup cache assumes NSS callback uses in-buffer strings

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Centos:7 glibc-common to version 0:2.17-326.el7_9.3 or higher.

References

Improper Check or Handling of Exceptional Conditions vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

Remediation

There is no fixed version for Centos:7 expat.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Remediation

There is no fixed version for Centos:7 glibc.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Out-of-bounds Read vulnerability report

medium severity

Privilege Context Switching Error

Vulnerable module: coreutils
Introduced through: coreutils@8.22-24.el7

Detailed paths

Introduced through: centos@7 › coreutils@8.22-24.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream coreutils package and not the coreutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for Centos:7 coreutils.

References

Privilege Context Switching Error vulnerability report

medium severity

Privilege Context Switching Error

Vulnerable module: libblkid
Introduced through: libblkid@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libblkid@2.23.2-65.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libblkid package and not the libblkid package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for Centos:7 libblkid.

References

Privilege Context Switching Error vulnerability report

medium severity

Privilege Context Switching Error

Vulnerable module: libmount
Introduced through: libmount@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libmount@2.23.2-65.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libmount package and not the libmount package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for Centos:7 libmount.

References

Privilege Context Switching Error vulnerability report

medium severity

Privilege Context Switching Error

Vulnerable module: libuuid
Introduced through: libuuid@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libuuid@2.23.2-65.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libuuid package and not the libuuid package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for Centos:7 libuuid.

References

Privilege Context Switching Error vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Out-of-bounds Write vulnerability report

medium severity

Use After Free

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Use After Free vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Out-of-bounds Write vulnerability report

medium severity

Use After Free

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Use After Free vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: lz4
Introduced through: lz4@1.8.3-1.el7

Detailed paths

Introduced through: centos@7 › lz4@1.8.3-1.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream lz4 package and not the lz4 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

Remediation

There is no fixed version for Centos:7 lz4.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Privilege Context Switching Error

Vulnerable module: util-linux
Introduced through: util-linux@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › util-linux@2.23.2-65.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for Centos:7 util-linux.

References

Privilege Context Switching Error vulnerability report

medium severity

Inappropriate Encoding for Output Context

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7
Fixed in: 0:2.27-44.base.el7_9.1

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements of bidirectional text can further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such that the ordering of tokens perceived by human reviewers does not match what will be processed by a compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.

Remediation

Upgrade Centos:7 binutils to version 0:2.27-44.base.el7_9.1 or higher.

References

Inappropriate Encoding for Output Context vulnerability report

medium severity

Inappropriate Encoding for Output Context

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

There is no fixed version for Centos:7 libgcc.

References

Inappropriate Encoding for Output Context vulnerability report

medium severity

Inappropriate Encoding for Output Context

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Inappropriate Encoding for Output Context vulnerability report

medium severity

Inappropriate Encoding for Output Context

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allows an adversary to produce source code identifiers such as function names using homoglyphs that render visually identical to a target identifier. Adversaries can leverage this to inject code via adversarial identifier definitions in upstream software dependencies invoked deceptively in downstream software. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard (all versions). Unless mitigated, an adversary could produce source code identifiers using homoglyph characters that render visually identical to but are distinct from a target identifier. In this way, an adversary could inject adversarial identifier definitions in upstream software that are not detected by human reviewers and are invoked deceptively in downstream software. The Unicode Consortium has documented this class of security vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms.

Remediation

There is no fixed version for Centos:7 libgcc.

References

Inappropriate Encoding for Output Context vulnerability report

medium severity

Inappropriate Encoding for Output Context

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Inappropriate Encoding for Output Context vulnerability report

medium severity

Release of Invalid Pointer or Reference

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when --no-clobber is used together with --remove-on-error.

Remediation

There is no fixed version for Centos:7 curl.

References

Release of Invalid Pointer or Reference vulnerability report

medium severity

Release of Invalid Pointer or Reference

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when --no-clobber is used together with --remove-on-error.

Remediation

There is no fixed version for Centos:7 libcurl.

References

Release of Invalid Pointer or Reference vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Use After Free

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Use After Free vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Use After Free

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Use After Free vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: lz4
Introduced through: lz4@1.8.3-1.el7

Detailed paths

Introduced through: centos@7 › lz4@1.8.3-1.el7

NVD Description

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Remediation

There is no fixed version for Centos:7 lz4.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)

Remediation

There is no fixed version for Centos:7 python.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Out-of-Bounds vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

medium severity

Use After Free

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

Use After Free vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: json-c
Introduced through: json-c@0.11-4.el7_0

Detailed paths

Introduced through: centos@7 › json-c@0.11-4.el7_0

NVD Description

Note: Versions mentioned in the description apply only to the upstream json-c package and not the json-c package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.

Remediation

There is no fixed version for Centos:7 json-c.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: libcap
Introduced through: libcap@2.22-11.el7

Detailed paths

Introduced through: centos@7 › libcap@2.22-11.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcap package and not the libcap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB.

Remediation

There is no fixed version for Centos:7 libcap.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: libcom_err
Introduced through: libcom_err@1.42.9-19.el7

Detailed paths

Introduced through: centos@7 › libcom_err@1.42.9-19.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcom_err package and not the libcom_err package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.

Remediation

There is no fixed version for Centos:7 libcom_err.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Double Free

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Double Free vulnerability report

medium severity

Use After Free

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Use After Free vulnerability report

medium severity

Double Free

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Double Free vulnerability report

medium severity

Use After Free

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Use After Free vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Out-of-bounds Write vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Out-of-bounds Write vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Out-of-bounds Write vulnerability report

medium severity

XML External Entity (XXE) Injection

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.

Remediation

There is no fixed version for Centos:7 python.

References

XML External Entity (XXE) Injection vulnerability report

medium severity

XML External Entity (XXE) Injection

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.

Remediation

There is no fixed version for Centos:7 python-libs.

References

XML External Entity (XXE) Injection vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

vim is vulnerable to Heap-based Buffer Overflow

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-Bounds vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Read vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Write vulnerability report

medium severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

vim is vulnerable to Use After Free

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7
Fixed in: 32:9.11.4-26.P2.el7_9.2

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.2 or higher.

References

Resource Exhaustion vulnerability report

medium severity

Cleartext Transmission of Sensitive Information

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (--ssl-reqd on the command line orCURLOPT_USE_SSL set to CURLUSESSL_CONTROL or CURLUSESSL_ALL withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations withoutTLS contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

Remediation

There is no fixed version for Centos:7 curl.

References

Cleartext Transmission of Sensitive Information vulnerability report

medium severity

Cleartext Transmission of Sensitive Information

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Remediation

There is no fixed version for Centos:7 curl.

References

Cleartext Transmission of Sensitive Information vulnerability report

medium severity

Improper Certificate Validation

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.

Remediation

There is no fixed version for Centos:7 curl.

References

Improper Certificate Validation vulnerability report

medium severity

Inappropriate Encoding for Output Context

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a different URL usingthe wrong host name when it is later retrieved.For example, a URL like http://example.com%2F127.0.0.1/, would be allowed bythe parser and get transposed into http://example.com/127.0.0.1/. This flawcan be used to circumvent filters, checks and more.

Remediation

There is no fixed version for Centos:7 curl.

References

Inappropriate Encoding for Output Context vulnerability report

medium severity

Missing Release of Resource after Effective Lifetime

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

Remediation

There is no fixed version for Centos:7 curl.

References

Missing Release of Resource after Effective Lifetime vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: cyrus-sasl-lib
Introduced through: cyrus-sasl-lib@2.1.26-23.el7

Detailed paths

Introduced through: centos@7 › cyrus-sasl-lib@2.1.26-23.el7

NVD Description

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.

Remediation

There is no fixed version for Centos:7 cyrus-sasl-lib.

References

Resource Exhaustion vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

Remediation

There is no fixed version for Centos:7 expat.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

Remediation

There is no fixed version for Centos:7 expat.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

Remediation

There is no fixed version for Centos:7 expat.

References

Resource Exhaustion vulnerability report

medium severity

Use After Free

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

Remediation

There is no fixed version for Centos:7 expat.

References

Use After Free vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.

Remediation

There is no fixed version for Centos:7 glib2.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Improper Input Validation

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.

Remediation

There is no fixed version for Centos:7 glibc.

References

Improper Input Validation vulnerability report

medium severity

Memory Leak

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.

Remediation

There is no fixed version for Centos:7 glibc.

References

Memory Leak vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

The xdr_bytes and xdr_string functions in the GNU C Library (aka glibc or libc6) 2.25 mishandle failures of buffer deserialization, which allows remote attackers to cause a denial of service (virtual memory allocation, or memory consumption if an overcommit setting is not used) via a crafted UDP packet to port 111, a related issue to CVE-2017-8779. NOTE: [Information provided from upstream and references

Remediation

There is no fixed version for Centos:7 glibc.

References

Resource Exhaustion vulnerability report

medium severity

Stack-based Buffer Overflow

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7
Fixed in: 0:2.17-322.el7_9

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of "Fixed for glibc 2.33" in the 26649 reference.

Remediation

Upgrade Centos:7 glibc to version 0:2.17-322.el7_9 or higher.

References

Stack-based Buffer Overflow vulnerability report

medium severity

Improper Input Validation

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Improper Input Validation vulnerability report

medium severity

Memory Leak

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Memory Leak vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Resource Exhaustion vulnerability report

medium severity

Stack-based Buffer Overflow

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7
Fixed in: 0:2.17-322.el7_9

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

Upgrade Centos:7 glibc-common to version 0:2.17-322.el7_9 or higher.

References

Stack-based Buffer Overflow vulnerability report

medium severity

Memory Leak

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.15.1-50.el7

Detailed paths

Introduced through: centos@7 › krb5-libs@1.15.1-50.el7

NVD Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

Memory Leak vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.15.1-50.el7

Detailed paths

Introduced through: centos@7 › krb5-libs@1.15.1-50.el7

NVD Description

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

NULL Pointer Dereference vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.15.1-50.el7

Detailed paths

Introduced through: centos@7 › krb5-libs@1.15.1-50.el7

NVD Description

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

Uncontrolled Recursion vulnerability report

medium severity

Cleartext Transmission of Sensitive Information

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Cleartext Transmission of Sensitive Information vulnerability report

medium severity

Cleartext Transmission of Sensitive Information

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Cleartext Transmission of Sensitive Information vulnerability report

medium severity

Improper Certificate Validation

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Improper Certificate Validation vulnerability report

medium severity

Inappropriate Encoding for Output Context

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Inappropriate Encoding for Output Context vulnerability report

medium severity

Missing Release of Resource after Effective Lifetime

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Missing Release of Resource after Effective Lifetime vulnerability report

medium severity

Improper Certificate Validation

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

Remediation

There is no fixed version for Centos:7 libgcc.

References

Improper Certificate Validation vulnerability report

medium severity

Improper Input Validation

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

Remediation

There is no fixed version for Centos:7 libgcc.

References

Improper Input Validation vulnerability report

medium severity

Improper Input Validation

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

Remediation

There is no fixed version for Centos:7 libgcc.

References

Improper Input Validation vulnerability report

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Remediation

There is no fixed version for Centos:7 libgcc.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.

Remediation

There is no fixed version for Centos:7 libgcc.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

medium severity

Use of a Broken or Risky Cryptographic Algorithm

Vulnerable module: libgcrypt
Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

Introduced through: centos@7 › libgcrypt@1.5.3-14.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt package and not the libgcrypt package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: libssh2
Introduced through: libssh2@1.8.0-4.el7
Fixed in: 0:1.8.0-4.el7_9.1

Detailed paths

Introduced through: centos@7 › libssh2@1.8.0-4.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory.

Remediation

Upgrade Centos:7 libssh2 to version 0:1.8.0-4.el7_9.1 or higher.

References

Out-of-bounds Read vulnerability report

medium severity

Improper Certificate Validation

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Improper Certificate Validation vulnerability report

medium severity

Improper Input Validation

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Improper Input Validation vulnerability report

medium severity

Improper Input Validation

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Improper Input Validation vulnerability report

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: libtasn1
Introduced through: libtasn1@4.10-1.el7

Detailed paths

Introduced through: centos@7 › libtasn1@4.10-1.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libtasn1 package and not the libtasn1 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.

Remediation

There is no fixed version for Centos:7 libtasn1.

References

Uncontrolled Recursion vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') vulnerability report

medium severity

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Integer Overflow or Wraparound vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 libxml2.

References

NULL Pointer Dereference vulnerability report

medium severity

Use After Free

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Use After Free vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') vulnerability report

medium severity

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Integer Overflow or Wraparound vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

NULL Pointer Dereference vulnerability report

medium severity

Use After Free

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Use After Free vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: nss
Introduced through: nss@3.53.1-3.el7_9
Fixed in: 0:3.53.1-7.el7_9

Detailed paths

Introduced through: centos@7 › nss@3.53.1-3.el7_9

NVD Description

A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.

Remediation

Upgrade Centos:7 nss to version 0:3.53.1-7.el7_9 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

Use of a Broken or Risky Cryptographic Algorithm

Vulnerable module: nss
Introduced through: nss@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss@3.53.1-3.el7_9

NVD Description

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

Remediation

There is no fixed version for Centos:7 nss.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: nss-sysinit
Introduced through: nss-sysinit@3.53.1-3.el7_9
Fixed in: 0:3.53.1-7.el7_9

Detailed paths

Introduced through: centos@7 › nss-sysinit@3.53.1-3.el7_9

NVD Description

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.53.1-7.el7_9 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

Use of a Broken or Risky Cryptographic Algorithm

Vulnerable module: nss-sysinit
Introduced through: nss-sysinit@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-sysinit@3.53.1-3.el7_9

NVD Description

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: nss-tools
Introduced through: nss-tools@3.53.1-3.el7_9
Fixed in: 0:3.53.1-7.el7_9

Detailed paths

Introduced through: centos@7 › nss-tools@3.53.1-3.el7_9

NVD Description

Remediation

Upgrade Centos:7 nss-tools to version 0:3.53.1-7.el7_9 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

Use of a Broken or Risky Cryptographic Algorithm

Vulnerable module: nss-tools
Introduced through: nss-tools@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-tools@3.53.1-3.el7_9

NVD Description

Remediation

There is no fixed version for Centos:7 nss-tools.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

medium severity

Access of Resource Using Incompatible Type ('Type Confusion')

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability report

medium severity

Improper Handling of Length Parameter Inconsistency

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

Improper Handling of Length Parameter Inconsistency vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).

Remediation

There is no fixed version for Centos:7 openldap.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Integer Underflow

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

Integer Underflow vulnerability report

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7
Fixed in: 0:2.4.44-23.el7_9

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service.

Remediation

Upgrade Centos:7 openldap to version 0:2.4.44-23.el7_9 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read).

Remediation

There is no fixed version for Centos:7 openldap.

References

Out-of-bounds Read vulnerability report

medium severity

Reachable Assertion

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7
Fixed in: 0:2.4.44-25.el7_9

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.

Remediation

Upgrade Centos:7 openldap to version 0:2.4.44-25.el7_9 or higher.

References

Reachable Assertion vulnerability report

medium severity

Reachable Assertion

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7
Fixed in: 0:2.4.44-25.el7_9

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability.

Remediation

Upgrade Centos:7 openldap to version 0:2.4.44-25.el7_9 or higher.

References

Reachable Assertion vulnerability report

medium severity

Reachable Assertion

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

Reachable Assertion vulnerability report

medium severity

Reachable Assertion

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

Reachable Assertion vulnerability report

medium severity

Release of Invalid Pointer or Reference

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

Release of Invalid Pointer or Reference vulnerability report

medium severity

Release of Invalid Pointer or Reference

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

Release of Invalid Pointer or Reference vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime.

Remediation

There is no fixed version for Centos:7 openldap.

References

Resource Exhaustion vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7
Fixed in: 1:1.0.2k-22.el7_9

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-22.el7_9 or higher.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Use After Free

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.

The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash.

This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.

Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream.

The OpenSSL cms and smime command line applications are similarly affected.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Use After Free vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: p11-kit
Introduced through: p11-kit@0.23.5-3.el7

Detailed paths

Introduced through: centos@7 › p11-kit@0.23.5-3.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream p11-kit package and not the p11-kit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc.

Remediation

There is no fixed version for Centos:7 p11-kit.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: p11-kit-trust
Introduced through: p11-kit-trust@0.23.5-3.el7

Detailed paths

Introduced through: centos@7 › p11-kit-trust@0.23.5-3.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream p11-kit-trust package and not the p11-kit-trust package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

There is no fixed version for Centos:7 p11-kit-trust.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Improper Input Validation

Vulnerable module: pcre
Introduced through: pcre@8.32-17.el7

Detailed paths

Introduced through: centos@7 › pcre@8.32-17.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre package and not the pcre package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup.

Remediation

There is no fixed version for Centos:7 pcre.

References

Improper Input Validation vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: pcre
Introduced through: pcre@8.32-17.el7

Detailed paths

Introduced through: centos@7 › pcre@8.32-17.el7

NVD Description

The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.

Remediation

There is no fixed version for Centos:7 pcre.

References

Out-of-bounds Read vulnerability report

medium severity

Eval Injection

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.

Remediation

There is no fixed version for Centos:7 python.

References

Eval Injection vulnerability report

medium severity

Improper Input Validation

Vulnerable module: python
Introduced through: python@2.7.5-89.el7
Fixed in: 0:2.7.5-90.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-90.el7 or higher.

References

Improper Input Validation vulnerability report

medium severity

Incorrect Type Conversion or Cast

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 python.

References

Incorrect Type Conversion or Cast vulnerability report

medium severity

Inefficient Regular Expression Complexity

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

There is a MEDIUM severity vulnerability affecting CPython.

Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

Remediation

There is no fixed version for Centos:7 python.

References

Inefficient Regular Expression Complexity vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Remediation

There is no fixed version for Centos:7 python.

References

Resource Exhaustion vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.

Remediation

There is no fixed version for Centos:7 python.

References

Uncontrolled Recursion vulnerability report

medium severity

Use After Free

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

A use-after-free exists in Python through 3.9 via heappushpop in heapq.

Remediation

There is no fixed version for Centos:7 python.

References

Use After Free vulnerability report

medium severity

Eval Injection

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.

Remediation

There is no fixed version for Centos:7 python-libs.

References

Eval Injection vulnerability report

medium severity

Improper Input Validation

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7
Fixed in: 0:2.7.5-90.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-90.el7 or higher.

References

Improper Input Validation vulnerability report

medium severity

Incorrect Type Conversion or Cast

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Incorrect Type Conversion or Cast vulnerability report

medium severity

Inefficient Regular Expression Complexity

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

There is a MEDIUM severity vulnerability affecting CPython.

Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

Remediation

There is no fixed version for Centos:7 python-libs.

References

Inefficient Regular Expression Complexity vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Resource Exhaustion vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Uncontrolled Recursion vulnerability report

medium severity

Use After Free

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

A use-after-free exists in Python through 3.9 via heappushpop in heapq.

Remediation

There is no fixed version for Centos:7 python-libs.

References

Use After Free vulnerability report

medium severity

Improper Input Validation

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Improper Input Validation vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.

Remediation

There is no fixed version for Centos:7 sqlite.

References

NULL Pointer Dereference vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Out-of-bounds Read vulnerability report

medium severity

Unchecked Error Condition

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Unchecked Error Condition vulnerability report

medium severity

Off-by-one Error

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

Remediation

There is no fixed version for Centos:7 glibc.

References

Off-by-one Error vulnerability report

medium severity

Off-by-one Error

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Off-by-one Error vulnerability report

medium severity

Arbitrary Command Injection

Vulnerable module: libblkid
Introduced through: libblkid@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libblkid@2.23.2-65.el7

NVD Description

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Remediation

There is no fixed version for Centos:7 libblkid.

References

Arbitrary Command Injection vulnerability report

medium severity

Arbitrary Command Injection

Vulnerable module: libmount
Introduced through: libmount@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libmount@2.23.2-65.el7

NVD Description

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Remediation

There is no fixed version for Centos:7 libmount.

References

Arbitrary Command Injection vulnerability report

medium severity

Arbitrary Command Injection

Vulnerable module: libuuid
Introduced through: libuuid@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libuuid@2.23.2-65.el7

NVD Description

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Remediation

There is no fixed version for Centos:7 libuuid.

References

Arbitrary Command Injection vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Improper Access Control

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.

Remediation

There is no fixed version for Centos:7 openldap.

References

Improper Access Control vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7
Fixed in: 1:1.0.2k-23.el7_9

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-23.el7_9 or higher.

References

Out-of-bounds Read vulnerability report

medium severity

Arbitrary Command Injection

Vulnerable module: util-linux
Introduced through: util-linux@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › util-linux@2.23.2-65.el7

NVD Description

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Remediation

There is no fixed version for Centos:7 util-linux.

References

Arbitrary Command Injection vulnerability report

medium severity

Link Following

Vulnerable module: rpm
Introduced through: rpm@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm@4.11.3-45.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm package and not the rpm package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.

Remediation

There is no fixed version for Centos:7 rpm.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm
Introduced through: rpm@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm@4.11.3-45.el7

NVD Description

It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.

Remediation

There is no fixed version for Centos:7 rpm.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-build-libs
Introduced through: rpm-build-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-build-libs@4.11.3-45.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-build-libs package and not the rpm-build-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-build-libs
Introduced through: rpm-build-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-build-libs@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-libs
Introduced through: rpm-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-libs@4.11.3-45.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-libs package and not the rpm-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-libs
Introduced through: rpm-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-libs@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-python
Introduced through: rpm-python@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-python@4.11.3-45.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-python package and not the rpm-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

There is no fixed version for Centos:7 rpm-python.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-python
Introduced through: rpm-python@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-python@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-python.

References

Link Following vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

vim is vulnerable to Heap-based Buffer Overflow

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Write vulnerability report

medium severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

vim is vulnerable to Use After Free

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

medium severity

Insufficient Verification of Data Authenticity

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.15.1-50.el7

Detailed paths

Introduced through: centos@7 › krb5-libs@1.15.1-50.el7

NVD Description

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

Insufficient Verification of Data Authenticity vulnerability report

medium severity

Stack-based Buffer Overflow

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.15.1-50.el7

Detailed paths

Introduced through: centos@7 › krb5-libs@1.15.1-50.el7

NVD Description

plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

Stack-based Buffer Overflow vulnerability report

medium severity

CVE-2023-26604

Vulnerable module: systemd
Introduced through: systemd@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd@219-78.el7

NVD Description

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

Remediation

There is no fixed version for Centos:7 systemd.

References

CVE-2023-26604 vulnerability report

medium severity

CVE-2023-26604

Vulnerable module: systemd-libs
Introduced through: systemd-libs@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd-libs@219-78.el7

NVD Description

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

CVE-2023-26604 vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

vim is vulnerable to Heap-based Buffer Overflow

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-Bounds vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: bash
Introduced through: bash@4.2.46-34.el7

Detailed paths

Introduced through: centos@7 › bash@4.2.46-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bash package and not the bash package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, are printed through the echo built-in function. A local attacker, who can provide data to print through the "echo -e" built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr() in lib/sh/strtrans.c mishandles u32cconv().

Remediation

There is no fixed version for Centos:7 bash.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

readelf in GNU Binutils 2.28 writes to illegal addresses while processing corrupt input files containing symbol-difference relocations, leading to a heap-based buffer overflow.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in bfd_getl64.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and availability.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Write vulnerability report

medium severity

Use After Free

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

readelf in GNU Binutils 2.28 has a use-after-free (specifically read-after-free) error while processing multiple, relocated sections in an MSP430 binary. This is caused by mishandling of an invalid symbol index, and mishandling of state across invocations.

Remediation

There is no fixed version for Centos:7 binutils.

References

Use After Free vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: cpio
Introduced through: cpio@2.11-28.el7

Detailed paths

Introduced through: centos@7 › cpio@2.11-28.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream cpio package and not the cpio package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.

Remediation

There is no fixed version for Centos:7 cpio.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Improper Input Validation

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

Remediation

There is no fixed version for Centos:7 glibc.

References

Improper Input Validation vulnerability report

medium severity

Improper Input Validation

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

Remediation

There is no fixed version for Centos:7 glibc.

References

Improper Input Validation vulnerability report

medium severity

Use After Free

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.

Remediation

There is no fixed version for Centos:7 glibc.

References

Use After Free vulnerability report

medium severity

Improper Input Validation

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Improper Input Validation vulnerability report

medium severity

Improper Input Validation

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Improper Input Validation vulnerability report

medium severity

Use After Free

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Use After Free vulnerability report

medium severity

Link Following

Vulnerable module: systemd
Introduced through: systemd@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd@219-78.el7

NVD Description

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.

Remediation

There is no fixed version for Centos:7 systemd.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: systemd-libs
Introduced through: systemd-libs@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd-libs@219-78.el7

NVD Description

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

Link Following vulnerability report

medium severity

CVE-2005-2541

Vulnerable module: tar
Introduced through: tar@2:1.26-35.el7

Detailed paths

Introduced through: centos@7 › tar@2:1.26-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

Remediation

There is no fixed version for Centos:7 tar.

References

CVE-2005-2541 vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: zlib
Introduced through: zlib@1.2.7-18.el7
Fixed in: 0:1.2.7-21.el7_9

Detailed paths

Introduced through: centos@7 › zlib@1.2.7-18.el7

NVD Description

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Remediation

Upgrade Centos:7 zlib to version 0:1.2.7-21.el7_9 or higher.

References

Out-of-Bounds vulnerability report

medium severity

HTTP Request Smuggling

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7
Fixed in: 32:9.11.4-26.P2.el7_9.13

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.13 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

Unchecked Error Condition

Vulnerable module: dracut
Introduced through: dracut@033-572.el7

Detailed paths

Introduced through: centos@7 › dracut@033-572.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dracut package and not the dracut package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid password.

Remediation

There is no fixed version for Centos:7 dracut.

References

Unchecked Error Condition vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: libssh2
Introduced through: libssh2@1.8.0-4.el7

Detailed paths

Introduced through: centos@7 › libssh2@1.8.0-4.el7

NVD Description

In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.

Remediation

There is no fixed version for Centos:7 libssh2.

References

Integer Overflow or Wraparound vulnerability report

medium severity

CVE-2024-6923

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

There is a MEDIUM severity vulnerability affecting CPython.

The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

Remediation

There is no fixed version for Centos:7 python.

References

CVE-2024-6923 vulnerability report

medium severity

CVE-2024-6923

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

There is a MEDIUM severity vulnerability affecting CPython.

The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

Remediation

There is no fixed version for Centos:7 python-libs.

References

CVE-2024-6923 vulnerability report

medium severity

XML External Entity (XXE) Injection

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

Remediation

There is no fixed version for Centos:7 libxml2.

References

XML External Entity (XXE) Injection vulnerability report

medium severity

XML External Entity (XXE) Injection

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

XML External Entity (XXE) Injection vulnerability report

medium severity

Arbitrary Command Injection

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Arbitrary Command Injection vulnerability report

medium severity

Arbitrary Command Injection

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Arbitrary Command Injection vulnerability report

medium severity

Insufficient Verification of Data Authenticity

Vulnerable module: rpm
Introduced through: rpm@4.11.3-45.el7
Fixed in: 0:4.11.3-48.el7_9

Detailed paths

Introduced through: centos@7 › rpm@4.11.3-45.el7

NVD Description

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

Remediation

Upgrade Centos:7 rpm to version 0:4.11.3-48.el7_9 or higher.

References

Insufficient Verification of Data Authenticity vulnerability report

medium severity

Insufficient Verification of Data Authenticity

Vulnerable module: rpm-build-libs
Introduced through: rpm-build-libs@4.11.3-45.el7
Fixed in: 0:4.11.3-48.el7_9

Detailed paths

Introduced through: centos@7 › rpm-build-libs@4.11.3-45.el7

NVD Description

Remediation

Upgrade Centos:7 rpm-build-libs to version 0:4.11.3-48.el7_9 or higher.

References

Insufficient Verification of Data Authenticity vulnerability report

medium severity

Insufficient Verification of Data Authenticity

Vulnerable module: rpm-libs
Introduced through: rpm-libs@4.11.3-45.el7
Fixed in: 0:4.11.3-48.el7_9

Detailed paths

Introduced through: centos@7 › rpm-libs@4.11.3-45.el7

NVD Description

Remediation

Upgrade Centos:7 rpm-libs to version 0:4.11.3-48.el7_9 or higher.

References

Insufficient Verification of Data Authenticity vulnerability report

medium severity

Insufficient Verification of Data Authenticity

Vulnerable module: rpm-python
Introduced through: rpm-python@4.11.3-45.el7
Fixed in: 0:4.11.3-48.el7_9

Detailed paths

Introduced through: centos@7 › rpm-python@4.11.3-45.el7

NVD Description

Remediation

Upgrade Centos:7 rpm-python to version 0:4.11.3-48.el7_9 or higher.

References

Insufficient Verification of Data Authenticity vulnerability report

medium severity

Expected Behavior Violation

Vulnerable module: systemd
Introduced through: systemd@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd@219-78.el7

NVD Description

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

Remediation

There is no fixed version for Centos:7 systemd.

References

Expected Behavior Violation vulnerability report

medium severity

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: systemd
Introduced through: systemd@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd@219-78.el7

NVD Description

systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.

Remediation

There is no fixed version for Centos:7 systemd.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

medium severity

Expected Behavior Violation

Vulnerable module: systemd-libs
Introduced through: systemd-libs@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd-libs@219-78.el7

NVD Description

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

Expected Behavior Violation vulnerability report

medium severity

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: systemd-libs
Introduced through: systemd-libs@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd-libs@219-78.el7

NVD Description

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

vim is vulnerable to Heap-based Buffer Overflow

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Write vulnerability report

medium severity

Improper Input Validation

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

Sending a flood of dynamic DNS updates may cause named to allocate large amounts of memory. This, in turn, may cause named to exit due to a lack of free memory. We are not aware of any cases where this has been exploited.

Memory is allocated prior to the checking of access permissions (ACLs) and is retained during the processing of a dynamic update from a client whose access credentials are accepted. Memory allocated to clients that are not permitted to send updates is released immediately upon rejection. The scope of this vulnerability is limited therefore to trusted clients who are permitted to make dynamic zone changes.

If a dynamic update is REFUSED, memory will be released again very quickly. Therefore it is only likely to be possible to degrade or stop named by sending a flood of unaccepted dynamic updates comparable in magnitude to a query flood intended to achieve the same detrimental outcome.

BIND 9.11 and earlier branches are also affected, but through exhaustion of internal resources rather than memory constraints. This may reduce performance but should not be a significant problem for most servers. Therefore we don't intend to address this for BIND versions prior to BIND 9.16. This issue affects BIND 9 versions 9.16.0 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.8-S1 through 9.16.36-S1.

Remediation

There is no fixed version for Centos:7 bind-license.

References

Improper Input Validation vulnerability report

medium severity

Reachable Assertion

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7
Fixed in: 32:9.11.4-26.P2.el7_9.7

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.7 or higher.

References

Reachable Assertion vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7
Fixed in: 32:9.11.4-26.P2.el7_9.2

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.2 or higher.

References

Resource Exhaustion vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

Remediation

There is no fixed version for Centos:7 curl.

References

Uncontrolled Recursion vulnerability report

medium severity

Improper Verification of Cryptographic Signature

Vulnerable module: dbus
Introduced through: dbus@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus@1:1.10.24-15.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.

Remediation

There is no fixed version for Centos:7 dbus.

References

Improper Verification of Cryptographic Signature vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: dbus
Introduced through: dbus@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus@1:1.10.24-15.el7

NVD Description

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format.

Remediation

There is no fixed version for Centos:7 dbus.

References

Resource Exhaustion vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: dbus
Introduced through: dbus@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus@1:1.10.24-15.el7

NVD Description

Remediation

There is no fixed version for Centos:7 dbus.

References

Resource Exhaustion vulnerability report

medium severity

Improper Verification of Cryptographic Signature

Vulnerable module: dbus-libs
Introduced through: dbus-libs@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus-libs@1:1.10.24-15.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

Improper Verification of Cryptographic Signature vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: dbus-libs
Introduced through: dbus-libs@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus-libs@1:1.10.24-15.el7

NVD Description

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

Resource Exhaustion vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: dbus-libs
Introduced through: dbus-libs@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus-libs@1:1.10.24-15.el7

NVD Description

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format.

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

Resource Exhaustion vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Remediation

There is no fixed version for Centos:7 expat.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

Remediation

There is no fixed version for Centos:7 expat.

References

Resource Exhaustion vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

Remediation

There is no fixed version for Centos:7 glibc.

References

Out-of-bounds Read vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Out-of-bounds Read vulnerability report

medium severity

Improper Validation of Certificate with Host Mismatch

Vulnerable module: gnupg2
Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

Introduced through: centos@7 › gnupg2@2.0.22-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.

Remediation

There is no fixed version for Centos:7 gnupg2.

References

Improper Validation of Certificate with Host Mismatch vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.15.1-50.el7
Fixed in: 0:1.15.1-51.el7_9

Detailed paths

Introduced through: centos@7 › krb5-libs@1.15.1-50.el7

NVD Description

The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.

Remediation

Upgrade Centos:7 krb5-libs to version 0:1.15.1-51.el7_9 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

Remediation

There is no fixed version for Centos:7 libcurl.

References

Uncontrolled Recursion vulnerability report

medium severity

HTTP Request Smuggling

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

Remediation

There is no fixed version for Centos:7 libgcc.

References

HTTP Request Smuggling vulnerability report

medium severity

HTTP Request Smuggling

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

HTTP Request Smuggling vulnerability report

medium severity

Improper Input Validation

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Improper Input Validation vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Out-of-Bounds vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Out-of-bounds Read vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Out-of-bounds Read vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Resource Exhaustion vulnerability report

medium severity

XML External Entity (XXE) Injection

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).

Remediation

There is no fixed version for Centos:7 libxml2.

References

XML External Entity (XXE) Injection vulnerability report

medium severity

Improper Input Validation

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Improper Input Validation vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Out-of-Bounds vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Out-of-bounds Read vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Out-of-bounds Read vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Resource Exhaustion vulnerability report

medium severity

XML External Entity (XXE) Injection

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

XML External Entity (XXE) Injection vulnerability report

medium severity

Information Exposure

Vulnerable module: nss
Introduced through: nss@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss@3.53.1-3.el7_9

NVD Description

NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

Remediation

There is no fixed version for Centos:7 nss.

References

Information Exposure vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: nss
Introduced through: nss@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss@3.53.1-3.el7_9

NVD Description

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.

Remediation

There is no fixed version for Centos:7 nss.

References

NULL Pointer Dereference vulnerability report

medium severity

Information Exposure

Vulnerable module: nss-sysinit
Introduced through: nss-sysinit@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-sysinit@3.53.1-3.el7_9

NVD Description

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

Information Exposure vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: nss-sysinit
Introduced through: nss-sysinit@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-sysinit@3.53.1-3.el7_9

NVD Description

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

NULL Pointer Dereference vulnerability report

medium severity

Information Exposure

Vulnerable module: nss-tools
Introduced through: nss-tools@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-tools@3.53.1-3.el7_9

NVD Description

Remediation

There is no fixed version for Centos:7 nss-tools.

References

Information Exposure vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: nss-tools
Introduced through: nss-tools@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-tools@3.53.1-3.el7_9

NVD Description

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.

Remediation

There is no fixed version for Centos:7 nss-tools.

References

NULL Pointer Dereference vulnerability report

medium severity

Information Exposure

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)

Remediation

There is no fixed version for Centos:7 openldap.

References

Information Exposure vulnerability report

medium severity

SQL Injection

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.

Remediation

There is no fixed version for Centos:7 openldap.

References

SQL Injection vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow.

Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service.

An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods.

When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*).

With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms.

Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data.

Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low.

In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature.

The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication.

In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Resource Exhaustion vulnerability report

medium severity

HTTP Response Splitting

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.

Remediation

There is no fixed version for Centos:7 python.

References

HTTP Response Splitting vulnerability report

medium severity

HTTP Response Splitting

Vulnerable module: python
Introduced through: python@2.7.5-89.el7
Fixed in: 0:2.7.5-92.el7_9

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-92.el7_9 or higher.

References

HTTP Response Splitting vulnerability report

medium severity

HTTP Response Splitting

Vulnerable module: python
Introduced through: python@2.7.5-89.el7
Fixed in: 0:2.7.5-92.el7_9

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-92.el7_9 or higher.

References

HTTP Response Splitting vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

Remediation

There is no fixed version for Centos:7 python.

References

Resource Exhaustion vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

Remediation

There is no fixed version for Centos:7 python.

References

Resource Exhaustion vulnerability report

medium severity

HTTP Response Splitting

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

HTTP Response Splitting vulnerability report

medium severity

HTTP Response Splitting

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7
Fixed in: 0:2.7.5-92.el7_9

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-92.el7_9 or higher.

References

HTTP Response Splitting vulnerability report

medium severity

HTTP Response Splitting

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7
Fixed in: 0:2.7.5-92.el7_9

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-92.el7_9 or higher.

References

HTTP Response Splitting vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Resource Exhaustion vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Resource Exhaustion vulnerability report

medium severity

Link Following

Vulnerable module: rpm
Introduced through: rpm@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm@4.11.3-45.el7

NVD Description

It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

There is no fixed version for Centos:7 rpm.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm
Introduced through: rpm@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm@4.11.3-45.el7

NVD Description

A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

There is no fixed version for Centos:7 rpm.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-build-libs
Introduced through: rpm-build-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-build-libs@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-build-libs
Introduced through: rpm-build-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-build-libs@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-libs
Introduced through: rpm-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-libs@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-libs
Introduced through: rpm-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-libs@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-python
Introduced through: rpm-python@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-python@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-python.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-python
Introduced through: rpm-python@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-python@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-python.

References

Link Following vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Out-of-Bounds vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Out-of-bounds Read vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Out-of-bounds Read vulnerability report

medium severity

Use of Uninitialized Resource

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Use of Uninitialized Resource vulnerability report

medium severity

OS Command Injection

Vulnerable module: libblkid
Introduced through: libblkid@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libblkid@2.23.2-65.el7

NVD Description

An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.

Remediation

There is no fixed version for Centos:7 libblkid.

References

OS Command Injection vulnerability report

medium severity

OS Command Injection

Vulnerable module: libmount
Introduced through: libmount@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libmount@2.23.2-65.el7

NVD Description

An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.

Remediation

There is no fixed version for Centos:7 libmount.

References

OS Command Injection vulnerability report

medium severity

OS Command Injection

Vulnerable module: libuuid
Introduced through: libuuid@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libuuid@2.23.2-65.el7

NVD Description

An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.

Remediation

There is no fixed version for Centos:7 libuuid.

References

OS Command Injection vulnerability report

medium severity

OS Command Injection

Vulnerable module: util-linux
Introduced through: util-linux@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › util-linux@2.23.2-65.el7

NVD Description

An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.

Remediation

There is no fixed version for Centos:7 util-linux.

References

OS Command Injection vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: nspr
Introduced through: nspr@4.25.0-2.el7_9

Detailed paths

Introduced through: centos@7 › nspr@4.25.0-2.el7_9

NVD Description

Note: Versions mentioned in the description apply only to the upstream nspr package and not the nspr package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.

Remediation

There is no fixed version for Centos:7 nspr.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Link Following

Vulnerable module: rpm
Introduced through: rpm@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm@4.11.3-45.el7

NVD Description

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

There is no fixed version for Centos:7 rpm.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-build-libs
Introduced through: rpm-build-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-build-libs@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-libs
Introduced through: rpm-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-libs@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-python
Introduced through: rpm-python@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-python@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-python.

References

Link Following vulnerability report

medium severity

Reachable Assertion

Vulnerable module: dbus
Introduced through: dbus@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus@1:1.10.24-15.el7

NVD Description

D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.

Remediation

There is no fixed version for Centos:7 dbus.

References

Reachable Assertion vulnerability report

medium severity

Reachable Assertion

Vulnerable module: dbus-libs
Introduced through: dbus-libs@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus-libs@1:1.10.24-15.el7

NVD Description

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

Reachable Assertion vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

Remediation

There is no fixed version for Centos:7 expat.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: gmp
Introduced through: gmp@1:6.0.0-15.el7

Detailed paths

Introduced through: centos@7 › gmp@1:6.0.0-15.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream gmp package and not the gmp package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.

Remediation

There is no fixed version for Centos:7 gmp.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Multiple Interpretations of UI Input

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.

The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.

Remediation

There is no fixed version for Centos:7 python.

References

Multiple Interpretations of UI Input vulnerability report

medium severity

Multiple Interpretations of UI Input

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.

Remediation

There is no fixed version for Centos:7 python-libs.

References

Multiple Interpretations of UI Input vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Resource Exhaustion vulnerability report

medium severity

Cleartext Transmission of Sensitive Information

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got before the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

Remediation

There is no fixed version for Centos:7 curl.

References

Cleartext Transmission of Sensitive Information vulnerability report

medium severity

Cleartext Transmission of Sensitive Information

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Cleartext Transmission of Sensitive Information vulnerability report

medium severity

Cross-site Scripting (XSS)

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

Remediation

There is no fixed version for Centos:7 libgcc.

References

Cross-site Scripting (XSS) vulnerability report

medium severity

Information Exposure

Vulnerable module: libgcrypt
Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

Introduced through: centos@7 › libgcrypt@1.5.3-14.el7

NVD Description

libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

Information Exposure vulnerability report

medium severity

Cross-site Scripting (XSS)

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Cross-site Scripting (XSS) vulnerability report

medium severity

Cross-site Scripting (XSS)

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

Possible cross-site scripting vulnerability in libxml after commit 960f0e2.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Cross-site Scripting (XSS) vulnerability report

medium severity

Cross-site Scripting (XSS)

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Possible cross-site scripting vulnerability in libxml after commit 960f0e2.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Cross-site Scripting (XSS) vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: nss
Introduced through: nss@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss@3.53.1-3.el7_9

NVD Description

A mismatch between allocator and deallocator could have lead to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

Remediation

There is no fixed version for Centos:7 nss.

References

Out-of-Bounds vulnerability report

medium severity

Incorrect Conversion between Numeric Types

Vulnerable module: nss-softokn
Introduced through: nss-softokn@3.53.1-6.el7_9

Detailed paths

Introduced through: centos@7 › nss-softokn@3.53.1-6.el7_9

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result "POINT_AT_INFINITY" when it should not. A man-in-the-middle attacker could use this to interfere with a connection, resulting in an attacked party computing an incorrect shared secret. This vulnerability affects Firefox < 55.

Remediation

There is no fixed version for Centos:7 nss-softokn.

References

Incorrect Conversion between Numeric Types vulnerability report

medium severity

Incorrect Conversion between Numeric Types

Vulnerable module: nss-softokn-freebl
Introduced through: nss-softokn-freebl@3.53.1-6.el7_9

Detailed paths

Introduced through: centos@7 › nss-softokn-freebl@3.53.1-6.el7_9

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

There is no fixed version for Centos:7 nss-softokn-freebl.

References

Incorrect Conversion between Numeric Types vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: nss-sysinit
Introduced through: nss-sysinit@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-sysinit@3.53.1-3.el7_9

NVD Description

A mismatch between allocator and deallocator could have lead to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

Out-of-Bounds vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: nss-tools
Introduced through: nss-tools@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-tools@3.53.1-3.el7_9

NVD Description

A mismatch between allocator and deallocator could have lead to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

Remediation

There is no fixed version for Centos:7 nss-tools.

References

Out-of-Bounds vulnerability report

medium severity

Missing Authentication for Critical Function

Vulnerable module: systemd
Introduced through: systemd@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd@219-78.el7

NVD Description

An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.

Remediation

There is no fixed version for Centos:7 systemd.

References

Missing Authentication for Critical Function vulnerability report

medium severity

Missing Authentication for Critical Function

Vulnerable module: systemd-libs
Introduced through: systemd-libs@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd-libs@219-78.el7

NVD Description

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

Missing Authentication for Critical Function vulnerability report

medium severity

Authentication Bypass by Primary Weakness

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.

Remediation

There is no fixed version for Centos:7 curl.

References

Authentication Bypass by Primary Weakness vulnerability report

medium severity

Authentication Bypass by Primary Weakness

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.

Remediation

There is no fixed version for Centos:7 curl.

References

Authentication Bypass by Primary Weakness vulnerability report

medium severity

Improper Certificate Validation

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with xn-- and should not be allowed to pattern match, but the wildcard check in curl could still check for x*, which would match even though the IDN name most likely contained nothing even resembling an x.

Remediation

There is no fixed version for Centos:7 curl.

References

Improper Certificate Validation vulnerability report

medium severity

Stack-based Buffer Overflow

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets.

Remediation

There is no fixed version for Centos:7 glibc.

References

Stack-based Buffer Overflow vulnerability report

medium severity

Use After Free

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss_gethostbyname2_r and nss_getcanonname_r hooks without implementing the nss*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

Remediation

There is no fixed version for Centos:7 glibc.

References

Use After Free vulnerability report

medium severity

Use After Free

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

A flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

Remediation

There is no fixed version for Centos:7 glibc.

References

Use After Free vulnerability report

medium severity

Stack-based Buffer Overflow

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Stack-based Buffer Overflow vulnerability report

medium severity

Use After Free

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Use After Free vulnerability report

medium severity

Use After Free

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Use After Free vulnerability report

medium severity

Improper Verification of Cryptographic Signature

Vulnerable module: gnupg2
Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

Introduced through: centos@7 › gnupg2@2.0.22-5.el7_5

NVD Description

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.

Remediation

There is no fixed version for Centos:7 gnupg2.

References

Improper Verification of Cryptographic Signature vulnerability report

medium severity

Authentication Bypass by Primary Weakness

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Authentication Bypass by Primary Weakness vulnerability report

medium severity

Authentication Bypass by Primary Weakness

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Authentication Bypass by Primary Weakness vulnerability report

medium severity

Improper Certificate Validation

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Improper Certificate Validation vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.

Remediation

There is no fixed version for Centos:7 libgcc.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Covert Timing Channel

Vulnerable module: libgcrypt
Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

Introduced through: centos@7 › libgcrypt@1.5.3-14.el7

NVD Description

In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

Covert Timing Channel vulnerability report

medium severity

Covert Timing Channel

Vulnerable module: libgcrypt
Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

Introduced through: centos@7 › libgcrypt@1.5.3-14.el7

NVD Description

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

Covert Timing Channel vulnerability report

medium severity

Use of a Broken or Risky Cryptographic Algorithm

Vulnerable module: libgcrypt
Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

Introduced through: centos@7 › libgcrypt@1.5.3-14.el7

NVD Description

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

medium severity

Truncation of Security-relevant Information

Vulnerable module: libssh2
Introduced through: libssh2@1.8.0-4.el7

Detailed paths

Introduced through: centos@7 › libssh2@1.8.0-4.el7

NVD Description

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.

Remediation

There is no fixed version for Centos:7 libssh2.

References

Truncation of Security-relevant Information vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Off-by-one Error

Vulnerable module: libtasn1
Introduced through: libtasn1@4.10-1.el7

Detailed paths

Introduced through: centos@7 › libtasn1@4.10-1.el7

NVD Description

GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.

Remediation

There is no fixed version for Centos:7 libtasn1.

References

Off-by-one Error vulnerability report

medium severity

Improper Input Validation

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

Remediation

There is no fixed version for Centos:7 libxml2.

References

Improper Input Validation vulnerability report

medium severity

Improper Input Validation

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Improper Input Validation vulnerability report

medium severity

Improper Input Validation

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Improper Input Validation vulnerability report

medium severity

Improper Input Validation

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Improper Input Validation vulnerability report

medium severity

Missing Required Cryptographic Step

Vulnerable module: nss
Introduced through: nss@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss@3.53.1-3.el7_9

NVD Description

nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.

Remediation

There is no fixed version for Centos:7 nss.

References

Missing Required Cryptographic Step vulnerability report

medium severity

Missing Required Cryptographic Step

Vulnerable module: nss-sysinit
Introduced through: nss-sysinit@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-sysinit@3.53.1-3.el7_9

NVD Description

nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

Missing Required Cryptographic Step vulnerability report

medium severity

Missing Required Cryptographic Step

Vulnerable module: nss-tools
Introduced through: nss-tools@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-tools@3.53.1-3.el7_9

NVD Description

nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.

Remediation

There is no fixed version for Centos:7 nss-tools.

References

Missing Required Cryptographic Step vulnerability report

medium severity

Access of Resource Using Incompatible Type ('Type Confusion')

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process.

Impact summary: Abnormal termination of an application can a cause a denial of service.

Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address when comparing the expected name with an otherName subject alternative name of an X.509 certificate. This may result in an exception that terminates the application program.

Note that basic certificate chain validation (signatures, dates, ...) is not affected, the denial of service can occur only when the application also specifies an expected DNS name, Email address or IP address.

TLS servers rarely solicit client certificates, and even when they do, they generally don't perform a name check against a reference identifier (expected identity), but rather extract the presented identity after checking the certificate chain. So TLS servers are generally not affected and the severity of the issue is Moderate.

The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability report

medium severity

Information Exposure

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.

For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Information Exposure vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7
Fixed in: 1:1.0.2k-22.el7_9

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-22.el7_9 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

Buffer Overflow

Vulnerable module: python
Introduced through: python@2.7.5-89.el7
Fixed in: 0:2.7.5-92.el7_9

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-92.el7_9 or higher.

References

Buffer Overflow vulnerability report

medium severity

HTTP Request Smuggling

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

Remediation

There is no fixed version for Centos:7 python.

References

HTTP Request Smuggling vulnerability report

medium severity

Race Condition

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.

Remediation

There is no fixed version for Centos:7 python.

References

Race Condition vulnerability report

medium severity

Buffer Overflow

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7
Fixed in: 0:2.7.5-92.el7_9

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-92.el7_9 or higher.

References

Buffer Overflow vulnerability report

medium severity

HTTP Request Smuggling

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

HTTP Request Smuggling vulnerability report

medium severity

Race Condition

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.

Remediation

There is no fixed version for Centos:7 python-libs.

References

Race Condition vulnerability report

medium severity

Improper Validation of Array Index

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Improper Validation of Array Index vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: libcom_err
Introduced through: libcom_err@1.42.9-19.el7

Detailed paths

Introduced through: centos@7 › libcom_err@1.42.9-19.el7

NVD Description

An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.

Remediation

There is no fixed version for Centos:7 libcom_err.

References

Out-of-bounds Read vulnerability report

medium severity

Stack-based Buffer Overflow

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7
Fixed in: 0:2.17-322.el7_9

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.

Remediation

Upgrade Centos:7 glibc to version 0:2.17-322.el7_9 or higher.

References

Stack-based Buffer Overflow vulnerability report

medium severity

Stack-based Buffer Overflow

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7
Fixed in: 0:2.17-322.el7_9

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

Upgrade Centos:7 glibc-common to version 0:2.17-322.el7_9 or higher.

References

Stack-based Buffer Overflow vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.

Remediation

There is no fixed version for Centos:7 expat.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Improper Input Validation

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL command that triggers an API call with a crafted pointer value in the second argument.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Improper Input Validation vulnerability report

medium severity

Directory Traversal

Vulnerable module: tar
Introduced through: tar@2:1.26-35.el7

Detailed paths

Introduced through: centos@7 › tar@2:1.26-35.el7

NVD Description

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.

Remediation

There is no fixed version for Centos:7 tar.

References

Directory Traversal vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

medium severity

Use After Free

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Use After Free vulnerability report

medium severity

Use After Free

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35 in the process_symbol_table, as demonstrated in readelf, via a crafted file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Use After Free vulnerability report

medium severity

Directory Traversal

Vulnerable module: cpio
Introduced through: cpio@2.11-28.el7

Detailed paths

Introduced through: centos@7 › cpio@2.11-28.el7

NVD Description

Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames.

Remediation

There is no fixed version for Centos:7 cpio.

References

Directory Traversal vulnerability report

medium severity

Authentication Bypass by Primary Weakness

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.

Remediation

There is no fixed version for Centos:7 curl.

References

Authentication Bypass by Primary Weakness vulnerability report

medium severity

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

Remediation

There is no fixed version for Centos:7 expat.

References

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') vulnerability report

medium severity

Information Exposure

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition.

Remediation

There is no fixed version for Centos:7 glib2.

References

Information Exposure vulnerability report

medium severity

Information Exposure

Vulnerable module: libblkid
Introduced through: libblkid@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libblkid@2.23.2-65.el7

NVD Description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

Remediation

There is no fixed version for Centos:7 libblkid.

References

Information Exposure vulnerability report

medium severity

Authentication Bypass by Primary Weakness

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Authentication Bypass by Primary Weakness vulnerability report

medium severity

Information Exposure

Vulnerable module: libmount
Introduced through: libmount@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libmount@2.23.2-65.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libmount.

References

Information Exposure vulnerability report

medium severity

Information Exposure

Vulnerable module: libuuid
Introduced through: libuuid@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libuuid@2.23.2-65.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libuuid.

References

Information Exposure vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: lua
Introduced through: lua@5.1.4-15.el7

Detailed paths

Introduced through: centos@7 › lua@5.1.4-15.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream lua package and not the lua package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.

Remediation

There is no fixed version for Centos:7 lua.

References

Out-of-bounds Write vulnerability report

medium severity

Client-Side Enforcement of Server-Side Security

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Client-Side Enforcement of Server-Side Security vulnerability report

medium severity

Insecure Inherited Permissions

Vulnerable module: pam
Introduced through: pam@1.1.8-23.el7

Detailed paths

Introduced through: centos@7 › pam@1.1.8-23.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream pam package and not the pam package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

Remediation

There is no fixed version for Centos:7 pam.

References

Insecure Inherited Permissions vulnerability report

medium severity

Directory Traversal

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

Remediation

There is no fixed version for Centos:7 python.

References

Directory Traversal vulnerability report

medium severity

Directory Traversal

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Directory Traversal vulnerability report

medium severity

Improper Input Validation

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Improper Input Validation vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

Remediation

There is no fixed version for Centos:7 sqlite.

References

NULL Pointer Dereference vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Uncontrolled Recursion vulnerability report

medium severity

Deadlock

Vulnerable module: systemd
Introduced through: systemd@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd@219-78.el7

NVD Description

systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file.

Remediation

There is no fixed version for Centos:7 systemd.

References

Deadlock vulnerability report

medium severity

Information Exposure

Vulnerable module: systemd
Introduced through: systemd@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd@219-78.el7

NVD Description

A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.

Remediation

There is no fixed version for Centos:7 systemd.

References

Information Exposure vulnerability report

medium severity

Off-by-one Error

Vulnerable module: systemd
Introduced through: systemd@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd@219-78.el7

NVD Description

An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.

Remediation

There is no fixed version for Centos:7 systemd.

References

Off-by-one Error vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: systemd
Introduced through: systemd@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd@219-78.el7

NVD Description

A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.

Remediation

There is no fixed version for Centos:7 systemd.

References

Uncontrolled Recursion vulnerability report

medium severity

Deadlock

Vulnerable module: systemd-libs
Introduced through: systemd-libs@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd-libs@219-78.el7

NVD Description

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

Deadlock vulnerability report

medium severity

Information Exposure

Vulnerable module: systemd-libs
Introduced through: systemd-libs@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd-libs@219-78.el7

NVD Description

A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

Information Exposure vulnerability report

medium severity

Off-by-one Error

Vulnerable module: systemd-libs
Introduced through: systemd-libs@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd-libs@219-78.el7

NVD Description

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

Off-by-one Error vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: systemd-libs
Introduced through: systemd-libs@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd-libs@219-78.el7

NVD Description

A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

Uncontrolled Recursion vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: tar
Introduced through: tar@2:1.26-35.el7

Detailed paths

Introduced through: centos@7 › tar@2:1.26-35.el7

NVD Description

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

Remediation

There is no fixed version for Centos:7 tar.

References

Out-of-Bounds vulnerability report

medium severity

Information Exposure

Vulnerable module: util-linux
Introduced through: util-linux@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › util-linux@2.23.2-65.el7

NVD Description

Remediation

There is no fixed version for Centos:7 util-linux.

References

Information Exposure vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

vim is vulnerable to Out-of-bounds Read

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Read vulnerability report

medium severity

Arbitrary Code Injection

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7
Fixed in: 0:7.29.0-59.el7_9.1

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

Remediation

Upgrade Centos:7 curl to version 0:7.29.0-59.el7_9.1 or higher.

References

Arbitrary Code Injection vulnerability report

medium severity

Arbitrary Code Injection

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7
Fixed in: 0:7.29.0-59.el7_9.1

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

Remediation

Upgrade Centos:7 libcurl to version 0:7.29.0-59.el7_9.1 or higher.

References

Arbitrary Code Injection vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Out-of-Bounds vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Out-of-Bounds vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Out-of-Bounds vulnerability report

medium severity

Information Exposure

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.

Remediation

There is no fixed version for Centos:7 python.

References

Information Exposure vulnerability report

medium severity

Information Exposure

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Information Exposure vulnerability report

medium severity

Improper Input Validation

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.

Remediation

There is no fixed version for Centos:7 bind-license.

References

Improper Input Validation vulnerability report

medium severity

Improper Input Validation

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7
Fixed in: 32:9.11.4-26.P2.el7_9.13

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.13 or higher.

References

Improper Input Validation vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is a heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap in archive64.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in process_mips_specific in readelf.c via a malformed MIPS option section.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm.

Remediation

There is no fixed version for Centos:7 binutils.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an out-of-bounds read leading to a SEGV in bfd_getl32 in libbfd.c, when called from pex64_get_runtime_function in pei-x86_64.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

medium severity

Cleartext Transmission of Sensitive Information

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and not using thetrailing dot in the URL.

Remediation

There is no fixed version for Centos:7 curl.

References

Cleartext Transmission of Sensitive Information vulnerability report

medium severity

Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

Remediation

There is no fixed version for Centos:7 curl.

References

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability report

medium severity

Improper Input Validation

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.

Remediation

There is no fixed version for Centos:7 curl.

References

Improper Input Validation vulnerability report

medium severity

Improper Input Validation

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.

Remediation

There is no fixed version for Centos:7 curl.

References

Improper Input Validation vulnerability report

medium severity

Resource Injection

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

Remediation

There is no fixed version for Centos:7 curl.

References

Resource Injection vulnerability report

medium severity

Use After Free

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

The libcurl API function called curl_maprintf() before version 7.51.0 can be tricked into doing a double-free due to an unsafe size_t multiplication, on systems using 32 bit size_t variables.

Remediation

There is no fixed version for Centos:7 curl.

References

Use After Free vulnerability report

medium severity

Use After Free

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

The function read_data() in security.c in curl before version 7.51.0 is vulnerable to memory double free.

Remediation

There is no fixed version for Centos:7 curl.

References

Use After Free vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.

Remediation

There is no fixed version for Centos:7 glibc.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: gnupg2
Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

Introduced through: centos@7 › gnupg2@2.0.22-5.el7_5

NVD Description

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Remediation

There is no fixed version for Centos:7 gnupg2.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

medium severity

Cleartext Transmission of Sensitive Information

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Cleartext Transmission of Sensitive Information vulnerability report

medium severity

Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability report

medium severity

Improper Input Validation

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Improper Input Validation vulnerability report

medium severity

Improper Input Validation

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Improper Input Validation vulnerability report

medium severity

Resource Injection

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Resource Injection vulnerability report

medium severity

Use After Free

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

The function read_data() in security.c in curl before version 7.51.0 is vulnerable to memory double free.

Remediation

There is no fixed version for Centos:7 libcurl.

References

Use After Free vulnerability report

medium severity

Use After Free

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

The libcurl API function called curl_maprintf() before version 7.51.0 can be tricked into doing a double-free due to an unsafe size_t multiplication, on systems using 32 bit size_t variables.

Remediation

There is no fixed version for Centos:7 libcurl.

References

Use After Free vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libgcc.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Use After Free

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5
Fixed in: 0:2.9.1-6.el7_9.6

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.

Remediation

Upgrade Centos:7 libxml2 to version 0:2.9.1-6.el7_9.6 or higher.

References

Use After Free vulnerability report

medium severity

Use After Free

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5
Fixed in: 0:2.9.1-6.el7_9.6

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

Upgrade Centos:7 libxml2-python to version 0:2.9.1-6.el7_9.6 or higher.

References

Use After Free vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: lua
Introduced through: lua@5.1.4-15.el7

Detailed paths

Introduced through: centos@7 › lua@5.1.4-15.el7

NVD Description

Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.

Remediation

There is no fixed version for Centos:7 lua.

References

Out-of-Bounds vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Out-of-Bounds vulnerability report

medium severity

Stack-based Buffer Overflow

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Stack-based Buffer Overflow vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Out-of-Bounds vulnerability report

medium severity

Stack-based Buffer Overflow

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Stack-based Buffer Overflow vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Out-of-Bounds vulnerability report

medium severity

Stack-based Buffer Overflow

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Stack-based Buffer Overflow vulnerability report

medium severity

Improperly Implemented Security Check for Standard

Vulnerable module: nss-softokn
Introduced through: nss-softokn@3.53.1-6.el7_9

Detailed paths

Introduced through: centos@7 › nss-softokn@3.53.1-6.el7_9

NVD Description

Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.

Remediation

There is no fixed version for Centos:7 nss-softokn.

References

Improperly Implemented Security Check for Standard vulnerability report

medium severity

Improperly Implemented Security Check for Standard

Vulnerable module: nss-softokn-freebl
Introduced through: nss-softokn-freebl@3.53.1-6.el7_9

Detailed paths

Introduced through: centos@7 › nss-softokn-freebl@3.53.1-6.el7_9

NVD Description

Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.

Remediation

There is no fixed version for Centos:7 nss-softokn-freebl.

References

Improperly Implemented Security Check for Standard vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: p11-kit
Introduced through: p11-kit@0.23.5-3.el7

Detailed paths

Introduced through: centos@7 › p11-kit@0.23.5-3.el7

NVD Description

An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation.

Remediation

There is no fixed version for Centos:7 p11-kit.

References

Out-of-bounds Read vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: p11-kit-trust
Introduced through: p11-kit-trust@0.23.5-3.el7

Detailed paths

Introduced through: centos@7 › p11-kit-trust@0.23.5-3.el7

NVD Description

Remediation

There is no fixed version for Centos:7 p11-kit-trust.

References

Out-of-bounds Read vulnerability report

medium severity

Arbitrary Code Injection

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

Remediation

There is no fixed version for Centos:7 python.

References

Arbitrary Code Injection vulnerability report

medium severity

Cryptographic Issues

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.

Remediation

There is no fixed version for Centos:7 python.

References

Cryptographic Issues vulnerability report

medium severity

Improper Input Validation

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

Remediation

There is no fixed version for Centos:7 python.

References

Improper Input Validation vulnerability report

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected.

When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.

Remediation

There is no fixed version for Centos:7 python.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

medium severity

Unchecked Return Value

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

Remediation

There is no fixed version for Centos:7 python.

References

Unchecked Return Value vulnerability report

medium severity

Arbitrary Code Injection

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Arbitrary Code Injection vulnerability report

medium severity

Cryptographic Issues

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Cryptographic Issues vulnerability report

medium severity

Improper Input Validation

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Improper Input Validation vulnerability report

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected.

Remediation

There is no fixed version for Centos:7 python-libs.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

medium severity

Unchecked Return Value

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Unchecked Return Value vulnerability report

medium severity

Unchecked Error Condition

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Unchecked Error Condition vulnerability report

medium severity

OS Command Injection

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

OS Command Injection vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: zlib
Introduced through: zlib@1.2.7-18.el7

Detailed paths

Introduced through: centos@7 › zlib@1.2.7-18.el7

NVD Description

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

Remediation

There is no fixed version for Centos:7 zlib.

References

Integer Overflow or Wraparound vulnerability report

medium severity

CVE-2014-3477

Vulnerable module: dbus
Introduced through: dbus@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus@1:1.10.24-15.el7

NVD Description

The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.

Remediation

There is no fixed version for Centos:7 dbus.

References

CVE-2014-3477 vulnerability report

medium severity

CVE-2014-3477

Vulnerable module: dbus-libs
Introduced through: dbus-libs@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus-libs@1:1.10.24-15.el7

NVD Description

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

CVE-2014-3477 vulnerability report

medium severity

Insufficiently Protected Credentials

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

Remediation

There is no fixed version for Centos:7 curl.

References

Insufficiently Protected Credentials vulnerability report

medium severity

Insufficiently Protected Credentials

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Insufficiently Protected Credentials vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: libssh2
Introduced through: libssh2@1.8.0-4.el7

Detailed paths

Introduced through: centos@7 › libssh2@1.8.0-4.el7

NVD Description

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Remediation

There is no fixed version for Centos:7 libssh2.

References

Out-of-bounds Read vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: libssh2
Introduced through: libssh2@1.8.0-4.el7

Detailed paths

Introduced through: centos@7 › libssh2@1.8.0-4.el7

NVD Description

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Remediation

There is no fixed version for Centos:7 libssh2.

References

Out-of-bounds Read vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7
Fixed in: 0:2.17-322.el7_9

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.

Remediation

Upgrade Centos:7 glibc to version 0:2.17-322.el7_9 or higher.

References

Out-of-Bounds vulnerability report

medium severity

Stack-based Buffer Overflow

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name.

Remediation

There is no fixed version for Centos:7 glibc.

References

Stack-based Buffer Overflow vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7
Fixed in: 0:2.17-322.el7_9

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.

Remediation

Upgrade Centos:7 glibc-common to version 0:2.17-322.el7_9 or higher.

References

Out-of-Bounds vulnerability report

medium severity

Stack-based Buffer Overflow

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Stack-based Buffer Overflow vulnerability report

medium severity

Improper Authentication

Vulnerable module: libssh2
Introduced through: libssh2@1.8.0-4.el7

Detailed paths

Introduced through: centos@7 › libssh2@1.8.0-4.el7

NVD Description

A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in thepki_verify_data_signature function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value rc, which is initialized to SSH_ERROR and later rewritten to save the return value of the function call pki_key_check_hash_compatible. The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls goto error returning SSH_OK.

Remediation

There is no fixed version for Centos:7 libssh2.

References

Improper Authentication vulnerability report

medium severity

Improper Verification of Cryptographic Signature

Vulnerable module: rpm
Introduced through: rpm@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm@4.11.3-45.el7

NVD Description

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.

Remediation

There is no fixed version for Centos:7 rpm.

References

Improper Verification of Cryptographic Signature vulnerability report

medium severity

Improper Verification of Cryptographic Signature

Vulnerable module: rpm-build-libs
Introduced through: rpm-build-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-build-libs@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

Improper Verification of Cryptographic Signature vulnerability report

medium severity

Improper Verification of Cryptographic Signature

Vulnerable module: rpm-libs
Introduced through: rpm-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-libs@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

Improper Verification of Cryptographic Signature vulnerability report

medium severity

Improper Verification of Cryptographic Signature

Vulnerable module: rpm-python
Introduced through: rpm-python@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-python@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-python.

References

Improper Verification of Cryptographic Signature vulnerability report

medium severity

CVE-2017-10140

Vulnerable module: libdb
Introduced through: libdb@5.3.21-25.el7

Detailed paths

Introduced through: centos@7 › libdb@5.3.21-25.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libdb package and not the libdb package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.

Remediation

There is no fixed version for Centos:7 libdb.

References

CVE-2017-10140 vulnerability report

medium severity

CVE-2017-10140

Vulnerable module: libdb-utils
Introduced through: libdb-utils@5.3.21-25.el7

Detailed paths

Introduced through: centos@7 › libdb-utils@5.3.21-25.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libdb-utils package and not the libdb-utils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

There is no fixed version for Centos:7 libdb-utils.

References

CVE-2017-10140 vulnerability report

medium severity

Incorrect Authorization

Vulnerable module: systemd
Introduced through: systemd@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd@219-78.el7

NVD Description

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".

Remediation

There is no fixed version for Centos:7 systemd.

References

Incorrect Authorization vulnerability report

medium severity

Incorrect Authorization

Vulnerable module: systemd-libs
Introduced through: systemd-libs@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd-libs@219-78.el7

NVD Description

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

Incorrect Authorization vulnerability report

medium severity

Improper Verification of Cryptographic Signature

Vulnerable module: rpm
Introduced through: rpm@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm@4.11.3-45.el7

NVD Description

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

Remediation

There is no fixed version for Centos:7 rpm.

References

Improper Verification of Cryptographic Signature vulnerability report

medium severity

Improper Verification of Cryptographic Signature

Vulnerable module: rpm-build-libs
Introduced through: rpm-build-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-build-libs@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

Improper Verification of Cryptographic Signature vulnerability report

medium severity

Improper Verification of Cryptographic Signature

Vulnerable module: rpm-libs
Introduced through: rpm-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-libs@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

Improper Verification of Cryptographic Signature vulnerability report

medium severity

Improper Verification of Cryptographic Signature

Vulnerable module: rpm-python
Introduced through: rpm-python@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-python@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-python.

References

Improper Verification of Cryptographic Signature vulnerability report

medium severity

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: systemd
Introduced through: systemd@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd@219-78.el7

NVD Description

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.

Remediation

There is no fixed version for Centos:7 systemd.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

medium severity

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: systemd-libs
Introduced through: systemd-libs@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd-libs@219-78.el7

NVD Description

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

medium severity

Improper Neutralization of Special Elements

Vulnerable module: audit-libs
Introduced through: audit-libs@2.8.5-4.el7

Detailed paths

Introduced through: centos@7 › audit-libs@2.8.5-4.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream audit-libs package and not the audit-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.

Remediation

There is no fixed version for Centos:7 audit-libs.

References

Improper Neutralization of Special Elements vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7
Fixed in: 32:9.11.4-26.P2.el7_9.2

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.2 or higher.

References

Resource Exhaustion vulnerability report

medium severity

Information Exposure

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.

Remediation

There is no fixed version for Centos:7 curl.

References

Information Exposure vulnerability report

medium severity

Information Exposure

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.

Remediation

There is no fixed version for Centos:7 curl.

References

Information Exposure vulnerability report

medium severity

Insufficiently Protected Credentials

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.

Remediation

There is no fixed version for Centos:7 curl.

References

Insufficiently Protected Credentials vulnerability report

medium severity

CVE-2013-0341

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Remediation

There is no fixed version for Centos:7 expat.

References

https://access.redhat.com/security/cve/CVE-2013-0341

CVE-2013-0341 vulnerability report

medium severity

Insufficient Entropy

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.

Remediation

There is no fixed version for Centos:7 expat.

References

Insufficient Entropy vulnerability report

medium severity

Use of Insufficiently Random Values

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.

Remediation

There is no fixed version for Centos:7 expat.

References

Use of Insufficiently Random Values vulnerability report

medium severity

XML External Entity (XXE) Injection

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

Remediation

There is no fixed version for Centos:7 expat.

References

XML External Entity (XXE) Injection vulnerability report

medium severity

Algorithmic Complexity

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Remediation

There is no fixed version for Centos:7 glib2.

References

Algorithmic Complexity vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.

Remediation

There is no fixed version for Centos:7 glib2.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Remediation

There is no fixed version for Centos:7 glib2.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Remediation

There is no fixed version for Centos:7 glib2.

References

Uncontrolled Recursion vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Remediation

There is no fixed version for Centos:7 glib2.

References

Uncontrolled Recursion vulnerability report

medium severity

Uncontrolled Recursion

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\.|([^\\W_])?)+)+$/.

Remediation

There is no fixed version for Centos:7 glib2.

References

Uncontrolled Recursion vulnerability report

medium severity

Access of Resource Using Incompatible Type ('Type Confusion')

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.15.1-50.el7

Detailed paths

Introduced through: centos@7 › krb5-libs@1.15.1-50.el7

NVD Description

lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability report

medium severity

Access of Resource Using Incompatible Type ('Type Confusion')

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.15.1-50.el7

Detailed paths

Introduced through: centos@7 › krb5-libs@1.15.1-50.el7

NVD Description

lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.15.1-50.el7

Detailed paths

Introduced through: centos@7 › krb5-libs@1.15.1-50.el7

NVD Description

The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

Out-of-bounds Read vulnerability report

medium severity

Information Exposure

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Information Exposure vulnerability report

medium severity

Information Exposure

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Information Exposure vulnerability report

medium severity

Insufficiently Protected Credentials

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.

Remediation

There is no fixed version for Centos:7 libcurl.

References

Insufficiently Protected Credentials vulnerability report

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: libtasn1
Introduced through: libtasn1@4.10-1.el7

Detailed paths

Introduced through: centos@7 › libtasn1@4.10-1.el7

NVD Description

The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service (infinite recursion) via a crafted certificate.

Remediation

There is no fixed version for Centos:7 libtasn1.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Information Exposure

Vulnerable module: nss
Introduced through: nss@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss@3.53.1-3.el7_9

NVD Description

Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121.

Remediation

There is no fixed version for Centos:7 nss.

References

Information Exposure vulnerability report

medium severity

Use of a Broken or Risky Cryptographic Algorithm

Vulnerable module: nss
Introduced through: nss@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss@3.53.1-3.el7_9

NVD Description

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

Remediation

There is no fixed version for Centos:7 nss.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

medium severity

Information Exposure

Vulnerable module: nss-sysinit
Introduced through: nss-sysinit@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-sysinit@3.53.1-3.el7_9

NVD Description

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

Information Exposure vulnerability report

medium severity

Use of a Broken or Risky Cryptographic Algorithm

Vulnerable module: nss-sysinit
Introduced through: nss-sysinit@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-sysinit@3.53.1-3.el7_9

NVD Description

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

medium severity

Information Exposure

Vulnerable module: nss-tools
Introduced through: nss-tools@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-tools@3.53.1-3.el7_9

NVD Description

Remediation

There is no fixed version for Centos:7 nss-tools.

References

Information Exposure vulnerability report

medium severity

Use of a Broken or Risky Cryptographic Algorithm

Vulnerable module: nss-tools
Introduced through: nss-tools@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-tools@3.53.1-3.el7_9

NVD Description

Remediation

There is no fixed version for Centos:7 nss-tools.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

medium severity

Use of a Broken or Risky Cryptographic Algorithm

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

Remediation

There is no fixed version for Centos:7 python.

References

Out-of-Bounds vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Out-of-Bounds vulnerability report

medium severity

Link Following

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

Remediation

There is no fixed version for Centos:7 binutils.

References

Link Following vulnerability report

medium severity

Race Condition

Vulnerable module: coreutils
Introduced through: coreutils@8.22-24.el7

Detailed paths

Introduced through: centos@7 › coreutils@8.22-24.el7

NVD Description

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

Remediation

There is no fixed version for Centos:7 coreutils.

References

Race Condition vulnerability report

medium severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), the search pattern is displayed at the bottom of the screen in a buffer (msgbuf). When right-left mode (:set rl) is enabled, the search pattern is reversed. This happens by allocating a new buffer. If the search pattern contains some ASCII NUL characters, the buffer allocated will be smaller than the original allocated buffer (because for allocating the reversed buffer, the strlen() function is called, which only counts until it notices an ASCII NUL byte ) and thus the original length indicator is wrong. This causes an overflow when accessing characters inside the msgbuf by the previously (now wrong) length of the msgbuf. The issue has been fixed as of Vim patch v9.1.0689.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Improper Input Validation

Vulnerable module: dbus
Introduced through: dbus@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus@1:1.10.24-15.el7

NVD Description

dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.

Remediation

There is no fixed version for Centos:7 dbus.

References

Improper Input Validation vulnerability report

medium severity

Improper Input Validation

Vulnerable module: dbus
Introduced through: dbus@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus@1:1.10.24-15.el7

NVD Description

dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message containing an invalid file descriptor.

Remediation

There is no fixed version for Centos:7 dbus.

References

Improper Input Validation vulnerability report

medium severity

Improper Input Validation

Vulnerable module: dbus-libs
Introduced through: dbus-libs@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus-libs@1:1.10.24-15.el7

NVD Description

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

Improper Input Validation vulnerability report

medium severity

Improper Input Validation

Vulnerable module: dbus-libs
Introduced through: dbus-libs@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus-libs@1:1.10.24-15.el7

NVD Description

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

Improper Input Validation vulnerability report

medium severity

Improper Verification of Source of a Communication Channel

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact.

Remediation

There is no fixed version for Centos:7 glib2.

References

Improper Verification of Source of a Communication Channel vulnerability report

medium severity

Improper Certificate Validation

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths case insensitively,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

Remediation

There is no fixed version for Centos:7 curl.

References

Improper Certificate Validation vulnerability report

medium severity

Information Exposure

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

Remediation

There is no fixed version for Centos:7 curl.

References

Information Exposure vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the PWD command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit 415d2e7cb7, March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.

Remediation

There is no fixed version for Centos:7 curl.

References

Out-of-bounds Read vulnerability report

medium severity

Improper Certificate Validation

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Improper Certificate Validation vulnerability report

medium severity

Information Exposure

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Information Exposure vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Out-of-bounds Read vulnerability report

medium severity

Covert Timing Channel

Vulnerable module: nss
Introduced through: nss@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss@3.53.1-3.el7_9

NVD Description

An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

Remediation

There is no fixed version for Centos:7 nss.

References

Covert Timing Channel vulnerability report

medium severity

Covert Timing Channel

Vulnerable module: nss-sysinit
Introduced through: nss-sysinit@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-sysinit@3.53.1-3.el7_9

NVD Description

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

Covert Timing Channel vulnerability report

medium severity

Covert Timing Channel

Vulnerable module: nss-tools
Introduced through: nss-tools@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-tools@3.53.1-3.el7_9

NVD Description

Remediation

There is no fixed version for Centos:7 nss-tools.

References

Covert Timing Channel vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via CURLOPT_USERNAME.

Remediation

There is no fixed version for Centos:7 curl.

References

Out-of-bounds Write vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via CURLOPT_USERNAME.

Remediation

There is no fixed version for Centos:7 libcurl.

References

Out-of-bounds Write vulnerability report

medium severity

Information Exposure

Vulnerable module: libgcrypt
Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

Introduced through: centos@7 › libgcrypt@1.5.3-14.el7

NVD Description

Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

Information Exposure vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: libsepol
Introduced through: libsepol@2.5-10.el7

Detailed paths

Introduced through: centos@7 › libsepol@2.5-10.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libsepol package and not the libsepol package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

Remediation

There is no fixed version for Centos:7 libsepol.

References

Out-of-Bounds vulnerability report

medium severity

Use After Free

Vulnerable module: libsepol
Introduced through: libsepol@2.5-10.el7

Detailed paths

Introduced through: centos@7 › libsepol@2.5-10.el7

NVD Description

The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).

Remediation

There is no fixed version for Centos:7 libsepol.

References

Use After Free vulnerability report

medium severity

Use After Free

Vulnerable module: libsepol
Introduced through: libsepol@2.5-10.el7

Detailed paths

Introduced through: centos@7 › libsepol@2.5-10.el7

NVD Description

The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).

Remediation

There is no fixed version for Centos:7 libsepol.

References

Use After Free vulnerability report

medium severity

Use After Free

Vulnerable module: libsepol
Introduced through: libsepol@2.5-10.el7

Detailed paths

Introduced through: centos@7 › libsepol@2.5-10.el7

NVD Description

The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).

Remediation

There is no fixed version for Centos:7 libsepol.

References

Use After Free vulnerability report

medium severity

Information Exposure

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Remediation

There is no fixed version for Centos:7 curl.

References

Information Exposure vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.

Remediation

There is no fixed version for Centos:7 curl.

References

Out-of-bounds Read vulnerability report

medium severity

Information Exposure

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.15.1-50.el7

Detailed paths

Introduced through: centos@7 › krb5-libs@1.15.1-50.el7

NVD Description

The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

Information Exposure vulnerability report

medium severity

Information Exposure

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Information Exposure vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Out-of-bounds Read vulnerability report

medium severity

Use of Externally-Controlled Format String

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Use of Externally-Controlled Format String vulnerability report

medium severity

Use of Externally-Controlled Format String

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Use of Externally-Controlled Format String vulnerability report

medium severity

Use of Externally-Controlled Format String

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Use of Externally-Controlled Format String vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.1.0-12.el7

Detailed paths

Introduced through: centos@7 › expat@2.1.0-12.el7

NVD Description

An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.

Remediation

There is no fixed version for Centos:7 expat.

References

Integer Overflow or Wraparound vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Write vulnerability report

low severity

Insufficient Verification of Data Authenticity

Vulnerable module: ca-certificates
Introduced through: ca-certificates@2020.2.41-70.0.el7_8

Detailed paths

Introduced through: centos@7 › ca-certificates@2020.2.41-70.0.el7_8

NVD Description

Note: Versions mentioned in the description apply only to the upstream ca-certificates package and not the ca-certificates package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.

Remediation

There is no fixed version for Centos:7 ca-certificates.

References

Insufficient Verification of Data Authenticity vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Stack-based Buffer Overflow vulnerability report

low severity

Privilege Dropping / Lowering Errors

Vulnerable module: bash
Introduced through: bash@4.2.46-34.el7

Detailed paths

Introduced through: centos@7 › bash@4.2.46-34.el7

NVD Description

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

Remediation

There is no fixed version for Centos:7 bash.

References

Privilege Dropping / Lowering Errors vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: libtasn1
Introduced through: libtasn1@4.10-1.el7

Detailed paths

Introduced through: centos@7 › libtasn1@4.10-1.el7

NVD Description

Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.

Remediation

There is no fixed version for Centos:7 libtasn1.

References

Stack-based Buffer Overflow vulnerability report

low severity

Buffer Over-read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Buffer Over-read in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Buffer Over-read vulnerability report

low severity

Buffer Over-read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Buffer Over-read in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Buffer Over-read vulnerability report

low severity

Divide By Zero

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Divide By Zero vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Integer Overflow or Wraparound vulnerability report

low severity

Out-of-Bounds

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-Bounds vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Write vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Write vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Write vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Stack-based Buffer Overflow vulnerability report

low severity

Unchecked Return Value

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Unchecked Return Value vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Use After Free in GitHub repository vim/vim prior to 9.0.0046.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Use After Free in GitHub repository vim/vim prior to 9.0.0213.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Use After Free in GitHub repository vim/vim prior to 9.0.0225.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Use After Free in GitHub repository vim/vim prior to 9.0.0246.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Use After Free in GitHub repository vim/vim prior to 9.0.0221.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Use After Free in GitHub repository vim/vim prior to 9.0.0322.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Use After Free in GitHub repository vim/vim prior to 9.0.0490.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Use After Free in GitHub repository vim/vim prior to 9.0.0614.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Use After Free in GitHub repository vim/vim prior to 9.0.0530.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Use After Free in GitHub repository vim/vim prior to 9.0.0882.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Use After Free in GitHub repository vim/vim prior to 9.0.0789.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

libcurl provides the CURLOPT_CERTINFO option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

Remediation

There is no fixed version for Centos:7 curl.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf8_str().

Remediation

There is no fixed version for Centos:7 glib2.

References

Out-of-bounds Read vulnerability report

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

low severity

Out-of-Bounds

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libgcc.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Out-of-Bounds vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5 incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() functions (as well as other similarly named encryption and decryption initialisation functions). Instead of using the custom cipher directly it incorrectly tries to fetch an equivalent cipher from the available providers. An equivalent cipher is found based on the NID passed to EVP_CIPHER_meth_new(). This NID is supposed to represent the unique NID for a given cipher. However it is possible for an application to incorrectly pass NID_undef as this value in the call to EVP_CIPHER_meth_new(). When NID_undef is used in this way the OpenSSL encryption/decryption initialisation function will match the NULL cipher as being equivalent and will fetch this from the available providers. This will succeed if the default provider has been loaded (or if a third party provider has been loaded that offers this cipher). Using the NULL cipher means that the plaintext is emitted as the ciphertext. Applications are only affected by this issue if they call EVP_CIPHER_meth_new() using NID_undef and subsequently use it in a call to an encryption/decryption initialisation function. Applications that only use SSL/TLS are not impacted by this issue. Fixed in OpenSSL 3.0.6 (Affected 3.0.0-3.0.5).

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

NULL Pointer Dereference vulnerability report

low severity

Improper Handling of Highly Compressed Data (Data Amplification)

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.

Remediation

There is no fixed version for Centos:7 python.

References

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability report

low severity

Improper Handling of Highly Compressed Data (Data Amplification)

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.

Remediation

There is no fixed version for Centos:7 python-libs.

References

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability report

low severity

Improper Input Validation

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Improper Input Validation vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing.

Remediation

There is no fixed version for Centos:7 sqlite.

References

NULL Pointer Dereference vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: libcom_err
Introduced through: libcom_err@1.42.9-19.el7

Detailed paths

Introduced through: centos@7 › libcom_err@1.42.9-19.el7

NVD Description

Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247.

Remediation

There is no fixed version for Centos:7 libcom_err.

References

Heap-based Buffer Overflow vulnerability report

low severity

Divide By Zero

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Divide By Zero vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Out-of-Bounds

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

vim is vulnerable to Heap-based Buffer Overflow

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-Bounds vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Read vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.

Remediation

There is no fixed version for Centos:7 openldap.

References

NULL Pointer Dereference vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

vim is vulnerable to Out-of-bounds Read

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Read vulnerability report

low severity

Use After Free

Vulnerable module: dbus
Introduced through: dbus@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus@1:1.10.24-15.el7

NVD Description

A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors

Remediation

There is no fixed version for Centos:7 dbus.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: dbus-libs
Introduced through: dbus-libs@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus-libs@1:1.10.24-15.el7

NVD Description

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. The name of the patch is d0fab10ed2a86698937e3c3fed2f10bd9bb5e731. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-212324.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Out-of-Bounds

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-Bounds vulnerability report

low severity

Improper Input Validation

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message.

Remediation

There is no fixed version for Centos:7 bind-license.

References

Improper Input Validation vulnerability report

low severity

Resource Exhaustion

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.

Remediation

There is no fixed version for Centos:7 glib2.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

Remediation

There is no fixed version for Centos:7 glib2.

References

Resource Exhaustion vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Heap-based Buffer Overflow vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Out-of-bounds Read vulnerability report

low severity

Resource Exhaustion

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().

Remediation

There is no fixed version for Centos:7 ncurses.

References

Resource Exhaustion vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Stack-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Heap-based Buffer Overflow vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Out-of-bounds Read vulnerability report

low severity

Resource Exhaustion

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Resource Exhaustion vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Stack-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Heap-based Buffer Overflow vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Out-of-bounds Read vulnerability report

low severity

Resource Exhaustion

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Resource Exhaustion vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Stack-based Buffer Overflow vulnerability report

low severity

Reversible One-Way Hash

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions.

Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences.

The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the contents of vector registers in a different order than they are saved. Thus the contents of some of these vector registers are corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions.

The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service.

The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3. If this cipher is enabled on the server a malicious client can influence whether this AEAD cipher is used. This implies that TLS server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Reversible One-Way Hash vulnerability report

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 python.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Resource Exhaustion

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.

Remediation

There is no fixed version for Centos:7 glib2.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.

Remediation

There is no fixed version for Centos:7 glib2.

References

Resource Exhaustion vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: gnupg2
Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

Introduced through: centos@7 › gnupg2@2.0.22-5.el7_5

NVD Description

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

Remediation

There is no fixed version for Centos:7 gnupg2.

References

Out-of-bounds Write vulnerability report

low severity

Use of Uninitialized Resource

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.

Remediation

There is no fixed version for Centos:7 binutils.

References

Use of Uninitialized Resource vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: gawk
Introduced through: gawk@4.0.2-4.el7_3.1

Detailed paths

Introduced through: centos@7 › gawk@4.0.2-4.el7_3.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream gawk package and not the gawk package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.

Remediation

There is no fixed version for Centos:7 gawk.

References

Out-of-bounds Read vulnerability report

low severity

Buffer Over-read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Buffer Over-read vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

NULL Pointer Dereference vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to the "demangling of virtual tables."

Remediation

There is no fixed version for Centos:7 binutils.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

Integer overflow in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to inconsistent use of the long and int types for lengths.

Remediation

There is no fixed version for Centos:7 binutils.

References

Integer Overflow or Wraparound vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.

Remediation

There is no fixed version for Centos:7 curl.

References

Heap-based Buffer Overflow vulnerability report

low severity

Use After Free

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7
Fixed in: 0:7.29.0-59.el7_9.2

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

A use after free vulnerability exists in curl <7.87.0. Curl can be asked to tunnel virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.

Remediation

Upgrade Centos:7 curl to version 0:7.29.0-59.el7_9.2 or higher.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Remediation

There is no fixed version for Centos:7 glibc.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Use After Free vulnerability report

low severity

Memory Leak

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.15.1-50.el7

Detailed paths

Introduced through: centos@7 › krb5-libs@1.15.1-50.el7

NVD Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

Memory Leak vulnerability report

low severity

Memory Leak

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.15.1-50.el7

Detailed paths

Introduced through: centos@7 › krb5-libs@1.15.1-50.el7

NVD Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

Memory Leak vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Heap-based Buffer Overflow vulnerability report

low severity

Use After Free

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7
Fixed in: 0:7.29.0-59.el7_9.2

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

Upgrade Centos:7 libcurl to version 0:7.29.0-59.el7_9.2 or higher.

References

Use After Free vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libgcc.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libgcc.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Integer Overflow or Wraparound vulnerability report

low severity

Use After Free

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

Remediation

There is no fixed version for Centos:7 libxml2.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Use After Free vulnerability report

low severity

Covert Timing Channel

Vulnerable module: nss
Introduced through: nss@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss@3.53.1-3.el7_9

NVD Description

The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites.

Remediation

There is no fixed version for Centos:7 nss.

References

Covert Timing Channel vulnerability report

low severity

Covert Timing Channel

Vulnerable module: nss-sysinit
Introduced through: nss-sysinit@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-sysinit@3.53.1-3.el7_9

NVD Description

The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites.

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

Covert Timing Channel vulnerability report

low severity

Covert Timing Channel

Vulnerable module: nss-tools
Introduced through: nss-tools@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-tools@3.53.1-3.el7_9

NVD Description

The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites.

Remediation

There is no fixed version for Centos:7 nss-tools.

References

Covert Timing Channel vulnerability report

low severity

Covert Timing Channel

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Covert Timing Channel vulnerability report

low severity

Information Exposure

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer.

Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application.

The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was never standardised and is deprecated in favour of ALPN. We believe that ALPN is significantly more widely deployed than NPN. The SSL_select_next_proto function accepts a list of protocols from the server and a list of protocols from the client and returns the first protocol that appears in the server list that also appears in the client list. In the case of no overlap between the two lists it returns the first item in the client list. In either case it will signal whether an overlap between the two lists was found. In the case where SSL_select_next_proto is called with a zero length client list it fails to notice this condition and returns the memory immediately following the client list pointer (and reports that there was no overlap in the lists).

This function is typically called from a server side application callback for ALPN or a client side application callback for NPN. In the case of ALPN the list of protocols supplied by the client is guaranteed by libssl to never be zero in length. The list of server protocols comes from the application and should never normally be expected to be of zero length. In this case if the SSL_select_next_proto function has been called as expected (with the list supplied by the client passed in the client/client_len parameters), then the application will not be vulnerable to this issue. If the application has accidentally been configured with a zero length server list, and has accidentally passed that zero length server list in the client/client_len parameters, and has additionally failed to correctly handle a "no overlap" response (which would normally result in a handshake failure in ALPN) then it will be vulnerable to this problem.

In the case of NPN, the protocol permits the client to opportunistically select a protocol when there is no overlap. OpenSSL returns the first client protocol in the no overlap case in support of this. The list of client protocols comes from the application and should never normally be expected to be of zero length. However if the SSL_select_next_proto function is accidentally called with a client_len of 0 then an invalid memory pointer will be returned instead. If the application uses this output as the opportunistic protocol then the loss of confidentiality will occur.

This issue has been assessed as Low severity because applications are most likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not widely used. It also requires an application configuration or programming error. Finally, this issue would not typically be under attacker control making active exploitation unlikely.

The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

Due to the low severity of this issue we are not issuing new releases of OpenSSL at this time. The fix will be included in the next releases when they become available.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Information Exposure vulnerability report

low severity

Resource Exhaustion

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

A security vulnerability has been identified in all supported versions

of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems.

Policy processing is disabled by default but can be enabled by passing the -policy' argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Resource Exhaustion vulnerability report

low severity

Buffer Overflow

Vulnerable module: file-libs
Introduced through: file-libs@5.11-37.el7

Detailed paths

Introduced through: centos@7 › file-libs@5.11-37.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream file-libs package and not the file-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.

Remediation

There is no fixed version for Centos:7 file-libs.

References

Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: gpgme
Introduced through: gpgme@1.3.2-5.el7

Detailed paths

Introduced through: centos@7 › gpgme@1.3.2-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream gpgme package and not the gpgme package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Multiple heap-based buffer overflows in the status_handler function in (1) engine-gpgsm.c and (2) engine-uiserver.c in GPGME before 1.5.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to "different line lengths in a specific order."

Remediation

There is no fixed version for Centos:7 gpgme.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Improper Input Validation

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, has an unchecked strnlen operation. Remote attackers could leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Improper Input Validation vulnerability report

low severity

Improper Input Validation

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34.

Remediation

There is no fixed version for Centos:7 binutils.

References

Improper Input Validation vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can cause a denial of service via a crafted file.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new, that can cause a denial of service via a crafted file.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Remediation

There is no fixed version for Centos:7 binutils.

References

https://access.redhat.com/security/cve/CVE-2020-16598

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability. This flaw affects binutils versions prior to 2.34.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to an invalid read in process_symbol_table, as demonstrated in readeif.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Uncontrolled Recursion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Uncontrolled Recursion vulnerability report

low severity

Information Exposure

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.

Remediation

There is no fixed version for Centos:7 curl.

References

Information Exposure vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: file-libs
Introduced through: file-libs@5.11-37.el7

Detailed paths

Introduced through: centos@7 › file-libs@5.11-37.el7

NVD Description

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.

Remediation

There is no fixed version for Centos:7 file-libs.

References

Out-of-bounds Read vulnerability report

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.

Remediation

There is no fixed version for Centos:7 glibc.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

low severity

Information Exposure

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Information Exposure vulnerability report

low severity

Resource Exhaustion

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

Remediation

There is no fixed version for Centos:7 libgcc.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Resource Exhaustion vulnerability report

low severity

Buffer Over-read

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Buffer Over-read vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser.

Remediation

There is no fixed version for Centos:7 libxml2.

References

NULL Pointer Dereference vulnerability report

low severity

Buffer Over-read

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Buffer Over-read vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

NULL Pointer Dereference vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Out-of-Bounds vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack

Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly.

A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue.

OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass().

We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant.

The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

NULL Pointer Dereference vulnerability report

low severity

Out-of-Bounds

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Out-of-Bounds vulnerability report

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: tar
Introduced through: tar@2:1.26-35.el7

Detailed paths

Introduced through: centos@7 › tar@2:1.26-35.el7

NVD Description

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).

Remediation

There is no fixed version for Centos:7 tar.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

low severity

Incorrect Privilege Assignment

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Incorrect Privilege Assignment vulnerability report

low severity

Incorrect Privilege Assignment

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Incorrect Privilege Assignment vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Integer Overflow or Wraparound vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

vim 8.2.2348 is affected by null pointer dereference, allows local attackers to cause a denial of service (DoS) via the ex_buffer_all method.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

NULL Pointer Dereference vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

vim is vulnerable to Heap-based Buffer Overflow

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Read vulnerability report

low severity

Undefined Behavior for Input to API

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Undefined Behavior for Input to API vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted binary.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Use After Free

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "btypevec."

Remediation

There is no fixed version for Centos:7 binutils.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "ktypevec."

Remediation

There is no fixed version for Centos:7 binutils.

References

Use After Free vulnerability report

low severity

Link Following

Vulnerable module: cpio
Introduced through: cpio@2.11-28.el7

Detailed paths

Introduced through: centos@7 › cpio@2.11-28.el7

NVD Description

A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories through symlinks.

Remediation

There is no fixed version for Centos:7 cpio.

References

Link Following vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

The curl_getdate function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short.

Remediation

There is no fixed version for Centos:7 curl.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

libcurl's ASN1 parser code has the GTime2str() function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the time fraction, leading to a strlen() getting performed on a pointer to a heap buffer area that is not (purposely) null terminated.

This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when CURLINFO_CERTINFO is used.

Remediation

There is no fixed version for Centos:7 curl.

References

Out-of-bounds Read vulnerability report

low severity

Link Following

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)

Remediation

There is no fixed version for Centos:7 glib2.

References

Link Following vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

The curl_getdate function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short.

Remediation

There is no fixed version for Centos:7 libcurl.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when CURLINFO_CERTINFO is used.

Remediation

There is no fixed version for Centos:7 libcurl.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libgcc.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary.

Remediation

There is no fixed version for Centos:7 libgcc.

References

Out-of-bounds Read vulnerability report

low severity

Use After Free

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "ktypevec."

Remediation

There is no fixed version for Centos:7 libgcc.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "btypevec."

Remediation

There is no fixed version for Centos:7 libgcc.

References

Use After Free vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Out-of-bounds Read vulnerability report

low severity

Use After Free

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "ktypevec."

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "btypevec."

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Use After Free vulnerability report

low severity

Excessive Iteration

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

Issue summary: Checking excessively long DH keys or parameters may be very slow.

Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.

The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p.

An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack.

The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check().

Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Excessive Iteration vulnerability report

low severity

Improper Certificate Validation

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification.

As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function.

Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument.

Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Improper Certificate Validation vulnerability report

low severity

Improper Certificate Validation

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks.

Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether.

Policy processing is disabled by default but can be enabled by passing the -policy' argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Improper Certificate Validation vulnerability report

low severity

Missing Required Cryptographic Step

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow.

Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.

While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters.

Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q.

An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack.

DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().

Also vulnerable are the OpenSSL pkey command line application when using the "-pubcheck" option, as well as the OpenSSL genpkey command line application.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Missing Required Cryptographic Step vulnerability report

low severity

Resource Exhaustion

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

Issue summary: Checking excessively long DH keys or parameters may be very slow.

The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length.

However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large.

An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack.

Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option.

The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Resource Exhaustion vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: pcre
Introduced through: pcre@8.32-17.el7

Detailed paths

Introduced through: centos@7 › pcre@8.32-17.el7

NVD Description

libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

Remediation

There is no fixed version for Centos:7 pcre.

References

Integer Overflow or Wraparound vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Incorrect Calculation of Buffer Size

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Incorrect Calculation of Buffer Size vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Write vulnerability report

low severity

Information Exposure

Vulnerable module: readline
Introduced through: readline@6.2-11.el7

Detailed paths

Introduced through: centos@7 › readline@6.2-11.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream readline package and not the readline package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo.

Remediation

There is no fixed version for Centos:7 readline.

References

Information Exposure vulnerability report

low severity

Race Condition

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

Remediation

There is no fixed version for Centos:7 python.

References

Race Condition vulnerability report

low severity

Race Condition

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Race Condition vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: coreutils
Introduced through: coreutils@8.22-24.el7

Detailed paths

Introduced through: centos@7 › coreutils@8.22-24.el7

NVD Description

The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings.

Remediation

There is no fixed version for Centos:7 coreutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Out-of-Bounds

Vulnerable module: coreutils
Introduced through: coreutils@8.22-24.el7

Detailed paths

Introduced through: centos@7 › coreutils@8.22-24.el7

NVD Description

Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified other impact via long strings.

Remediation

There is no fixed version for Centos:7 coreutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: libblkid
Introduced through: libblkid@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libblkid@2.23.2-65.el7

NVD Description

Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.

Remediation

There is no fixed version for Centos:7 libblkid.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: libmount
Introduced through: libmount@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libmount@2.23.2-65.el7

NVD Description

Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.

Remediation

There is no fixed version for Centos:7 libmount.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: libuuid
Introduced through: libuuid@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libuuid@2.23.2-65.el7

NVD Description

Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.

Remediation

There is no fixed version for Centos:7 libuuid.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: util-linux
Introduced through: util-linux@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › util-linux@2.23.2-65.el7

NVD Description

Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.

Remediation

There is no fixed version for Centos:7 util-linux.

References

Out-of-Bounds vulnerability report

low severity

Improper Authentication

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.

Remediation

There is no fixed version for Centos:7 curl.

References

Improper Authentication vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.

Remediation

There is no fixed version for Centos:7 curl.

References

Out-of-bounds Read vulnerability report

low severity

Improper Authentication

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Improper Authentication vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Out-of-bounds Read vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: libxml2
Introduced through: libxml2@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2@2.9.1-6.el7.5

NVD Description

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.

Remediation

There is no fixed version for Centos:7 libxml2.

References

Stack-based Buffer Overflow vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: libxml2-python
Introduced through: libxml2-python@2.9.1-6.el7.5

Detailed paths

Introduced through: centos@7 › libxml2-python@2.9.1-6.el7.5

NVD Description

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

Stack-based Buffer Overflow vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Integer Overflow or Wraparound vulnerability report

low severity

Resource Exhaustion

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module.

When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.

Remediation

There is no fixed version for Centos:7 python.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module.

Remediation

There is no fixed version for Centos:7 python-libs.

References

Resource Exhaustion vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

vim is vulnerable to Use After Free

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption problem caused by the cplus_demangle_type function making recursive calls to itself in certain scenarios involving many 'P' characters.

Remediation

There is no fixed version for Centos:7 binutils.

References

Allocation of Resources Without Limits or Throttling vulnerability report

low severity

Improper Input Validation

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened.

Remediation

There is no fixed version for Centos:7 binutils.

References

Improper Input Validation vulnerability report

low severity

Use of Uninitialized Variable

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

A flaw was found in Binutils. The field the_bfd of asymbolstruct is uninitialized in the bfd_mach_o_get_synthetic_symtab function, which may lead to an application crash and local denial of service.

Remediation

There is no fixed version for Centos:7 binutils.

References

Use of Uninitialized Variable vulnerability report

low severity

Use of Uninitialized Variable

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service.

Remediation

There is no fixed version for Centos:7 binutils.

References

Use of Uninitialized Variable vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: libblkid
Introduced through: libblkid@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libblkid@2.23.2-65.el7

NVD Description

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

Remediation

There is no fixed version for Centos:7 libblkid.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: libmount
Introduced through: libmount@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libmount@2.23.2-65.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libmount.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: libuuid
Introduced through: libuuid@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › libuuid@2.23.2-65.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libuuid.

References

Integer Overflow or Wraparound vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_match that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-party

Remediation

There is no fixed version for Centos:7 ncurses.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Out-of-Bounds vulnerability report

low severity

Incorrect Implementation of Authentication Algorithm

Vulnerable module: shadow-utils
Introduced through: shadow-utils@2:4.6-5.el7

Detailed paths

Introduced through: centos@7 › shadow-utils@2:4.6-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream shadow-utils package and not the shadow-utils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

Remediation

There is no fixed version for Centos:7 shadow-utils.

References

Incorrect Implementation of Authentication Algorithm vulnerability report

low severity

Use After Free

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Use After Free vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: util-linux
Introduced through: util-linux@2.23.2-65.el7

Detailed paths

Introduced through: centos@7 › util-linux@2.23.2-65.el7

NVD Description

Remediation

There is no fixed version for Centos:7 util-linux.

References

Integer Overflow or Wraparound vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a :s command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive :s call causes free-ing of memory which may later then be accessed by the initial :s command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins and so it may eventually move the off position out of a valid buffer size. Impact is low since it is not easily reproducible and requires to have several mappings active and run into some error condition. But when this happens, this will cause a crash. The issue has been fixed as of Vim patch v9.1.0697. Users are advised to upgrade. There are no known workarounds for this issue.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line. Back then we assumed this loop is unnecessary. However, this change made it possible that the cursor position stays invalid and points beyond the end of a line, which would eventually cause a heap-buffer-overflow when trying to access the line pointer at the specified cursor position. It's not quite clear yet, what can lead to this situation that the cursor points to an invalid position. That's why patch v9.1.0707 does not include a test case. The only observed impact has been a program crash. This issue has been addressed in with the patch v9.1.0707. All users are advised to upgrade.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as demonstrated by nm.

Remediation

There is no fixed version for Centos:7 binutils.

References

Integer Overflow or Wraparound vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. The vulnerability can trigger program crashes. It may lead to an information leak as well.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2line, size, and strings. It could lead to information disclosure as well.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Incorrect Permission Assignment for Critical Resource

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.

Remediation

There is no fixed version for Centos:7 glib2.

References

Incorrect Permission Assignment for Critical Resource vulnerability report

low severity

Improper Initialization

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.

Remediation

There is no fixed version for Centos:7 libgcc.

References

Improper Initialization vulnerability report

low severity

Improper Initialization

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Improper Initialization vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: procps-ng
Introduced through: procps-ng@3.3.10-28.el7

Detailed paths

Introduced through: centos@7 › procps-ng@3.3.10-28.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream procps-ng package and not the procps-ng package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.

Remediation

There is no fixed version for Centos:7 procps-ng.

References

Stack-based Buffer Overflow vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Use After Free in GitHub repository vim/vim prior to 9.0.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The get_count function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31, allows remote attackers to cause a denial of service (malloc called with the result of an integer-overflowing calculation) or possibly have unspecified other impact via a crafted string, as demonstrated by c++filt.

Remediation

There is no fixed version for Centos:7 binutils.

References

Integer Overflow or Wraparound vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions next_is_type_qual() and cplus_demangle_type() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there is a stack consumption problem caused by recursive stack frames: cplus_demangle_type, d_bare_function_type, d_function_type.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions d_name(), d_encoding(), and d_local_name() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Use After Free

Vulnerable module: bzip2-libs
Introduced through: bzip2-libs@1.0.6-13.el7

Detailed paths

Introduced through: centos@7 › bzip2-libs@1.0.6-13.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bzip2-libs package and not the bzip2-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.

Remediation

There is no fixed version for Centos:7 bzip2-libs.

References

Use After Free vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: cpio
Introduced through: cpio@2.11-28.el7

Detailed paths

Introduced through: centos@7 › cpio@2.11-28.el7

NVD Description

The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.

Remediation

There is no fixed version for Centos:7 cpio.

References

Out-of-bounds Write vulnerability report

low severity

Memory Leak

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Memory Leak vulnerability report

low severity

Improper Handling of Exceptional Conditions

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling is enabled and the cpo-settings include the 'n' flag. This may happen when a window border is present and when the wrapped line continues on the next physical line directly in the window border because the 'cpo' setting includes the 'n' flag. Only users with non-default settings are affected and the exception should only result in a crash. This issue has been addressed in commit cb0b99f0 which has been included in release version 9.0.2107. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Improper Handling of Exceptional Conditions vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit 58f9befca1 which has been included in release version 9.0.2109. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the overflow. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit 060623e which has been included in release version 9.0.2110. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit ac6378773 which has been included in release version 9.0.2108. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has been addressed in commit 73b2d379 which has been included in release version 9.0.2111. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit 6bf131888 which has been included in version 9.0.2112. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Integer Overflow or Wraparound vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit 25aabc2b which has been included in release version 9.0.2106. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Improper Validation of Certificate with Host Mismatch

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

Remediation

There is no fixed version for Centos:7 openldap.

References

Improper Validation of Certificate with Host Mismatch vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: bzip2-libs
Introduced through: bzip2-libs@1.0.6-13.el7

Detailed paths

Introduced through: centos@7 › bzip2-libs@1.0.6-13.el7

NVD Description

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

Remediation

There is no fixed version for Centos:7 bzip2-libs.

References

Out-of-bounds Write vulnerability report

low severity

Link Following

Vulnerable module: cpio
Introduced through: cpio@2.11-28.el7

Detailed paths

Introduced through: centos@7 › cpio@2.11-28.el7

NVD Description

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

Remediation

There is no fixed version for Centos:7 cpio.

References

Link Following vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: cracklib
Introduced through: cracklib@2.9.0-11.el7

Detailed paths

Introduced through: centos@7 › cracklib@2.9.0-11.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream cracklib package and not the cracklib package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack-based buffer overflow in the FascistGecosUser function in lib/fascist.c in cracklib allows local users to cause a denial of service (application crash) or gain privileges via a long GECOS field, involving longbuffer.

Remediation

There is no fixed version for Centos:7 cracklib.

References

Out-of-bounds Write vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: cracklib-dicts
Introduced through: cracklib-dicts@2.9.0-11.el7

Detailed paths

Introduced through: centos@7 › cracklib-dicts@2.9.0-11.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream cracklib-dicts package and not the cracklib-dicts package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

There is no fixed version for Centos:7 cracklib-dicts.

References

Out-of-bounds Write vulnerability report

low severity

Algorithmic Complexity

Vulnerable module: dbus
Introduced through: dbus@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus@1:1.10.24-15.el7

NVD Description

The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a denial of service (CPU consumption) via a large number of method calls.

Remediation

There is no fixed version for Centos:7 dbus.

References

Algorithmic Complexity vulnerability report

low severity

Resource Exhaustion

Vulnerable module: dbus
Introduced through: dbus@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus@1:1.10.24-15.el7

NVD Description

D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor.

Remediation

There is no fixed version for Centos:7 dbus.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: dbus
Introduced through: dbus@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus@1:1.10.24-15.el7

NVD Description

The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.

Remediation

There is no fixed version for Centos:7 dbus.

References

Resource Exhaustion vulnerability report

low severity

Resource Management Errors

Vulnerable module: dbus
Introduced through: dbus@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus@1:1.10.24-15.el7

NVD Description

D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descriptors for a single sendmsg call.

Remediation

There is no fixed version for Centos:7 dbus.

References

Resource Management Errors vulnerability report

low severity

Algorithmic Complexity

Vulnerable module: dbus-libs
Introduced through: dbus-libs@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus-libs@1:1.10.24-15.el7

NVD Description

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

Algorithmic Complexity vulnerability report

low severity

Resource Exhaustion

Vulnerable module: dbus-libs
Introduced through: dbus-libs@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus-libs@1:1.10.24-15.el7

NVD Description

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: dbus-libs
Introduced through: dbus-libs@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus-libs@1:1.10.24-15.el7

NVD Description

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

Resource Exhaustion vulnerability report

low severity

Resource Management Errors

Vulnerable module: dbus-libs
Introduced through: dbus-libs@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus-libs@1:1.10.24-15.el7

NVD Description

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

Resource Management Errors vulnerability report

low severity

Out-of-Bounds

Vulnerable module: elfutils-default-yama-scope
Introduced through: elfutils-default-yama-scope@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-default-yama-scope@0.176-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

Out-of-Bounds vulnerability report

low severity

Resource Exhaustion

Vulnerable module: elfutils-default-yama-scope
Introduced through: elfutils-default-yama-scope@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-default-yama-scope@0.176-5.el7

NVD Description

In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) via crafted file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

Resource Exhaustion vulnerability report

low severity

Out-of-Bounds

Vulnerable module: elfutils-libelf
Introduced through: elfutils-libelf@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libelf@0.176-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

Out-of-Bounds vulnerability report

low severity

Resource Exhaustion

Vulnerable module: elfutils-libelf
Introduced through: elfutils-libelf@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libelf@0.176-5.el7

NVD Description

In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) via crafted file.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

Resource Exhaustion vulnerability report

low severity

Out-of-Bounds

Vulnerable module: elfutils-libs
Introduced through: elfutils-libs@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libs@0.176-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

Out-of-Bounds vulnerability report

low severity

Resource Exhaustion

Vulnerable module: elfutils-libs
Introduced through: elfutils-libs@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libs@0.176-5.el7

NVD Description

In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) via crafted file.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

Resource Exhaustion vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.

Remediation

There is no fixed version for Centos:7 glibc.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Integer Overflow or Wraparound vulnerability report

low severity

Improper Input Validation

Vulnerable module: libtasn1
Introduced through: libtasn1@4.10-1.el7

Detailed paths

Introduced through: centos@7 › libtasn1@4.10-1.el7

NVD Description

GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.

Remediation

There is no fixed version for Centos:7 libtasn1.

References

Improper Input Validation vulnerability report

low severity

Information Exposure

Vulnerable module: systemd
Introduced through: systemd@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd@219-78.el7

NVD Description

The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command.

Remediation

There is no fixed version for Centos:7 systemd.

References

Information Exposure vulnerability report

low severity

Information Exposure

Vulnerable module: systemd-libs
Introduced through: systemd-libs@219-78.el7

Detailed paths

Introduced through: centos@7 › systemd-libs@219-78.el7

NVD Description

The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command.

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

Information Exposure vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function ga_grow_inner in in the file src/alloc.c at line 748, which is freed in the file src/ex_docmd.c in the function do_cmdline at line 1010 and then used again in src/cmdhist.c at line 759. When using the :history command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Integer Overflow or Wraparound vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: procps-ng
Introduced through: procps-ng@3.3.10-28.el7

Detailed paths

Introduced through: centos@7 › procps-ng@3.3.10-28.el7

NVD Description

procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).

Remediation

There is no fixed version for Centos:7 procps-ng.

References

Heap-based Buffer Overflow vulnerability report

low severity

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: procps-ng
Introduced through: procps-ng@3.3.10-28.el7

Detailed paths

Introduced through: centos@7 › procps-ng@3.3.10-28.el7

NVD Description

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.

Remediation

There is no fixed version for Centos:7 procps-ng.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

low severity

Authentication Bypass

Vulnerable module: bind-license
Introduced through: bind-license@32:9.11.4-26.P2.el7

Detailed paths

Introduced through: centos@7 › bind-license@32:9.11.4-26.P2.el7

NVD Description

Cache Poisoning issue exists in DNS Response Rate Limiting.

Remediation

There is no fixed version for Centos:7 bind-license.

References

Authentication Bypass vulnerability report

low severity

Improper Input Validation

Vulnerable module: coreutils
Introduced through: coreutils@8.22-24.el7

Detailed paths

Introduced through: centos@7 › coreutils@8.22-24.el7

NVD Description

The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command.

Remediation

There is no fixed version for Centos:7 coreutils.

References

Improper Input Validation vulnerability report

low severity

Directory Traversal

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde () character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /2/foo while accessing a server with a specific user.

Remediation

There is no fixed version for Centos:7 curl.

References

Directory Traversal vulnerability report

low severity

Expected Behavior Violation

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

Remediation

There is no fixed version for Centos:7 curl.

References

Expected Behavior Violation vulnerability report

low severity

External Control of File Name or Path

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers.

libcurl provides a function call that duplicates en easy handle called curl_easy_duphandle.

If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as none (using the four ASCII letters, no quotes).

Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named none - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.

Remediation

There is no fixed version for Centos:7 curl.

References

External Control of File Name or Path vulnerability report

low severity

Improper Authentication

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.

Remediation

There is no fixed version for Centos:7 curl.

References

Improper Authentication vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

The URL percent-encoding decode function in libcurl before 7.51.0 is called curl_easy_unescape. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.

Remediation

There is no fixed version for Centos:7 curl.

References

Integer Overflow or Wraparound vulnerability report

low severity

Untrusted Pointer Dereference

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.

Remediation

There is no fixed version for Centos:7 curl.

References

Untrusted Pointer Dereference vulnerability report

low severity

Buffer Overflow

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Remediation

There is no fixed version for Centos:7 glib2.

References

Buffer Overflow vulnerability report

low severity

Improper Input Validation

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file.

Remediation

There is no fixed version for Centos:7 glib2.

References

Improper Input Validation vulnerability report

low severity

Improper Input Validation

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.

Remediation

There is no fixed version for Centos:7 glib2.

References

Improper Input Validation vulnerability report

low severity

Improper Input Validation

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.

Remediation

There is no fixed version for Centos:7 glib2.

References

Improper Input Validation vulnerability report

low severity

Use After Free

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.15.1-50.el7

Detailed paths

Introduced through: centos@7 › krb5-libs@1.15.1-50.el7

NVD Description

Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

Use After Free vulnerability report

low severity

Directory Traversal

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Directory Traversal vulnerability report

low severity

Expected Behavior Violation

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Expected Behavior Violation vulnerability report

low severity

External Control of File Name or Path

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers.

libcurl provides a function call that duplicates en easy handle called curl_easy_duphandle.

Remediation

There is no fixed version for Centos:7 libcurl.

References

External Control of File Name or Path vulnerability report

low severity

Improper Authentication

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Improper Authentication vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Integer Overflow or Wraparound vulnerability report

low severity

Untrusted Pointer Dereference

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.

Remediation

There is no fixed version for Centos:7 libcurl.

References

Untrusted Pointer Dereference vulnerability report

low severity

Improper Input Validation

Vulnerable module: libidn
Introduced through: libidn@1.28-4.el7

Detailed paths

Introduced through: centos@7 › libidn@1.28-4.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libidn package and not the libidn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.

Remediation

There is no fixed version for Centos:7 libidn.

References

Improper Input Validation vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: libidn
Introduced through: libidn@1.28-4.el7

Detailed paths

Introduced through: centos@7 › libidn@1.28-4.el7

NVD Description

The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read.

Remediation

There is no fixed version for Centos:7 libidn.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: libidn
Introduced through: libidn@1.28-4.el7

Detailed paths

Introduced through: centos@7 › libidn@1.28-4.el7

NVD Description

idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read.

Remediation

There is no fixed version for Centos:7 libidn.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: libidn
Introduced through: libidn@1.28-4.el7

Detailed paths

Introduced through: centos@7 › libidn@1.28-4.el7

NVD Description

idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read, a different vulnerability than CVE-2015-8948.

Remediation

There is no fixed version for Centos:7 libidn.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: libidn
Introduced through: libidn@1.28-4.el7

Detailed paths

Introduced through: centos@7 › libidn@1.28-4.el7

NVD Description

The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.

Remediation

There is no fixed version for Centos:7 libidn.

References

Out-of-bounds Read vulnerability report

low severity

Unchecked Return Value

Vulnerable module: libssh2
Introduced through: libssh2@1.8.0-4.el7

Detailed paths

Introduced through: centos@7 › libssh2@1.8.0-4.el7

NVD Description

A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

Remediation

There is no fixed version for Centos:7 libssh2.

References

Unchecked Return Value vulnerability report

low severity

Incorrect Calculation

Vulnerable module: nss-softokn
Introduced through: nss-softokn@3.53.1-6.el7_9

Detailed paths

Introduced through: centos@7 › nss-softokn@3.53.1-6.el7_9

NVD Description

The s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, improperly divides numbers, which might make it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging use of the (1) mp_div or (2) mp_exptmod function.

Remediation

There is no fixed version for Centos:7 nss-softokn.

References

Incorrect Calculation vulnerability report

low severity

Incorrect Calculation

Vulnerable module: nss-softokn-freebl
Introduced through: nss-softokn-freebl@3.53.1-6.el7_9

Detailed paths

Introduced through: centos@7 › nss-softokn-freebl@3.53.1-6.el7_9

NVD Description

Remediation

There is no fixed version for Centos:7 nss-softokn-freebl.

References

Incorrect Calculation vulnerability report

low severity

Information Exposure

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

Information Exposure vulnerability report

low severity

Improper Input Validation

Vulnerable module: pcre
Introduced through: pcre@8.32-17.el7

Detailed paths

Introduced through: centos@7 › pcre@8.32-17.el7

NVD Description

Remediation

There is no fixed version for Centos:7 pcre.

References

Improper Input Validation vulnerability report

low severity

Improper Input Validation

Vulnerable module: pcre
Introduced through: pcre@8.32-17.el7

Detailed paths

Introduced through: centos@7 › pcre@8.32-17.el7

NVD Description

Remediation

There is no fixed version for Centos:7 pcre.

References

Improper Input Validation vulnerability report

low severity

Improper Input Validation

Vulnerable module: pcre
Introduced through: pcre@8.32-17.el7

Detailed paths

Introduced through: centos@7 › pcre@8.32-17.el7

NVD Description

The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file.

Remediation

There is no fixed version for Centos:7 pcre.

References

Improper Input Validation vulnerability report

low severity

Expected Behavior Violation

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.

CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.

Remediation

There is no fixed version for Centos:7 python.

References

Expected Behavior Violation vulnerability report

low severity

Expected Behavior Violation

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.

Remediation

There is no fixed version for Centos:7 python-libs.

References

Expected Behavior Violation vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.

Remediation

There is no fixed version for Centos:7 python.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Heap-based Buffer Overflow vulnerability report

low severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).

Remediation

There is no fixed version for Centos:7 binutils.

References

Allocation of Resources Without Limits or Throttling vulnerability report

low severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

GNU Binutils 2.28 allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file with many program headers, related to the get_program_headers function in readelf.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

Allocation of Resources Without Limits or Throttling vulnerability report

low severity

Divide By Zero

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Divide By Zero vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the PLT section size, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to elf_i386_get_synthetic_symtab in elf32-i386.c and elf_x86_64_get_synthetic_symtab in elf64-x86-64.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The _bfd_elf_parse_attributes function in elf-attrs.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (_bfd_elf_attr_strdup heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The pe_print_idata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles HintName vector entries, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PE file, related to the bfd_getl16 function.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

bfd_get_debug_link_info_1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to bfd_getl32.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The read_section function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (parse_comp_unit heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a length calculation, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to read_1_byte.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The decode_line_info function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (read_1_byte heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file, related to parse_die and parse_line_table, as demonstrated by a parse_die heap-based buffer over-read.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The _bfd_coff_read_string_table function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not properly validate the size of the external string table, which allows remote attackers to cause a denial of service (excessive memory consumption, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted COFF binary.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 does not have integer-overflow protection on 32-bit platforms, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that is vulnerable to a heap-based buffer over-read (off-by-one) because of an incomplete check for invalid string offsets while loading symbols, leading to a GNU linker (ld) program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to the byte_get_little_endian function in elfcomm.c, the get_unwind_section_word function in readelf.c, and ARM unwind information that contains invalid word offsets.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to MIPS GOT mishandling in the process_mips_specific function in readelf.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Improper Input Validation

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The load_debug_section function in readelf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via an ELF file that lacks section headers.

Remediation

There is no fixed version for Centos:7 binutils.

References

Improper Input Validation vulnerability report

low severity

Improper Input Validation

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The coff_slurp_line_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted PE file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Improper Input Validation vulnerability report

low severity

Improper Input Validation

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (memory access violation) or possibly have unspecified other impact via a COFF binary in which a relocation refers to a location after the end of the to-be-relocated section.

Remediation

There is no fixed version for Centos:7 binutils.

References

Improper Input Validation vulnerability report

low severity

Improper Input Validation

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

readelf.c in GNU Binutils 2017-04-12 has a "shift exponent too large for type unsigned long" issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Improper Input Validation vulnerability report

low severity

Improper Input Validation

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.

Remediation

There is no fixed version for Centos:7 binutils.

References

Improper Input Validation vulnerability report

low severity

Improper Null Termination

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

GNU linker (ld) in GNU Binutils 2.28 is vulnerable to a heap-based buffer overflow while processing a bogus input script, leading to a program crash. This relates to lack of '\0' termination of a name field in ldlex.l.

Remediation

There is no fixed version for Centos:7 binutils.

References

Improper Null Termination vulnerability report

low severity

Incorrect Type Conversion or Cast

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

readelf.c in GNU Binutils 2017-04-12 has a "cannot be represented in type long" issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Incorrect Type Conversion or Cast vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpret a -1 value as a sorting count instead of an error flag, which allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate the symbol count, which allows remote attackers to cause a denial of service (integer overflow and application crash, or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The display_debug_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (integer overflow and heap-based buffer over-read, and application crash) or possibly have unspecified other impact via a crafted ELF file, related to print_debug_frame.

Remediation

There is no fixed version for Centos:7 binutils.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The pe_bfd_read_buildid function in peicode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate size and offset values in the data dictionary, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA macro in elf.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

Remediation

There is no fixed version for Centos:7 binutils.

References

Integer Overflow or Wraparound vulnerability report

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

process_debug_info in dwarf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file that contains a negative size value in a CU structure.

Remediation

There is no fixed version for Centos:7 binutils.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a group section that is too small.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The bfd_make_section_with_flags function in section.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a NULL dereference via a crafted file.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

scan_unit_for_symbols in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles NULL files in a .debug_line file table, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename. NOTE: this issue is caused by an incomplete fix for CVE-2017-15023.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandle the failure of a certain canonicalization step, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the DW_AT_name data type, which allows remote attackers to cause a denial of service (bfd_hash_hash NULL pointer dereference, or out-of-bounds access, and application crash) via a crafted ELF file, related to scan_unit_for_symbols and parse_comp_unit.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not properly validate the format count, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The coff_slurp_reloc_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted COFF based file.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The find_nearest_line function in addr2line in GNU Binutils 2.28 does not handle the case where the main file name and the directory name are both empty, triggering a NULL pointer dereference and an invalid write, and leading to a program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The dump_section_as_bytes function in readelf in GNU Binutils 2.28 accesses a NULL pointer while reading section contents in a corrupt binary, leading to a program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member access within null pointer" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an "int main() {return 0;}" program.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

GNU Binutils 2017-04-03 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash), related to the process_mips_specific function in readelf.c, via a crafted ELF file that triggers a large memory-allocation attempt.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 4 due to NULL pointer dereferencing of _bfd_elf_large_com_section. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 8 because of missing a check to determine whether symbols are NULL in the _bfd_dwarf2_find_nearest_line function. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in elf_link_input_bfd in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in the merge_strings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in work_stuff_copy_to_from when called from iterate_demangle_function.

Remediation

There is no fixed version for Centos:7 binutils.

References

NULL Pointer Dereference vulnerability report

low severity

Off-by-one Error

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that has an off-by-one vulnerability because it does not carefully check the string offset. The vulnerability could lead to a GNU linker (ld) program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

Off-by-one Error vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The elf_read_notesfunction in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggers a "buffer overflow on fuzzed archive header," related to an uninitialized variable, an improper conditional jump, and the get_archive_member_name, process_archive_index_and_symbols, and setup_archive functions.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

nm.c and objdump.c in GNU Binutils 2.29.1 mishandle certain global symbols, which allows remote attackers to cause a denial of service (_bfd_elf_get_symbol_version_string buffer over-read and application crash) or possibly have unspecified other impact via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The sh_elf_set_mach_from_flags function in bfd/elf32-sh.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The print_insn_score32 function in opcodes/score7-dis.c:552 in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. NOTE: this may be related to a compiler bug.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The versados_mkobject function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not initialize a certain data structure, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of rae insns printing for this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The _bfd_vms_slurp_etir function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The process_otr function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not validate a certain offset, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

opcodes/i386-dis.c in GNU Binutils 2.28 does not consider the number of registers for bnd mode, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The regs macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The score_opcodes function in opcodes/score7-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The ieee_archive_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. NOTE: this may be related to a compiler bug.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file in the _bfd_vms_get_value and _bfd_vms_slurp_etir functions during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

opcodes/rl78-decode.opc in GNU Binutils 2.28 has an unbounded GETBYTE macro, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executable objdump.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted mach-o file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted nlm file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds stack read via a crafted COFF image file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The _bfd_elf_parse_gnu_properties function in elf-properties.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not prevent negative pointers, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, miscalculates DW_FORM_ref_addr die refs in the case of a relocatable object file, which allows remote attackers to cause a denial of service (find_abstract_instance_name invalid memory read, segmentation fault, and application crash).

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate sizes of core notes, which allows remote attackers to cause a denial of service (bfd_getl32 heap-based buffer over-read and application crash) via a crafted object file, related to elfcore_grok_netbsd_procinfo, elfcore_grok_openbsd_procinfo, and elfcore_grok_nto_status.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an invalid read (of size 8) because the code to emit relocs (bfd_elf_final_link function in bfd/elflink.c) does not check the format of the input file before trying to read the ELF reloc section header. The vulnerability leads to a GNU linker (ld) program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 4) because of missing a check (in the find_link function) for null headers before attempting to match them. This vulnerability causes Binutils utilities like strip to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 8) because of missing a check (in the copy_special_section_fields function) for an invalid sh_link field before attempting to follow it. This vulnerability causes Binutils utilities like strip to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

objdump in GNU Binutils 2.28 is vulnerable to multiple heap-based buffer over-reads (of size 1 and size 8) while handling corrupt STABS enum type strings in a crafted object file, leading to program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip, that SHT_REL/SHR_RELA sections are always named starting with a .rel/.rela prefix. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy and strip, to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a swap_std_reloc_out function in bfd/aoutx.h that is vulnerable to an invalid read (of size 4) because of missing checks for relocs that could not be recognised. This vulnerability causes Binutils utilities like strip to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 and an invalid write of size 1 during processing of a corrupt binary containing reloc(s) with negative addresses. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The print_symbol_for_build_attribute function in readelf.c in GNU Binutils 2017-04-12 allows remote attackers to cause a denial of service (invalid read and SEGV) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 because the existing reloc offset range tests didn't catch small negative offsets less than the size of the reloc field. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

dwarf.c in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. This vulnerability causes programs that conduct an analysis of binary programs, such as objdump and readelf, to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The get_build_id function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file in which a certain size field is larger than a corresponding data field, as demonstrated by mishandling within the objdump program.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The getvalue function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted tekhex file, as demonstrated by mishandling within the nm program.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, because _bfd_add_merge_section mishandles section merges when size is not a multiple of entsize. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow (of size 1) while attempting to unget an EOF character from the input stream, potentially leading to a program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Write vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The find_nearest_line function in objdump in GNU Binutils 2.28 is vulnerable to an invalid write (of size 1) while disassembling a corrupt binary that contains an empty function name, leading to a program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Write vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid write of size 8 because of missing a malloc() return-value check to see if memory had actually been allocated in the _bfd_generic_get_section_contents function. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-bounds Write vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

Memory leak in decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

_bfd_dwarf2_cleanup_debug_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (memory leak) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

_bfd_elf_slurp_version_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to cause a denial of service (excessive memory allocation, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PE file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory exhaustion in objdump via a crafted PE file. Additional validation in dump_relocs_in_section in objdump.c can resolve this.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) during the "Create an array for saving the template argument values" XNEWVEC call. This can occur during execution of objdump.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Resource Exhaustion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted ELF file, leading to a denial of service (memory consumption), as demonstrated by nm.

Remediation

There is no fixed version for Centos:7 binutils.

References

Resource Exhaustion vulnerability report

low severity

Uncontrolled Recursion

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

find_abstract_instance_name in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Uncontrolled Recursion vulnerability report

low severity

Use After Free

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The aout_get_external_symbols function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (slurp_symtab invalid free and application crash) or possibly have unspecified other impact via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.

Remediation

There is no fixed version for Centos:7 curl.

References

Use After Free vulnerability report

low severity

Improper Authorization

Vulnerable module: dbus
Introduced through: dbus@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus@1:1.10.24-15.el7

NVD Description

D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.

Remediation

There is no fixed version for Centos:7 dbus.

References

Improper Authorization vulnerability report

low severity

Improper Authorization

Vulnerable module: dbus-libs
Introduced through: dbus-libs@1:1.10.24-15.el7

Detailed paths

Introduced through: centos@7 › dbus-libs@1:1.10.24-15.el7

NVD Description

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

Improper Authorization vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: elfutils-default-yama-scope
Introduced through: elfutils-default-yama-scope@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-default-yama-scope@0.176-5.el7

NVD Description

The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: elfutils-default-yama-scope
Introduced through: elfutils-default-yama-scope@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-default-yama-scope@0.176-5.el7

NVD Description

The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: elfutils-default-yama-scope
Introduced through: elfutils-default-yama-scope@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-default-yama-scope@0.176-5.el7

NVD Description

The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: elfutils-default-yama-scope
Introduced through: elfutils-default-yama-scope@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-default-yama-scope@0.176-5.el7

NVD Description

The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: elfutils-default-yama-scope
Introduced through: elfutils-default-yama-scope@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-default-yama-scope@0.176-5.el7

NVD Description

The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

Heap-based Buffer Overflow vulnerability report

low severity

Improper Input Validation

Vulnerable module: elfutils-default-yama-scope
Introduced through: elfutils-default-yama-scope@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-default-yama-scope@0.176-5.el7

NVD Description

elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

Improper Input Validation vulnerability report

low severity

Improper Input Validation

Vulnerable module: elfutils-default-yama-scope
Introduced through: elfutils-default-yama-scope@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-default-yama-scope@0.176-5.el7

NVD Description

elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

Improper Input Validation vulnerability report

low severity

Out-of-Bounds

Vulnerable module: elfutils-default-yama-scope
Introduced through: elfutils-default-yama-scope@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-default-yama-scope@0.176-5.el7

NVD Description

The __libelf_set_rawdata_wrlock function in elf_getdata.c in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted (1) sh_off or (2) sh_size ELF header value, which triggers a memory allocation failure.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: elfutils-default-yama-scope
Introduced through: elfutils-default-yama-scope@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-default-yama-scope@0.176-5.el7

NVD Description

The allocate_elf function in common.h in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted ELF file, which triggers a memory allocation failure.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

Out-of-Bounds vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: elfutils-libelf
Introduced through: elfutils-libelf@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libelf@0.176-5.el7

NVD Description

The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: elfutils-libelf
Introduced through: elfutils-libelf@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libelf@0.176-5.el7

NVD Description

The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: elfutils-libelf
Introduced through: elfutils-libelf@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libelf@0.176-5.el7

NVD Description

The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: elfutils-libelf
Introduced through: elfutils-libelf@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libelf@0.176-5.el7

NVD Description

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: elfutils-libelf
Introduced through: elfutils-libelf@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libelf@0.176-5.el7

NVD Description

The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

Heap-based Buffer Overflow vulnerability report

low severity

Improper Input Validation

Vulnerable module: elfutils-libelf
Introduced through: elfutils-libelf@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libelf@0.176-5.el7

NVD Description

elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

Improper Input Validation vulnerability report

low severity

Improper Input Validation

Vulnerable module: elfutils-libelf
Introduced through: elfutils-libelf@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libelf@0.176-5.el7

NVD Description

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

Improper Input Validation vulnerability report

low severity

Out-of-Bounds

Vulnerable module: elfutils-libelf
Introduced through: elfutils-libelf@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libelf@0.176-5.el7

NVD Description

The allocate_elf function in common.h in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted ELF file, which triggers a memory allocation failure.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: elfutils-libelf
Introduced through: elfutils-libelf@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libelf@0.176-5.el7

NVD Description

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

Out-of-Bounds vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: elfutils-libs
Introduced through: elfutils-libs@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libs@0.176-5.el7

NVD Description

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: elfutils-libs
Introduced through: elfutils-libs@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libs@0.176-5.el7

NVD Description

The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: elfutils-libs
Introduced through: elfutils-libs@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libs@0.176-5.el7

NVD Description

The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: elfutils-libs
Introduced through: elfutils-libs@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libs@0.176-5.el7

NVD Description

The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

Heap-based Buffer Overflow vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: elfutils-libs
Introduced through: elfutils-libs@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libs@0.176-5.el7

NVD Description

The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

Heap-based Buffer Overflow vulnerability report

low severity

Improper Input Validation

Vulnerable module: elfutils-libs
Introduced through: elfutils-libs@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libs@0.176-5.el7

NVD Description

elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

Improper Input Validation vulnerability report

low severity

Improper Input Validation

Vulnerable module: elfutils-libs
Introduced through: elfutils-libs@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libs@0.176-5.el7

NVD Description

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

Improper Input Validation vulnerability report

low severity

Out-of-Bounds

Vulnerable module: elfutils-libs
Introduced through: elfutils-libs@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libs@0.176-5.el7

NVD Description

The allocate_elf function in common.h in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted ELF file, which triggers a memory allocation failure.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: elfutils-libs
Introduced through: elfutils-libs@0.176-5.el7

Detailed paths

Introduced through: centos@7 › elfutils-libs@0.176-5.el7

NVD Description

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

Out-of-Bounds vulnerability report

low severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: file-libs
Introduced through: file-libs@5.11-37.el7

Detailed paths

Introduced through: centos@7 › file-libs@5.11-37.el7

NVD Description

The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of service via a large number of notes.

Remediation

There is no fixed version for Centos:7 file-libs.

References

Allocation of Resources Without Limits or Throttling vulnerability report

low severity

Uncontrolled Recursion

Vulnerable module: glib2
Introduced through: glib2@2.56.1-7.el7

Detailed paths

Introduced through: centos@7 › glib2@2.56.1-7.el7

NVD Description

In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

Remediation

There is no fixed version for Centos:7 glib2.

References

Uncontrolled Recursion vulnerability report

low severity

Improper Data Handling

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Remediation

There is no fixed version for Centos:7 glibc.

References

Improper Data Handling vulnerability report

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.

Remediation

There is no fixed version for Centos:7 glibc.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

low severity

Resource Exhaustion

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak).

Remediation

There is no fixed version for Centos:7 glibc.

References

Resource Exhaustion vulnerability report

low severity

Improper Data Handling

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Improper Data Handling vulnerability report

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

low severity

Resource Exhaustion

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Resource Exhaustion vulnerability report

low severity

Memory Leak

Vulnerable module: libcap
Introduced through: libcap@2.22-11.el7

Detailed paths

Introduced through: centos@7 › libcap@2.22-11.el7

NVD Description

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

Remediation

There is no fixed version for Centos:7 libcap.

References

Memory Leak vulnerability report

low severity

Use After Free

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.

Remediation

There is no fixed version for Centos:7 libcurl.

References

Use After Free vulnerability report

low severity

Improper Access Control

Vulnerable module: libdb
Introduced through: libdb@5.3.21-25.el7

Detailed paths

Introduced through: centos@7 › libdb@5.3.21-25.el7

NVD Description

Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Remediation

There is no fixed version for Centos:7 libdb.

References

Improper Access Control vulnerability report

low severity

Improper Access Control

Vulnerable module: libdb-utils
Introduced through: libdb-utils@5.3.21-25.el7

Detailed paths

Introduced through: centos@7 › libdb-utils@5.3.21-25.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libdb-utils.

References

Improper Access Control vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.

Remediation

There is no fixed version for Centos:7 libgcc.

References

Heap-based Buffer Overflow vulnerability report

low severity

Improper Input Validation

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libgcc.

References

Improper Input Validation vulnerability report

low severity

Resource Exhaustion

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libgcc.

References

Resource Exhaustion vulnerability report

low severity

Uncontrolled Recursion

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.

Remediation

There is no fixed version for Centos:7 libgcc.

References

Uncontrolled Recursion vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: libidn
Introduced through: libidn@1.28-4.el7

Detailed paths

Introduced through: centos@7 › libidn@1.28-4.el7

NVD Description

Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.

Remediation

There is no fixed version for Centos:7 libidn.

References

Integer Overflow or Wraparound vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Heap-based Buffer Overflow vulnerability report

low severity

Improper Input Validation

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Improper Input Validation vulnerability report

low severity

Resource Exhaustion

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Resource Exhaustion vulnerability report

low severity

Uncontrolled Recursion

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Uncontrolled Recursion vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: libtasn1
Introduced through: libtasn1@4.10-1.el7

Detailed paths

Introduced through: centos@7 › libtasn1@4.10-1.el7

NVD Description

The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1_node structure. It may lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 libtasn1.

References

NULL Pointer Dereference vulnerability report

low severity

Improper Input Validation

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Improper Input Validation vulnerability report

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.

Remediation

There is no fixed version for Centos:7 ncurses.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c. NOTE: Multiple third parties have disputed this indicating upstream does not regard it as a security issue.

Remediation

There is no fixed version for Centos:7 ncurses.

References

NULL Pointer Dereference vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Out-of-Bounds vulnerability report

low severity

Improper Input Validation

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Improper Input Validation vulnerability report

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c. NOTE: Multiple third parties have disputed this indicating upstream does not regard it as a security issue.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

NULL Pointer Dereference vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Out-of-Bounds vulnerability report

low severity

Improper Input Validation

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Improper Input Validation vulnerability report

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c. NOTE: Multiple third parties have disputed this indicating upstream does not regard it as a security issue.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

NULL Pointer Dereference vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Out-of-Bounds vulnerability report

low severity

Improper Certificate Validation

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.0.2k-19.el7

Detailed paths

Introduced through: centos@7 › openssl-libs@1:1.0.2k-19.el7

NVD Description

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. OpenSSL does not class this issue as a security vulnerability. The trusted CA store should not contain anything that the user does not trust to issue other certificates. Notes: https://github.com/openssl/openssl/issues/5236#issuecomment-119646061

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

https://access.redhat.com/security/cve/CVE-2021-3601

Improper Certificate Validation vulnerability report

low severity

Improper Initialization

Vulnerable module: pcre
Introduced through: pcre@8.32-17.el7

Detailed paths

Introduced through: centos@7 › pcre@8.32-17.el7

NVD Description

The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.

Remediation

There is no fixed version for Centos:7 pcre.

References

Improper Initialization vulnerability report

low severity

Uncontrolled Recursion

Vulnerable module: pcre
Introduced through: pcre@8.32-17.el7

Detailed paths

Introduced through: centos@7 › pcre@8.32-17.el7

NVD Description

In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

Remediation

There is no fixed version for Centos:7 pcre.

References

Uncontrolled Recursion vulnerability report

low severity

Out-of-Bounds

Vulnerable module: procps-ng
Introduced through: procps-ng@3.3.10-28.el7

Detailed paths

Introduced through: centos@7 › procps-ng@3.3.10-28.el7

NVD Description

Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap.

Remediation

There is no fixed version for Centos:7 procps-ng.

References

Out-of-Bounds vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where sqlite3_step(pStmt)==SQLITE_ROW is false and a data structure is never initialized.

Remediation

There is no fixed version for Centos:7 sqlite.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted file.

Remediation

There is no fixed version for Centos:7 sqlite.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.

Remediation

There is no fixed version for Centos:7 sqlite.

References

NULL Pointer Dereference vulnerability report

low severity

Memory Leak

Vulnerable module: tar
Introduced through: tar@2:1.26-35.el7

Detailed paths

Introduced through: centos@7 › tar@2:1.26-35.el7

NVD Description

A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 tar.

References

Memory Leak vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: tar
Introduced through: tar@2:1.26-35.el7

Detailed paths

Introduced through: centos@7 › tar@2:1.26-35.el7

NVD Description

pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.

Remediation

There is no fixed version for Centos:7 tar.

References

NULL Pointer Dereference vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: tar
Introduced through: tar@2:1.26-35.el7

Detailed paths

Introduced through: centos@7 › tar@2:1.26-35.el7

NVD Description

In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.

Remediation

There is no fixed version for Centos:7 tar.

References

Stack-based Buffer Overflow vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

NULL Pointer Dereference vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Out-of-bounds Read vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file. NOTE: there might be a limited number of scenarios in which this has security relevance.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Use After Free in GitHub repository vim/vim prior to v9.0.2010.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers Buf* autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

Improper Validation of Syntactic Correctness of Input

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

Remediation

There is no fixed version for Centos:7 curl.

References

Improper Validation of Syntactic Correctness of Input vulnerability report

low severity

Use of Uninitialized Resource

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

Remediation

There is no fixed version for Centos:7 curl.

References

Use of Uninitialized Resource vulnerability report

low severity

Use of Uninitialized Resource

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

curl supports the -t command line option, known as CURLOPT_TELNETOPTIONSin libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending NEW_ENV variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.

Remediation

There is no fixed version for Centos:7 curl.

References

Use of Uninitialized Resource vulnerability report

low severity

Improper Validation of Syntactic Correctness of Input

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Improper Validation of Syntactic Correctness of Input vulnerability report

low severity

Use of Uninitialized Resource

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Use of Uninitialized Resource vulnerability report

low severity

Use of Uninitialized Resource

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Use of Uninitialized Resource vulnerability report

low severity

Cleartext Transmission of Sensitive Information

Vulnerable module: nss
Introduced through: nss@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss@3.53.1-3.el7_9

NVD Description

Calling PK11_Encrypt() in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1.

Remediation

There is no fixed version for Centos:7 nss.

References

Cleartext Transmission of Sensitive Information vulnerability report

low severity

Cleartext Transmission of Sensitive Information

Vulnerable module: nss-sysinit
Introduced through: nss-sysinit@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-sysinit@3.53.1-3.el7_9

NVD Description

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

Cleartext Transmission of Sensitive Information vulnerability report

low severity

Cleartext Transmission of Sensitive Information

Vulnerable module: nss-tools
Introduced through: nss-tools@3.53.1-3.el7_9

Detailed paths

Introduced through: centos@7 › nss-tools@3.53.1-3.el7_9

NVD Description

Remediation

There is no fixed version for Centos:7 nss-tools.

References

Cleartext Transmission of Sensitive Information vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: rpm
Introduced through: rpm@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm@4.11.3-45.el7

NVD Description

A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 rpm.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: rpm-build-libs
Introduced through: rpm-build-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-build-libs@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: rpm-libs
Introduced through: rpm-libs@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-libs@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: rpm-python
Introduced through: rpm-python@4.11.3-45.el7

Detailed paths

Introduced through: centos@7 › rpm-python@4.11.3-45.el7

NVD Description

Remediation

There is no fixed version for Centos:7 rpm-python.

References

Out-of-bounds Read vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

ihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects.

Remediation

There is no fixed version for Centos:7 binutils.

References

Stack-based Buffer Overflow vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern, which triggers an out-of-bounds read.

Remediation

There is no fixed version for Centos:7 glibc.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Out-of-bounds Read vulnerability report

low severity

Incorrect Calculation of Buffer Size

Vulnerable module: gnupg2
Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

Introduced through: centos@7 › gnupg2@2.0.22-5.el7_5

NVD Description

kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service (invalid read operation) via a crafted keyring file, related to sign extensions and "memcpy with overlapping ranges."

Remediation

There is no fixed version for Centos:7 gnupg2.

References

Incorrect Calculation of Buffer Size vulnerability report

low severity

Information Exposure

Vulnerable module: gnupg2
Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

Introduced through: centos@7 › gnupg2@2.0.22-5.el7_5

NVD Description

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

Remediation

There is no fixed version for Centos:7 gnupg2.

References

Information Exposure vulnerability report

low severity

Information Exposure

Vulnerable module: gnupg2
Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

Introduced through: centos@7 › gnupg2@2.0.22-5.el7_5

NVD Description

The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."

Remediation

There is no fixed version for Centos:7 gnupg2.

References

Information Exposure vulnerability report

low severity

Use After Free

Vulnerable module: gnupg2
Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

Introduced through: centos@7 › gnupg2@2.0.22-5.el7_5

NVD Description

The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.

Remediation

There is no fixed version for Centos:7 gnupg2.

References

Use After Free vulnerability report

low severity

Information Exposure

Vulnerable module: libgcrypt
Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

Introduced through: centos@7 › libgcrypt@1.5.3-14.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

Information Exposure vulnerability report

low severity

Information Exposure

Vulnerable module: libgcrypt
Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

Introduced through: centos@7 › libgcrypt@1.5.3-14.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

Information Exposure vulnerability report

low severity

Use After Free

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

vim is vulnerable to Use After Free

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Use After Free vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Remediation

There is no fixed version for Centos:7 ncurses.

References

https://access.redhat.com/security/cve/CVE-2018-10754

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

https://access.redhat.com/security/cve/CVE-2018-10754

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

https://access.redhat.com/security/cve/CVE-2018-10754

NULL Pointer Dereference vulnerability report

low severity

Buffer Under-read

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Buffer Under-read vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Heap-based Buffer Overflow vulnerability report

low severity

Incorrect Permission Assignment for Critical Resource

Vulnerable module: openldap
Introduced through: openldap@2.4.44-22.el7

Detailed paths

Introduced through: centos@7 › openldap@2.4.44-22.el7

NVD Description

/usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between the creation of the certificate, and the chmod to protect it.

Remediation

There is no fixed version for Centos:7 openldap.

References

Incorrect Permission Assignment for Critical Resource vulnerability report

low severity

Improper Input Validation

Vulnerable module: python
Introduced through: python@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python@2.7.5-89.el7

NVD Description

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

Remediation

There is no fixed version for Centos:7 python.

References

Improper Input Validation vulnerability report

low severity

Improper Input Validation

Vulnerable module: python-libs
Introduced through: python-libs@2.7.5-89.el7

Detailed paths

Introduced through: centos@7 › python-libs@2.7.5-89.el7

NVD Description

Remediation

There is no fixed version for Centos:7 python-libs.

References

Improper Input Validation vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability.

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Arbitrary Code Injection

Vulnerable module: glibc
Introduced through: glibc@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc@2.17-317.el7

NVD Description

The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.

Remediation

There is no fixed version for Centos:7 glibc.

References

Arbitrary Code Injection vulnerability report

low severity

Arbitrary Code Injection

Vulnerable module: glibc-common
Introduced through: glibc-common@2.17-317.el7

Detailed paths

Introduced through: centos@7 › glibc-common@2.17-317.el7

NVD Description

Remediation

There is no fixed version for Centos:7 glibc-common.

References

Arbitrary Code Injection vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: ncurses
Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses@5.9-14.20130511.el7_4

NVD Description

Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.

Remediation

There is no fixed version for Centos:7 ncurses.

References

Stack-based Buffer Overflow vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: ncurses-base
Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-base@5.9-14.20130511.el7_4

NVD Description

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

Stack-based Buffer Overflow vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

Introduced through: centos@7 › ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

Stack-based Buffer Overflow vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Integer Overflow or Wraparound vulnerability report

low severity

Integer Overflow or Wraparound

Vulnerable module: vim-minimal
Introduced through: vim-minimal@2:7.4.629-7.el7

Detailed paths

Introduced through: centos@7 › vim-minimal@2:7.4.629-7.el7

NVD Description

vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

Integer Overflow or Wraparound vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: curl
Introduced through: curl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › curl@7.29.0-59.el7

NVD Description

The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.

Remediation

There is no fixed version for Centos:7 curl.

References

Out-of-bounds Read vulnerability report

low severity

Out-of-bounds Read

Vulnerable module: libcurl
Introduced through: libcurl@7.29.0-59.el7

Detailed paths

Introduced through: centos@7 › libcurl@7.29.0-59.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libcurl.

References

Out-of-bounds Read vulnerability report

low severity

Missing Release of Resource after Effective Lifetime

Vulnerable module: device-mapper
Introduced through: device-mapper@7:1.02.170-6.el7

Detailed paths

Introduced through: centos@7 › device-mapper@7:1.02.170-6.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream device-mapper package and not the device-mapper package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. NOTE: RedHat disputes CVE-2020-8991 as not being a vulnerability since there’s no apparent route to either privilege escalation or to denial of service through the bug

Remediation

There is no fixed version for Centos:7 device-mapper.

References

Missing Release of Resource after Effective Lifetime vulnerability report

low severity

Missing Release of Resource after Effective Lifetime

Vulnerable module: device-mapper-libs
Introduced through: device-mapper-libs@7:1.02.170-6.el7

Detailed paths

Introduced through: centos@7 › device-mapper-libs@7:1.02.170-6.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream device-mapper-libs package and not the device-mapper-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Remediation

There is no fixed version for Centos:7 device-mapper-libs.

References

Missing Release of Resource after Effective Lifetime vulnerability report

low severity

Missing Required Cryptographic Step

Vulnerable module: gnupg2
Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

Introduced through: centos@7 › gnupg2@2.0.22-5.el7_5

NVD Description

GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.

Remediation

There is no fixed version for Centos:7 gnupg2.

References

Missing Required Cryptographic Step vulnerability report

low severity

Insecure Temporary File

Vulnerable module: sqlite
Introduced through: sqlite@3.7.17-8.el7_7.1

Detailed paths

Introduced through: centos@7 › sqlite@3.7.17-8.el7_7.1

NVD Description

os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files.

Remediation

There is no fixed version for Centos:7 sqlite.

References

Insecure Temporary File vulnerability report

low severity

Heap-based Buffer Overflow

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write of 8 bytes. This can occur during execution of objdump.

Remediation

There is no fixed version for Centos:7 binutils.

References

Heap-based Buffer Overflow vulnerability report

low severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.27-44.base.el7

Detailed paths

Introduced through: centos@7 › binutils@2.27-44.base.el7

NVD Description

The d_print_comp function in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, which triggers infinite recursion and a buffer overflow, related to a node having "itself as ancestor more than once."

Remediation

There is no fixed version for Centos:7 binutils.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: libgcc
Introduced through: libgcc@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libgcc@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libgcc.

References

Out-of-Bounds vulnerability report

low severity

Out-of-Bounds

Vulnerable module: libstdc++
Introduced through: libstdc++@4.8.5-44.el7

Detailed paths

Introduced through: centos@7 › libstdc++@4.8.5-44.el7

NVD Description

Remediation

There is no fixed version for Centos:7 libstdc++.

References

Out-of-Bounds vulnerability report

Vulnerabilities

Dependencies

Source

Target OS

critical severity

Buffer Overflow

Detailed paths

NVD Description

Remediation

References

critical severity

Buffer Overflow

Detailed paths

NVD Description

Remediation

References

critical severity

Buffer Overflow

Detailed paths

NVD Description

Remediation

References

high severity

Inappropriate Encoding for Output Context

Detailed paths

NVD Description

Remediation

References

high severity

Incorrect Behavior Order: Early Validation

Detailed paths

NVD Description

Remediation

References

high severity

Integer Overflow or Wraparound

Detailed paths

NVD Description

Remediation

References

high severity

Integer Overflow or Wraparound

Detailed paths

NVD Description

Remediation

References

high severity

Integer Overflow or Wraparound

Detailed paths

NVD Description

Remediation

References

high severity

Integer Overflow or Wraparound

Detailed paths

NVD Description

Remediation

References

high severity

Integer Overflow or Wraparound

Detailed paths

NVD Description

Remediation

References

high severity

Integer Overflow or Wraparound

Detailed paths

NVD Description

Remediation

References

high severity

Use After Free

Detailed paths

NVD Description

Remediation

References

high severity

Use After Free

Detailed paths

NVD Description