Vulnerabilities

1359 via 1359 paths

Dependencies

146

Source

Group 6 Copy Created with Sketch. Docker

Target OS

centos:7
Test your Docker Hub image against our market leading vulnerability database Sign up for free
Severity
  • 3
  • 81
  • 666
  • 609
Status
  • 1359
  • 0
  • 0

critical severity

Buffer Overflow

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.67.0-4.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.

Remediation

Upgrade Centos:7 nss to version 0:3.67.0-4.el7_9 or higher.

References

critical severity

Buffer Overflow

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.67.0-4.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.67.0-4.el7_9 or higher.

References

critical severity

Buffer Overflow

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.67.0-4.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.67.0-4.el7_9 or higher.

References

high severity

Inappropriate Encoding for Output Context

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-14.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

high severity

Incorrect Behavior Order: Early Validation

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-14.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

high severity

Integer Overflow or Wraparound

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-14.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

high severity

Integer Overflow or Wraparound

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-14.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

high severity

Integer Overflow or Wraparound

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-14.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

high severity

Integer Overflow or Wraparound

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-14.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

high severity

Integer Overflow or Wraparound

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-14.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

high severity

Integer Overflow or Wraparound

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7
  • Fixed in: 0:2.56.1-9.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption.

Remediation

Upgrade Centos:7 glib2 to version 0:2.56.1-9.el7_9 or higher.

References

high severity

Encoding Error

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-77.el7_6

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-77.el7_6 or higher.

References

high severity

Encoding Error

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-80.el7_6

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-80.el7_6 or higher.

References

high severity

Encoding Error

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-77.el7_6

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-77.el7_6 or higher.

References

high severity

Encoding Error

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-80.el7_6

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-80.el7_6 or higher.

References

high severity

Use After Free

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7
  • Fixed in: 0:219-78.el7_9.7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.

Remediation

Upgrade Centos:7 systemd to version 0:219-78.el7_9.7 or higher.

References

high severity

Use After Free

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7
  • Fixed in: 0:219-78.el7_9.7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.

Remediation

Upgrade Centos:7 systemd-libs to version 0:219-78.el7_9.7 or higher.

References

high severity

SQL Injection

  • Vulnerable module: cyrus-sasl-lib
  • Introduced through: cyrus-sasl-lib@2.1.26-23.el7
  • Fixed in: 0:2.1.26-24.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 cyrus-sasl-lib@2.1.26-23.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream cyrus-sasl-lib package and not the cyrus-sasl-lib package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.

Remediation

Upgrade Centos:7 cyrus-sasl-lib to version 0:2.1.26-24.el7_9 or higher.

References

high severity

Incorrect Calculation

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-14.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

high severity

Integer Overflow or Wraparound

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-14.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

high severity

Integer Overflow or Wraparound

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-14.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

high severity

Integer Overflow or Wraparound

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-14.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

high severity

Incorrect Behavior Order: Early Validation

  • Vulnerable module: gzip
  • Introduced through: gzip@1.5-10.el7
  • Fixed in: 0:1.5-11.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 gzip@1.5-10.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream gzip package and not the gzip package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.

Remediation

Upgrade Centos:7 gzip to version 0:1.5-11.el7_9 or higher.

References

high severity

Integer Overflow or Wraparound

  • Vulnerable module: krb5-libs
  • Introduced through: krb5-libs@1.15.1-34.el7
  • Fixed in: 0:1.15.1-55.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 krb5-libs@1.15.1-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

Remediation

Upgrade Centos:7 krb5-libs to version 0:1.15.1-55.el7_9 or higher.

References

high severity

Out-of-Bounds

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.79.0-5.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Remediation

Upgrade Centos:7 nss to version 0:3.79.0-5.el7_9 or higher.

References

high severity

Out-of-Bounds

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.79.0-5.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.79.0-5.el7_9 or higher.

References

high severity

Out-of-Bounds

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.79.0-5.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.79.0-5.el7_9 or higher.

References

high severity

Out-of-bounds Write

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7
  • Fixed in: 0:3.7.17-8.el7_7.1

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade Centos:7 sqlite to version 0:3.7.17-8.el7_7.1 or higher.

References

high severity

Incorrect Calculation of Buffer Size

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7
  • Fixed in: 0:219-62.el7_6.2

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239.

Remediation

Upgrade Centos:7 systemd to version 0:219-62.el7_6.2 or higher.

References

high severity

Incorrect Calculation of Buffer Size

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7
  • Fixed in: 0:219-62.el7_6.2

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239.

Remediation

Upgrade Centos:7 systemd-libs to version 0:219-62.el7_6.2 or higher.

References

high severity

Incorrect Behavior Order: Early Validation

  • Vulnerable module: xz
  • Introduced through: xz@5.2.2-1.el7
  • Fixed in: 0:5.2.2-2.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 xz@5.2.2-1.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream xz package and not the xz package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.

Remediation

Upgrade Centos:7 xz to version 0:5.2.2-2.el7_9 or higher.

References

high severity

Incorrect Behavior Order: Early Validation

  • Vulnerable module: xz-libs
  • Introduced through: xz-libs@5.2.2-1.el7
  • Fixed in: 0:5.2.2-2.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 xz-libs@5.2.2-1.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream xz-libs package and not the xz-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.

Remediation

Upgrade Centos:7 xz-libs to version 0:5.2.2-2.el7_9 or higher.

References

high severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.9.4-74.el7_6.1

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of simultaneous connections contained an error which could be exploited to grow the number of simultaneous connections beyond this limit. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.6, 9.12.0 -> 9.12.4, 9.14.0. BIND 9 Supported Preview Edition versions 9.9.3-S1 -> 9.11.5-S3, and 9.11.5-S5. Versions 9.13.0 -> 9.13.7 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5743.

Remediation

Upgrade Centos:7 bind-license to version 32:9.9.4-74.el7_6.1 or higher.

References

high severity

Resource Exhaustion

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-16.P2.el7_8.6

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-16.P2.el7_8.6 or higher.

References

high severity

Authentication Bypass by Primary Weakness

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-94.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)

Remediation

Upgrade Centos:7 python to version 0:2.7.5-94.el7_9 or higher.

References

high severity

Authentication Bypass by Primary Weakness

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-94.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-94.el7_9 or higher.

References

high severity

Out-of-Bounds

  • Vulnerable module: zlib
  • Introduced through: zlib@1.2.7-18.el7
  • Fixed in: 0:1.2.7-20.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 zlib@1.2.7-18.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

Remediation

Upgrade Centos:7 zlib to version 0:1.2.7-20.el7_9 or higher.

References

high severity

Out-of-Bounds

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-26.P2.el7_9.4

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.4 or higher.

References

high severity

Use After Free

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-15.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-15.el7_9 or higher.

References

high severity

Out-of-bounds Write

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.44.0-7.el7_7

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Remediation

Upgrade Centos:7 nss to version 0:3.44.0-7.el7_7 or higher.

References

high severity

Out-of-bounds Write

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5
  • Fixed in: 0:3.44.0-8.el7_7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Remediation

Upgrade Centos:7 nss-softokn to version 0:3.44.0-8.el7_7 or higher.

References

high severity

Out-of-bounds Write

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5
  • Fixed in: 0:3.44.0-8.el7_7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Remediation

Upgrade Centos:7 nss-softokn-freebl to version 0:3.44.0-8.el7_7 or higher.

References

high severity

Out-of-bounds Write

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.44.0-7.el7_7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.44.0-7.el7_7 or higher.

References

high severity

Out-of-bounds Write

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.44.0-7.el7_7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.44.0-7.el7_7 or higher.

References

high severity

Out-of-bounds Write

  • Vulnerable module: nss-util
  • Introduced through: nss-util@3.36.0-1.el7_5
  • Fixed in: 0:3.44.0-4.el7_7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-util@3.36.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-util package and not the nss-util package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Remediation

Upgrade Centos:7 nss-util to version 0:3.44.0-4.el7_7 or higher.

References

high severity

Integer Overflow or Wraparound

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-14.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-14.el7_9 or higher.

References

high severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-26.P2.el7_9.14

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Every named instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the max-cache-size statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit.

It has been discovered that the effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.14 or higher.

References

high severity

Improper Input Validation

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-26.P2.el7_9.15

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing named to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.15 or higher.

References

high severity

Memory Leak

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-26.P2.el7_9.10

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.10 or higher.

References

high severity

Memory Leak

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-26.P2.el7_9.10

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.10 or higher.

References

high severity

Reachable Assertion

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-16.P2.el7_8.6

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-16.P2.el7_8.6 or higher.

References

high severity

Reachable Assertion

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-26.P2.el7_9.5

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.5 or higher.

References

high severity

Reachable Assertion

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw in query-handling code can cause named to exit prematurely with an assertion failure when:

  • nxdomain-redirect &lt;domain&gt;; is configured, and
  • the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

Remediation

There is no fixed version for Centos:7 bind-license.

References

high severity

Resource Exhaustion

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected named instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

Remediation

There is no fixed version for Centos:7 bind-license.

References

high severity

Resource Exhaustion

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

Remediation

There is no fixed version for Centos:7 bind-license.

References

high severity

Resource Exhaustion

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, named may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1.

Remediation

There is no fixed version for Centos:7 bind-license.

References

high severity

Resource Exhaustion

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Remediation

There is no fixed version for Centos:7 bind-license.

References

high severity

Integer Overflow or Wraparound

  • Vulnerable module: libssh2
  • Introduced through: libssh2@1.4.3-12.el7
  • Fixed in: 0:1.4.3-12.el7_6.2

Detailed paths

  • Introduced through: centos@7.6.1810 libssh2@1.4.3-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in libssh2 before 1.8.1. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used as an index to copy memory causing in an out of bounds memory write error.

Remediation

Upgrade Centos:7 libssh2 to version 0:1.4.3-12.el7_6.2 or higher.

References

high severity

Integer Overflow or Wraparound

  • Vulnerable module: libssh2
  • Introduced through: libssh2@1.4.3-12.el7
  • Fixed in: 0:1.4.3-12.el7_6.2

Detailed paths

  • Introduced through: centos@7.6.1810 libssh2@1.4.3-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

Remediation

Upgrade Centos:7 libssh2 to version 0:1.4.3-12.el7_6.2 or higher.

References

high severity

Integer Overflow or Wraparound

  • Vulnerable module: libssh2
  • Introduced through: libssh2@1.4.3-12.el7
  • Fixed in: 0:1.4.3-12.el7_6.2

Detailed paths

  • Introduced through: centos@7.6.1810 libssh2@1.4.3-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

Remediation

Upgrade Centos:7 libssh2 to version 0:1.4.3-12.el7_6.2 or higher.

References

high severity

Integer Overflow or Wraparound

  • Vulnerable module: libssh2
  • Introduced through: libssh2@1.4.3-12.el7
  • Fixed in: 0:1.4.3-12.el7_6.2

Detailed paths

  • Introduced through: centos@7.6.1810 libssh2@1.4.3-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

Remediation

Upgrade Centos:7 libssh2 to version 0:1.4.3-12.el7_6.2 or higher.

References

high severity

Buffer Overflow

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.44.0-7.el7_7

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Remediation

Upgrade Centos:7 nss to version 0:3.44.0-7.el7_7 or higher.

References

high severity

Buffer Overflow

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5
  • Fixed in: 0:3.44.0-8.el7_7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Remediation

Upgrade Centos:7 nss-softokn to version 0:3.44.0-8.el7_7 or higher.

References

high severity

Buffer Overflow

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5
  • Fixed in: 0:3.44.0-8.el7_7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Remediation

Upgrade Centos:7 nss-softokn-freebl to version 0:3.44.0-8.el7_7 or higher.

References

high severity

Buffer Overflow

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.44.0-7.el7_7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.44.0-7.el7_7 or higher.

References

high severity

Buffer Overflow

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.44.0-7.el7_7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.44.0-7.el7_7 or higher.

References

high severity

Buffer Overflow

  • Vulnerable module: nss-util
  • Introduced through: nss-util@3.36.0-1.el7_5
  • Fixed in: 0:3.44.0-4.el7_7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-util@3.36.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-util package and not the nss-util package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Remediation

Upgrade Centos:7 nss-util to version 0:3.44.0-4.el7_7 or higher.

References

high severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7
  • Fixed in: 1:1.0.2k-25.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-25.el7_9 or higher.

References

high severity

Improper Input Validation

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-93.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-93.el7_9 or higher.

References

high severity

Improper Input Validation

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-93.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-93.el7_9 or higher.

References

high severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7
  • Fixed in: 0:219-62.el7_6.2

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.

Remediation

Upgrade Centos:7 systemd to version 0:219-62.el7_6.2 or higher.

References

high severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7
  • Fixed in: 0:219-62.el7_6.2

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.

Remediation

Upgrade Centos:7 systemd-libs to version 0:219-62.el7_6.2 or higher.

References

high severity

Incorrect Type Conversion or Cast

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7
  • Fixed in: 1:1.0.2k-26.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.

When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-26.el7_9 or higher.

References

high severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7
  • Fixed in: 0:219-62.el7_6.2

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.

Remediation

Upgrade Centos:7 systemd to version 0:219-62.el7_6.2 or higher.

References

high severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7
  • Fixed in: 0:219-62.el7_6.2

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.

Remediation

Upgrade Centos:7 systemd-libs to version 0:219-62.el7_6.2 or higher.

References

high severity

Improper Input Validation

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7
  • Fixed in: 0:219-62.el7_6.5

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).

Remediation

Upgrade Centos:7 systemd to version 0:219-62.el7_6.5 or higher.

References

high severity

Improper Input Validation

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7
  • Fixed in: 0:219-62.el7_6.5

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).

Remediation

Upgrade Centos:7 systemd-libs to version 0:219-62.el7_6.5 or higher.

References

high severity

Resource Exhaustion

  • Vulnerable module: dbus
  • Introduced through: dbus@1:1.10.24-12.el7
  • Fixed in: 1:1.10.24-14.el7_8

Detailed paths

  • Introduced through: centos@7.6.1810 dbus@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.

Remediation

Upgrade Centos:7 dbus to version 1:1.10.24-14.el7_8 or higher.

References

high severity

Resource Exhaustion

  • Vulnerable module: dbus-libs
  • Introduced through: dbus-libs@1:1.10.24-12.el7
  • Fixed in: 1:1.10.24-14.el7_8

Detailed paths

  • Introduced through: centos@7.6.1810 dbus-libs@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.

Remediation

Upgrade Centos:7 dbus-libs to version 1:1.10.24-14.el7_8 or higher.

References

high severity

NULL Pointer Dereference

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7
  • Fixed in: 1:1.0.2k-21.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-21.el7_9 or higher.

References

high severity

Not Failing Securely ('Failing Open')

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

Remediation

There is no fixed version for Centos:7 nss.

References

high severity

Not Failing Securely ('Failing Open')

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

high severity

Not Failing Securely ('Failing Open')

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

Remediation

There is no fixed version for Centos:7 nss-tools.

References

high severity

Arbitrary Code Injection

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7
  • Fixed in: 2:7.4.160-6.el7_6

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.

Remediation

Upgrade Centos:7 vim-minimal to version 2:7.4.160-6.el7_6 or higher.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Remediation

There is no fixed version for Centos:7 glibc.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

medium severity

Use After Free

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.4

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.

Remediation

Upgrade Centos:7 libxml2 to version 0:2.9.1-6.el7.4 or higher.

References

medium severity

Use After Free

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.4

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade Centos:7 libxml2 to version 0:2.9.1-6.el7.4 or higher.

References

medium severity

Use After Free

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.4

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.

Remediation

Upgrade Centos:7 libxml2-python to version 0:2.9.1-6.el7.4 or higher.

References

medium severity

Use After Free

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.4

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade Centos:7 libxml2-python to version 0:2.9.1-6.el7.4 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

Privilege Context Switching Error

  • Vulnerable module: coreutils
  • Introduced through: coreutils@8.22-23.el7

Detailed paths

  • Introduced through: centos@7.6.1810 coreutils@8.22-23.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream coreutils package and not the coreutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for Centos:7 coreutils.

References

medium severity

Privilege Context Switching Error

  • Vulnerable module: libblkid
  • Introduced through: libblkid@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libblkid@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libblkid package and not the libblkid package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for Centos:7 libblkid.

References

medium severity

Privilege Context Switching Error

  • Vulnerable module: libmount
  • Introduced through: libmount@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libmount@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libmount package and not the libmount package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for Centos:7 libmount.

References

medium severity

Privilege Context Switching Error

  • Vulnerable module: libuuid
  • Introduced through: libuuid@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libuuid@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libuuid package and not the libuuid package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for Centos:7 libuuid.

References

medium severity

Out-of-bounds Write

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Use After Free

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Out-of-bounds Write

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Use After Free

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: lz4
  • Introduced through: lz4@1.7.5-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 lz4@1.7.5-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream lz4 package and not the lz4 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

Remediation

There is no fixed version for Centos:7 lz4.

References

medium severity

Privilege Context Switching Error

  • Vulnerable module: util-linux
  • Introduced through: util-linux@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 util-linux@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for Centos:7 util-linux.

References

medium severity

Inappropriate Encoding for Output Context

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7
  • Fixed in: 0:2.27-44.base.el7_9.1

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements of bidirectional text can further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such that the ordering of tokens perceived by human reviewers does not match what will be processed by a compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.

Remediation

Upgrade Centos:7 binutils to version 0:2.27-44.base.el7_9.1 or higher.

References

medium severity

Inappropriate Encoding for Output Context

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allows an adversary to produce source code identifiers such as function names using homoglyphs that render visually identical to a target identifier. Adversaries can leverage this to inject code via adversarial identifier definitions in upstream software dependencies invoked deceptively in downstream software. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard (all versions). Unless mitigated, an adversary could produce source code identifiers using homoglyph characters that render visually identical to but are distinct from a target identifier. In this way, an adversary could inject adversarial identifier definitions in upstream software that are not detected by human reviewers and are invoked deceptively in downstream software. The Unicode Consortium has documented this class of security vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms.

Remediation

There is no fixed version for Centos:7 libgcc.

References

medium severity

Inappropriate Encoding for Output Context

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements of bidirectional text can further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such that the ordering of tokens perceived by human reviewers does not match what will be processed by a compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.

Remediation

There is no fixed version for Centos:7 libgcc.

References

medium severity

Inappropriate Encoding for Output Context

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allows an adversary to produce source code identifiers such as function names using homoglyphs that render visually identical to a target identifier. Adversaries can leverage this to inject code via adversarial identifier definitions in upstream software dependencies invoked deceptively in downstream software. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard (all versions). Unless mitigated, an adversary could produce source code identifiers using homoglyph characters that render visually identical to but are distinct from a target identifier. In this way, an adversary could inject adversarial identifier definitions in upstream software that are not detected by human reviewers and are invoked deceptively in downstream software. The Unicode Consortium has documented this class of security vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

medium severity

Inappropriate Encoding for Output Context

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements of bidirectional text can further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such that the ordering of tokens perceived by human reviewers does not match what will be processed by a compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

medium severity

Release of Invalid Pointer or Reference

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when --no-clobber is used together with --remove-on-error.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Release of Invalid Pointer or Reference

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when --no-clobber is used together with --remove-on-error.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Use After Free

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Use After Free

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: lz4
  • Introduced through: lz4@1.7.5-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 lz4@1.7.5-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream lz4 package and not the lz4 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Remediation

There is no fixed version for Centos:7 lz4.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: nspr
  • Introduced through: nspr@4.19.0-1.el7_5
  • Fixed in: 0:4.25.0-2.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nspr@4.19.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nspr package and not the nspr package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.

Remediation

Upgrade Centos:7 nspr to version 0:4.25.0-2.el7_9 or higher.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.

Remediation

Upgrade Centos:7 nss to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.

Remediation

Upgrade Centos:7 nss-softokn to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.

Remediation

Upgrade Centos:7 nss-softokn-freebl to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: nss-util
  • Introduced through: nss-util@3.36.0-1.el7_5
  • Fixed in: 0:3.53.1-1.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-util@3.36.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-util package and not the nss-util package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.

Remediation

Upgrade Centos:7 nss-util to version 0:3.53.1-1.el7_9 or higher.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Out-of-Bounds

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

Improper Neutralization of Special Elements

  • Vulnerable module: bash
  • Introduced through: bash@4.2.46-31.el7
  • Fixed in: 0:4.2.46-34.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bash@4.2.46-31.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bash package and not the bash package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.

Remediation

Upgrade Centos:7 bash to version 0:4.2.46-34.el7 or higher.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7
  • Fixed in: 0:2.27-41.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f.

Remediation

Upgrade Centos:7 binutils to version 0:2.27-41.base.el7 or higher.

References

medium severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.

Remediation

There is no fixed version for Centos:7 binutils.

References

medium severity

Use After Free

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: json-c
  • Introduced through: json-c@0.11-4.el7_0

Detailed paths

  • Introduced through: centos@7.6.1810 json-c@0.11-4.el7_0

NVD Description

Note: Versions mentioned in the description apply only to the upstream json-c package and not the json-c package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.

Remediation

There is no fixed version for Centos:7 json-c.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: libcap
  • Introduced through: libcap@2.22-9.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcap@2.22-9.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcap package and not the libcap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB.

Remediation

There is no fixed version for Centos:7 libcap.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: libcom_err
  • Introduced through: libcom_err@1.42.9-13.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcom_err@1.42.9-13.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcom_err package and not the libcom_err package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.

Remediation

There is no fixed version for Centos:7 libcom_err.

References

medium severity

Double Free

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Use After Free

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Double Free

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Use After Free

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Out-of-bounds Write

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

Remediation

There is no fixed version for Centos:7 ncurses.

References

medium severity

Out-of-bounds Write

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

medium severity

Out-of-bounds Write

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

medium severity

XML External Entity (XXE) Injection

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

XML External Entity (XXE) Injection

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Out-of-Bounds

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

vim is vulnerable to Heap-based Buffer Overflow

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

medium severity

Out-of-bounds Write

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

medium severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

medium severity

Resource Exhaustion

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-16.P2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-16.P2.el7 or higher.

References

medium severity

Resource Exhaustion

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-26.P2.el7_9.2

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.2 or higher.

References

medium severity

Cleartext Transmission of Sensitive Information

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (--ssl-reqd on the command line orCURLOPT_USE_SSL set to CURLUSESSL_CONTROL or CURLUSESSL_ALL withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations withoutTLS contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Cleartext Transmission of Sensitive Information

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Improper Certificate Validation

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Inappropriate Encoding for Output Context

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a different URL usingthe wrong host name when it is later retrieved.For example, a URL like http://example.com%2F127.0.0.1/, would be allowed bythe parser and get transposed into http://example.com/127.0.0.1/. This flawcan be used to circumvent filters, checks and more.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity
new

Missing Release of Resource after Effective Lifetime

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Resource Exhaustion

  • Vulnerable module: cyrus-sasl-lib
  • Introduced through: cyrus-sasl-lib@2.1.26-23.el7

Detailed paths

  • Introduced through: centos@7.6.1810 cyrus-sasl-lib@2.1.26-23.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream cyrus-sasl-lib package and not the cyrus-sasl-lib package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.

Remediation

There is no fixed version for Centos:7 cyrus-sasl-lib.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-12.el7 or higher.

References

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

Remediation

There is no fixed version for Centos:7 expat.

References

medium severity

Resource Exhaustion

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-12.el7 or higher.

References

medium severity

Resource Exhaustion

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

Remediation

There is no fixed version for Centos:7 expat.

References

medium severity

Use After Free

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

Remediation

There is no fixed version for Centos:7 expat.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.

Remediation

There is no fixed version for Centos:7 glib2.

References

medium severity

Improper Input Validation

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.

Remediation

There is no fixed version for Centos:7 glibc.

References

medium severity

Memory Leak

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.

Remediation

There is no fixed version for Centos:7 glibc.

References

medium severity

Resource Exhaustion

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The xdr_bytes and xdr_string functions in the GNU C Library (aka glibc or libc6) 2.25 mishandle failures of buffer deserialization, which allows remote attackers to cause a denial of service (virtual memory allocation, or memory consumption if an overcommit setting is not used) via a crafted UDP packet to port 111, a related issue to CVE-2017-8779. NOTE: [Information provided from upstream and references

Remediation

There is no fixed version for Centos:7 glibc.

References

medium severity

Stack-based Buffer Overflow

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7
  • Fixed in: 0:2.17-322.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of "Fixed for glibc 2.33" in the 26649 reference.

Remediation

Upgrade Centos:7 glibc to version 0:2.17-322.el7_9 or higher.

References

medium severity

Improper Input Validation

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

medium severity

Memory Leak

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

medium severity

Resource Exhaustion

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The xdr_bytes and xdr_string functions in the GNU C Library (aka glibc or libc6) 2.25 mishandle failures of buffer deserialization, which allows remote attackers to cause a denial of service (virtual memory allocation, or memory consumption if an overcommit setting is not used) via a crafted UDP packet to port 111, a related issue to CVE-2017-8779. NOTE: [Information provided from upstream and references

Remediation

There is no fixed version for Centos:7 glibc-common.

References

medium severity

Stack-based Buffer Overflow

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7
  • Fixed in: 0:2.17-322.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of "Fixed for glibc 2.33" in the 26649 reference.

Remediation

Upgrade Centos:7 glibc-common to version 0:2.17-322.el7_9 or higher.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: krb5-libs
  • Introduced through: krb5-libs@1.15.1-34.el7

Detailed paths

  • Introduced through: centos@7.6.1810 krb5-libs@1.15.1-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

medium severity

Uncontrolled Recursion

  • Vulnerable module: krb5-libs
  • Introduced through: krb5-libs@1.15.1-34.el7

Detailed paths

  • Introduced through: centos@7.6.1810 krb5-libs@1.15.1-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

medium severity

Out-of-bounds Write

  • Vulnerable module: libcom_err
  • Introduced through: libcom_err@1.42.9-13.el7
  • Fixed in: 0:1.42.9-19.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcom_err@1.42.9-13.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcom_err package and not the libcom_err package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Remediation

Upgrade Centos:7 libcom_err to version 0:1.42.9-19.el7 or higher.

References

medium severity

Cleartext Transmission of Sensitive Information

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (--ssl-reqd on the command line orCURLOPT_USE_SSL set to CURLUSESSL_CONTROL or CURLUSESSL_ALL withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations withoutTLS contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Cleartext Transmission of Sensitive Information

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Improper Certificate Validation

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Inappropriate Encoding for Output Context

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a different URL usingthe wrong host name when it is later retrieved.For example, a URL like http://example.com%2F127.0.0.1/, would be allowed bythe parser and get transposed into http://example.com/127.0.0.1/. This flawcan be used to circumvent filters, checks and more.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity
new

Missing Release of Resource after Effective Lifetime

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Improper Certificate Validation

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

Remediation

There is no fixed version for Centos:7 libgcc.

References

medium severity

Improper Input Validation

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

medium severity

Improper Input Validation

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

Remediation

There is no fixed version for Centos:7 libgcc.

References

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Remediation

There is no fixed version for Centos:7 libgcc.

References

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.

Remediation

There is no fixed version for Centos:7 libgcc.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: libgcrypt
  • Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcrypt@1.5.3-14.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt package and not the libgcrypt package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: libssh2
  • Introduced through: libssh2@1.4.3-12.el7
  • Fixed in: 0:1.8.0-4.el7_9.1

Detailed paths

  • Introduced through: centos@7.6.1810 libssh2@1.4.3-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory.

Remediation

Upgrade Centos:7 libssh2 to version 0:1.8.0-4.el7_9.1 or higher.

References

medium severity

Improper Certificate Validation

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

medium severity

Improper Input Validation

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

medium severity

Improper Input Validation

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

medium severity

Uncontrolled Recursion

  • Vulnerable module: libtasn1
  • Introduced through: libtasn1@4.10-1.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libtasn1@4.10-1.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libtasn1 package and not the libtasn1 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.

Remediation

There is no fixed version for Centos:7 libtasn1.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.5

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

Remediation

Upgrade Centos:7 libxml2 to version 0:2.9.1-6.el7.5 or higher.

References

medium severity

Memory Leak

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.5

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

Remediation

Upgrade Centos:7 libxml2 to version 0:2.9.1-6.el7.5 or higher.

References

medium severity

Missing Release of Resource after Effective Lifetime

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.5

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.

Remediation

Upgrade Centos:7 libxml2 to version 0:2.9.1-6.el7.5 or higher.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Use After Free

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.5

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

Remediation

Upgrade Centos:7 libxml2-python to version 0:2.9.1-6.el7.5 or higher.

References

medium severity

Memory Leak

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.5

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

Remediation

Upgrade Centos:7 libxml2-python to version 0:2.9.1-6.el7.5 or higher.

References

medium severity

Missing Release of Resource after Effective Lifetime

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.5

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.

Remediation

Upgrade Centos:7 libxml2-python to version 0:2.9.1-6.el7.5 or higher.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Use After Free

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: nspr
  • Introduced through: nspr@4.19.0-1.el7_5
  • Fixed in: 0:4.21.0-1.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nspr@4.19.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nspr package and not the nspr package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.

Remediation

Upgrade Centos:7 nspr to version 0:4.21.0-1.el7 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: nspr
  • Introduced through: nspr@4.19.0-1.el7_5
  • Fixed in: 0:4.25.0-2.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nspr@4.19.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nspr package and not the nspr package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Remediation

Upgrade Centos:7 nspr to version 0:4.25.0-2.el7_9 or higher.

References

medium severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-7.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.

Remediation

Upgrade Centos:7 nss to version 0:3.53.1-7.el7_9 or higher.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.44.0-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.

Remediation

Upgrade Centos:7 nss to version 0:3.44.0-4.el7 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Remediation

Upgrade Centos:7 nss to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

Remediation

There is no fixed version for Centos:7 nss.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5
  • Fixed in: 0:3.44.0-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.

Remediation

Upgrade Centos:7 nss-softokn to version 0:3.44.0-5.el7 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Remediation

Upgrade Centos:7 nss-softokn to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5
  • Fixed in: 0:3.44.0-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.

Remediation

Upgrade Centos:7 nss-softokn-freebl to version 0:3.44.0-5.el7 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Remediation

Upgrade Centos:7 nss-softokn-freebl to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-7.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.53.1-7.el7_9 or higher.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.44.0-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.44.0-4.el7 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

medium severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-7.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.53.1-7.el7_9 or higher.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.44.0-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.44.0-4.el7 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

Remediation

There is no fixed version for Centos:7 nss-tools.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: nss-util
  • Introduced through: nss-util@3.36.0-1.el7_5
  • Fixed in: 0:3.44.0-3.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-util@3.36.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-util package and not the nss-util package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.

Remediation

Upgrade Centos:7 nss-util to version 0:3.44.0-3.el7 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: nss-util
  • Introduced through: nss-util@3.36.0-1.el7_5
  • Fixed in: 0:3.53.1-1.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-util@3.36.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-util package and not the nss-util package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Remediation

Upgrade Centos:7 nss-util to version 0:3.53.1-1.el7_9 or higher.

References

medium severity

Access of Resource Using Incompatible Type ('Type Confusion')

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

medium severity

Improper Handling of Length Parameter Inconsistency

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).

Remediation

There is no fixed version for Centos:7 openldap.

References

medium severity

Integer Underflow

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7
  • Fixed in: 0:2.4.44-23.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service.

Remediation

Upgrade Centos:7 openldap to version 0:2.4.44-23.el7_9 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read).

Remediation

There is no fixed version for Centos:7 openldap.

References

medium severity

Reachable Assertion

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7
  • Fixed in: 0:2.4.44-25.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.

Remediation

Upgrade Centos:7 openldap to version 0:2.4.44-25.el7_9 or higher.

References

medium severity

Reachable Assertion

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7
  • Fixed in: 0:2.4.44-25.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability.

Remediation

Upgrade Centos:7 openldap to version 0:2.4.44-25.el7_9 or higher.

References

medium severity

Reachable Assertion

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

medium severity

Reachable Assertion

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

medium severity

Release of Invalid Pointer or Reference

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

medium severity

Release of Invalid Pointer or Reference

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

Remediation

There is no fixed version for Centos:7 openldap.

References

medium severity

Resource Exhaustion

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime.

Remediation

There is no fixed version for Centos:7 openldap.

References

medium severity

Resource Exhaustion

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7
  • Fixed in: 0:2.4.44-22.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

Remediation

Upgrade Centos:7 openldap to version 0:2.4.44-22.el7 or higher.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7
  • Fixed in: 1:1.0.2k-22.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-22.el7_9 or higher.

References

medium severity

Use After Free

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.

The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash.

This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.

Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream.

The OpenSSL cms and smime command line applications are similarly affected.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: p11-kit
  • Introduced through: p11-kit@0.23.5-3.el7

Detailed paths

  • Introduced through: centos@7.6.1810 p11-kit@0.23.5-3.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream p11-kit package and not the p11-kit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc.

Remediation

There is no fixed version for Centos:7 p11-kit.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: p11-kit-trust
  • Introduced through: p11-kit-trust@0.23.5-3.el7

Detailed paths

  • Introduced through: centos@7.6.1810 p11-kit-trust@0.23.5-3.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream p11-kit-trust package and not the p11-kit-trust package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc.

Remediation

There is no fixed version for Centos:7 p11-kit-trust.

References

medium severity

Improper Input Validation

  • Vulnerable module: pcre
  • Introduced through: pcre@8.32-17.el7

Detailed paths

  • Introduced through: centos@7.6.1810 pcre@8.32-17.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre package and not the pcre package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup.

Remediation

There is no fixed version for Centos:7 pcre.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: pcre
  • Introduced through: pcre@8.32-17.el7

Detailed paths

  • Introduced through: centos@7.6.1810 pcre@8.32-17.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre package and not the pcre package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.

Remediation

There is no fixed version for Centos:7 pcre.

References

medium severity

Eval Injection

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

Improper Input Validation

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-90.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-90.el7 or higher.

References

medium severity

Incorrect Type Conversion or Cast

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-86.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-86.el7 or higher.

References

medium severity

Resource Exhaustion

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

Uncontrolled Recursion

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

Use After Free

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use-after-free exists in Python through 3.9 via heappushpop in heapq.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

Eval Injection

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Improper Input Validation

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-90.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-90.el7 or higher.

References

medium severity

Incorrect Type Conversion or Cast

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-86.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-86.el7 or higher.

References

medium severity

Resource Exhaustion

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Uncontrolled Recursion

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Use After Free

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use-after-free exists in Python through 3.9 via heappushpop in heapq.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Improper Input Validation

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

Unchecked Error Condition

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

Off-by-one Error

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

Remediation

There is no fixed version for Centos:7 glibc.

References

medium severity

Off-by-one Error

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

medium severity

Arbitrary Command Injection

  • Vulnerable module: libblkid
  • Introduced through: libblkid@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libblkid@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libblkid package and not the libblkid package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Remediation

There is no fixed version for Centos:7 libblkid.

References

medium severity

Arbitrary Command Injection

  • Vulnerable module: libmount
  • Introduced through: libmount@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libmount@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libmount package and not the libmount package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Remediation

There is no fixed version for Centos:7 libmount.

References

medium severity

Arbitrary Command Injection

  • Vulnerable module: libuuid
  • Introduced through: libuuid@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libuuid@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libuuid package and not the libuuid package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Remediation

There is no fixed version for Centos:7 libuuid.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: nspr
  • Introduced through: nspr@4.19.0-1.el7_5
  • Fixed in: 0:4.25.0-2.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nspr@4.19.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nspr package and not the nspr package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Remediation

Upgrade Centos:7 nspr to version 0:4.25.0-2.el7_9 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Remediation

Upgrade Centos:7 nss to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Remediation

Upgrade Centos:7 nss-softokn to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Remediation

Upgrade Centos:7 nss-softokn-freebl to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: nss-util
  • Introduced through: nss-util@3.36.0-1.el7_5
  • Fixed in: 0:3.53.1-1.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-util@3.36.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-util package and not the nss-util package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Remediation

Upgrade Centos:7 nss-util to version 0:3.53.1-1.el7_9 or higher.

References

medium severity

Improper Access Control

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.

Remediation

There is no fixed version for Centos:7 openldap.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7
  • Fixed in: 1:1.0.2k-23.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-23.el7_9 or higher.

References

medium severity

Exposed Dangerous Method or Function

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-86.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-86.el7 or higher.

References

medium severity

Exposed Dangerous Method or Function

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-86.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-86.el7 or higher.

References

medium severity

Arbitrary Command Injection

  • Vulnerable module: util-linux
  • Introduced through: util-linux@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 util-linux@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Remediation

There is no fixed version for Centos:7 util-linux.

References

medium severity

Improper Handling of Length Parameter Inconsistency

  • Vulnerable module: libssh2
  • Introduced through: libssh2@1.4.3-12.el7
  • Fixed in: 0:1.4.3-12.el7_6.3

Detailed paths

  • Introduced through: centos@7.6.1810 libssh2@1.4.3-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Remediation

Upgrade Centos:7 libssh2 to version 0:1.4.3-12.el7_6.3 or higher.

References

medium severity

Improper Input Validation

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-88.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-88.el7 or higher.

References

medium severity

Improper Input Validation

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-88.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-88.el7 or higher.

References

medium severity

Link Following

  • Vulnerable module: rpm
  • Introduced through: rpm@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm package and not the rpm package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.

Remediation

There is no fixed version for Centos:7 rpm.

References

medium severity

Link Following

  • Vulnerable module: rpm
  • Introduced through: rpm@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm package and not the rpm package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.

Remediation

There is no fixed version for Centos:7 rpm.

References

medium severity

Link Following

  • Vulnerable module: rpm-build-libs
  • Introduced through: rpm-build-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-build-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-build-libs package and not the rpm-build-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

medium severity

Link Following

  • Vulnerable module: rpm-build-libs
  • Introduced through: rpm-build-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-build-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-build-libs package and not the rpm-build-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

medium severity

Link Following

  • Vulnerable module: rpm-libs
  • Introduced through: rpm-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-libs package and not the rpm-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

medium severity

Link Following

  • Vulnerable module: rpm-libs
  • Introduced through: rpm-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-libs package and not the rpm-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

medium severity

Link Following

  • Vulnerable module: rpm-python
  • Introduced through: rpm-python@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-python@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-python package and not the rpm-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.

Remediation

There is no fixed version for Centos:7 rpm-python.

References

medium severity

Link Following

  • Vulnerable module: rpm-python
  • Introduced through: rpm-python@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-python@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-python package and not the rpm-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.

Remediation

There is no fixed version for Centos:7 rpm-python.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

medium severity

Out-of-bounds Write

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

medium severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

vim is vulnerable to Use After Free

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

medium severity

Insufficient Verification of Data Authenticity

  • Vulnerable module: krb5-libs
  • Introduced through: krb5-libs@1.15.1-34.el7

Detailed paths

  • Introduced through: centos@7.6.1810 krb5-libs@1.15.1-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

<p>A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD).</p> <p>To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it.</p> <p>The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.</p>

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

medium severity

Stack-based Buffer Overflow

  • Vulnerable module: krb5-libs
  • Introduced through: krb5-libs@1.15.1-34.el7

Detailed paths

  • Introduced through: centos@7.6.1810 krb5-libs@1.15.1-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

medium severity

Use After Free

  • Vulnerable module: nspr
  • Introduced through: nspr@4.19.0-1.el7_5
  • Fixed in: 0:4.25.0-2.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nspr@4.19.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nspr package and not the nspr package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.

Remediation

Upgrade Centos:7 nspr to version 0:4.25.0-2.el7_9 or higher.

References

medium severity

Use After Free

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.

Remediation

Upgrade Centos:7 nss to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use After Free

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.

Remediation

Upgrade Centos:7 nss-softokn to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Use After Free

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.

Remediation

Upgrade Centos:7 nss-softokn-freebl to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Use After Free

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use After Free

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use After Free

  • Vulnerable module: nss-util
  • Introduced through: nss-util@3.36.0-1.el7_5
  • Fixed in: 0:3.53.1-1.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-util@3.36.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-util package and not the nss-util package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.

Remediation

Upgrade Centos:7 nss-util to version 0:3.53.1-1.el7_9 or higher.

References

medium severity

CVE-2023-26604

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

Remediation

There is no fixed version for Centos:7 systemd.

References

medium severity

CVE-2023-26604

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

medium severity

Out-of-Bounds

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: bash
  • Introduced through: bash@4.2.46-31.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bash@4.2.46-31.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bash package and not the bash package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, are printed through the echo built-in function. A local attacker, who can provide data to print through the "echo -e" built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr() in lib/sh/strtrans.c mishandles u32cconv().

Remediation

There is no fixed version for Centos:7 bash.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

readelf in GNU Binutils 2.28 writes to illegal addresses while processing corrupt input files containing symbol-difference relocations, leading to a heap-based buffer overflow.

Remediation

There is no fixed version for Centos:7 binutils.

References

medium severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in bfd_getl64.

Remediation

There is no fixed version for Centos:7 binutils.

References

medium severity

Out-of-bounds Write

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and availability.

Remediation

There is no fixed version for Centos:7 binutils.

References

medium severity

Use After Free

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

readelf in GNU Binutils 2.28 has a use-after-free (specifically read-after-free) error while processing multiple, relocated sections in an MSP430 binary. This is caused by mishandling of an invalid symbol index, and mishandling of state across invocations.

Remediation

There is no fixed version for Centos:7 binutils.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: cpio
  • Introduced through: cpio@2.11-27.el7

Detailed paths

  • Introduced through: centos@7.6.1810 cpio@2.11-27.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream cpio package and not the cpio package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.

Remediation

There is no fixed version for Centos:7 cpio.

References

medium severity

Improper Authentication

  • Vulnerable module: dbus
  • Introduced through: dbus@1:1.10.24-12.el7
  • Fixed in: 1:1.10.24-15.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.

Remediation

Upgrade Centos:7 dbus to version 1:1.10.24-15.el7 or higher.

References

medium severity

Improper Authentication

  • Vulnerable module: dbus-libs
  • Introduced through: dbus-libs@1:1.10.24-12.el7
  • Fixed in: 1:1.10.24-15.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus-libs@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.

Remediation

Upgrade Centos:7 dbus-libs to version 1:1.10.24-15.el7 or higher.

References

medium severity

Improper Input Validation

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

Remediation

There is no fixed version for Centos:7 glibc.

References

medium severity

Improper Input Validation

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

Remediation

There is no fixed version for Centos:7 glibc.

References

medium severity

Use After Free

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.

Remediation

There is no fixed version for Centos:7 glibc.

References

medium severity

Improper Input Validation

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

medium severity

Improper Input Validation

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

medium severity

Use After Free

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

medium severity

Link Following

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.

Remediation

There is no fixed version for Centos:7 systemd.

References

medium severity

Link Following

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

medium severity

CVE-2005-2541

  • Vulnerable module: tar
  • Introduced through: tar@2:1.26-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 tar@2:1.26-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

Remediation

There is no fixed version for Centos:7 tar.

References

medium severity

Out-of-Bounds

  • Vulnerable module: zlib
  • Introduced through: zlib@1.2.7-18.el7
  • Fixed in: 0:1.2.7-21.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 zlib@1.2.7-18.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Remediation

Upgrade Centos:7 zlib to version 0:1.2.7-21.el7_9 or higher.

References

medium severity

HTTP Request Smuggling

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-26.P2.el7_9.13

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.13 or higher.

References

medium severity

Unchecked Error Condition

  • Vulnerable module: dracut
  • Introduced through: dracut@033-554.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dracut@033-554.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dracut package and not the dracut package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid password.

Remediation

There is no fixed version for Centos:7 dracut.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: libssh2
  • Introduced through: libssh2@1.4.3-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libssh2@1.4.3-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.

Remediation

There is no fixed version for Centos:7 libssh2.

References

medium severity

Improper Input Validation

  • Vulnerable module: cpio
  • Introduced through: cpio@2.11-27.el7
  • Fixed in: 0:2.11-28.el7

Detailed paths

  • Introduced through: centos@7.6.1810 cpio@2.11-27.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream cpio package and not the cpio package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.

Remediation

Upgrade Centos:7 cpio to version 0:2.11-28.el7 or higher.

References

medium severity

XML External Entity (XXE) Injection

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

XML External Entity (XXE) Injection

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Arbitrary Command Injection

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

medium severity

Arbitrary Command Injection

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

medium severity

Inclusion of Functionality from Untrusted Control Sphere

  • Vulnerable module: procps-ng
  • Introduced through: procps-ng@3.3.10-23.el7
  • Fixed in: 0:3.3.10-26.el7

Detailed paths

  • Introduced through: centos@7.6.1810 procps-ng@3.3.10-23.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream procps-ng package and not the procps-ng package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.

Remediation

Upgrade Centos:7 procps-ng to version 0:3.3.10-26.el7 or higher.

References

medium severity

Insufficient Verification of Data Authenticity

  • Vulnerable module: rpm
  • Introduced through: rpm@4.11.3-35.el7
  • Fixed in: 0:4.11.3-48.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 rpm@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm package and not the rpm package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

Remediation

Upgrade Centos:7 rpm to version 0:4.11.3-48.el7_9 or higher.

References

medium severity

Insufficient Verification of Data Authenticity

  • Vulnerable module: rpm-build-libs
  • Introduced through: rpm-build-libs@4.11.3-35.el7
  • Fixed in: 0:4.11.3-48.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-build-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-build-libs package and not the rpm-build-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

Remediation

Upgrade Centos:7 rpm-build-libs to version 0:4.11.3-48.el7_9 or higher.

References

medium severity

Insufficient Verification of Data Authenticity

  • Vulnerable module: rpm-libs
  • Introduced through: rpm-libs@4.11.3-35.el7
  • Fixed in: 0:4.11.3-48.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-libs package and not the rpm-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

Remediation

Upgrade Centos:7 rpm-libs to version 0:4.11.3-48.el7_9 or higher.

References

medium severity

Insufficient Verification of Data Authenticity

  • Vulnerable module: rpm-python
  • Introduced through: rpm-python@4.11.3-35.el7
  • Fixed in: 0:4.11.3-48.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-python@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-python package and not the rpm-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

Remediation

Upgrade Centos:7 rpm-python to version 0:4.11.3-48.el7_9 or higher.

References

medium severity

Expected Behavior Violation

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

Remediation

There is no fixed version for Centos:7 systemd.

References

medium severity

Time-of-check Time-of-use (TOCTOU)

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.

Remediation

There is no fixed version for Centos:7 systemd.

References

medium severity

Expected Behavior Violation

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

medium severity

Time-of-check Time-of-use (TOCTOU)

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

medium severity

Files or Directories Accessible to External Parties

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7
  • Fixed in: 0:2.56.1-7.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.

Remediation

Upgrade Centos:7 glib2 to version 0:2.56.1-7.el7 or higher.

References

medium severity

Out-of-bounds Write

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

vim is vulnerable to Heap-based Buffer Overflow

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

medium severity

Improper Access Control

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-9.P2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update request. Unfortunately, some rule types were not initially documented, and when documentation for them was added to the Administrator Reference Manual (ARM) in change #3112, the language that was added to the ARM at that time incorrectly described the behavior of two rule types, krb5-subdomain and ms-subdomain. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. This affects BIND versions prior to BIND 9.11.5 and BIND 9.12.3.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-9.P2.el7 or higher.

References

medium severity

Improper Input Validation

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Sending a flood of dynamic DNS updates may cause named to allocate large amounts of memory. This, in turn, may cause named to exit due to a lack of free memory. We are not aware of any cases where this has been exploited.

Memory is allocated prior to the checking of access permissions (ACLs) and is retained during the processing of a dynamic update from a client whose access credentials are accepted. Memory allocated to clients that are not permitted to send updates is released immediately upon rejection. The scope of this vulnerability is limited therefore to trusted clients who are permitted to make dynamic zone changes.

If a dynamic update is REFUSED, memory will be released again very quickly. Therefore it is only likely to be possible to degrade or stop named by sending a flood of unaccepted dynamic updates comparable in magnitude to a query flood intended to achieve the same detrimental outcome.

BIND 9.11 and earlier branches are also affected, but through exhaustion of internal resources rather than memory constraints. This may reduce performance but should not be a significant problem for most servers. Therefore we don't intend to address this for BIND versions prior to BIND 9.16. This issue affects BIND 9 versions 9.16.0 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.8-S1 through 9.16.36-S1.

Remediation

There is no fixed version for Centos:7 bind-license.

References

medium severity

Reachable Assertion

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-26.P2.el7_9.7

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.7 or higher.

References

medium severity

Resource Exhaustion

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-26.P2.el7_9.2

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.2 or higher.

References

medium severity

Uncontrolled Recursion

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Improper Verification of Cryptographic Signature

  • Vulnerable module: dbus
  • Introduced through: dbus@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.

Remediation

There is no fixed version for Centos:7 dbus.

References

medium severity

Resource Exhaustion

  • Vulnerable module: dbus
  • Introduced through: dbus@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format.

Remediation

There is no fixed version for Centos:7 dbus.

References

medium severity

Resource Exhaustion

  • Vulnerable module: dbus
  • Introduced through: dbus@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type.

Remediation

There is no fixed version for Centos:7 dbus.

References

medium severity

Improper Verification of Cryptographic Signature

  • Vulnerable module: dbus-libs
  • Introduced through: dbus-libs@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus-libs@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

medium severity

Resource Exhaustion

  • Vulnerable module: dbus-libs
  • Introduced through: dbus-libs@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus-libs@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type.

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

medium severity

Resource Exhaustion

  • Vulnerable module: dbus-libs
  • Introduced through: dbus-libs@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus-libs@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format.

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Remediation

There is no fixed version for Centos:7 expat.

References

medium severity

Resource Exhaustion

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

Remediation

There is no fixed version for Centos:7 expat.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

Remediation

There is no fixed version for Centos:7 glibc.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

medium severity

Improper Validation of Certificate with Host Mismatch

  • Vulnerable module: gnupg2
  • Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 gnupg2@2.0.22-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.

Remediation

There is no fixed version for Centos:7 gnupg2.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: krb5-libs
  • Introduced through: krb5-libs@1.15.1-34.el7
  • Fixed in: 0:1.15.1-51.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 krb5-libs@1.15.1-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.

Remediation

Upgrade Centos:7 krb5-libs to version 0:1.15.1-51.el7_9 or higher.

References

medium severity

Uncontrolled Recursion

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

HTTP Request Smuggling

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

Remediation

There is no fixed version for Centos:7 libgcc.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: libssh2
  • Introduced through: libssh2@1.4.3-12.el7
  • Fixed in: 0:1.8.0-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libssh2@1.4.3-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

Remediation

Upgrade Centos:7 libssh2 to version 0:1.8.0-4.el7 or higher.

References

medium severity

HTTP Request Smuggling

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

medium severity

Improper Input Validation

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.4

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.

Remediation

Upgrade Centos:7 libxml2 to version 0:2.9.1-6.el7.4 or higher.

References

medium severity

Out-of-Bounds

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Resource Exhaustion

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

XML External Entity (XXE) Injection

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Improper Input Validation

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.4

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.

Remediation

Upgrade Centos:7 libxml2-python to version 0:2.9.1-6.el7.4 or higher.

References

medium severity

Out-of-Bounds

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Resource Exhaustion

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

XML External Entity (XXE) Injection

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Information Exposure

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

Remediation

There is no fixed version for Centos:7 nss.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.

Remediation

There is no fixed version for Centos:7 nss.

References

medium severity

Information Exposure

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

medium severity

Information Exposure

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

Remediation

There is no fixed version for Centos:7 nss-tools.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.

Remediation

There is no fixed version for Centos:7 nss-tools.

References

medium severity

Information Exposure

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)

Remediation

There is no fixed version for Centos:7 openldap.

References

medium severity

SQL Injection

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.

Remediation

There is no fixed version for Centos:7 openldap.

References

medium severity

Resource Exhaustion

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow.

Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service.

An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods.

When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*).

With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms.

Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data.

Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low.

In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature.

The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication.

In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

medium severity

HTTP Response Splitting

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

HTTP Response Splitting

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-92.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-92.el7_9 or higher.

References

medium severity

HTTP Response Splitting

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-86.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-86.el7 or higher.

References

medium severity

HTTP Response Splitting

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-86.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-86.el7 or higher.

References

medium severity

HTTP Response Splitting

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-92.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-92.el7_9 or higher.

References

medium severity

Resource Exhaustion

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

Resource Exhaustion

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

HTTP Response Splitting

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

HTTP Response Splitting

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-92.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-92.el7_9 or higher.

References

medium severity

HTTP Response Splitting

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-86.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-86.el7 or higher.

References

medium severity

HTTP Response Splitting

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-86.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-86.el7 or higher.

References

medium severity

HTTP Response Splitting

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-92.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-92.el7_9 or higher.

References

medium severity

Resource Exhaustion

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Resource Exhaustion

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Link Following

  • Vulnerable module: rpm
  • Introduced through: rpm@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm package and not the rpm package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

There is no fixed version for Centos:7 rpm.

References

medium severity

Link Following

  • Vulnerable module: rpm
  • Introduced through: rpm@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm package and not the rpm package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

There is no fixed version for Centos:7 rpm.

References

medium severity

Link Following

  • Vulnerable module: rpm-build-libs
  • Introduced through: rpm-build-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-build-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-build-libs package and not the rpm-build-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

medium severity

Link Following

  • Vulnerable module: rpm-build-libs
  • Introduced through: rpm-build-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-build-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-build-libs package and not the rpm-build-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

medium severity

Link Following

  • Vulnerable module: rpm-libs
  • Introduced through: rpm-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-libs package and not the rpm-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

medium severity

Link Following

  • Vulnerable module: rpm-libs
  • Introduced through: rpm-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-libs package and not the rpm-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

medium severity

Link Following

  • Vulnerable module: rpm-python
  • Introduced through: rpm-python@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-python@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-python package and not the rpm-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

There is no fixed version for Centos:7 rpm-python.

References

medium severity

Link Following

  • Vulnerable module: rpm-python
  • Introduced through: rpm-python@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-python@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-python package and not the rpm-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

There is no fixed version for Centos:7 rpm-python.

References

medium severity

Out-of-Bounds

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

Use of Uninitialized Resource

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

OS Command Injection

  • Vulnerable module: libblkid
  • Introduced through: libblkid@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libblkid@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libblkid package and not the libblkid package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.

Remediation

There is no fixed version for Centos:7 libblkid.

References

medium severity

Out-of-bounds Write

  • Vulnerable module: libcom_err
  • Introduced through: libcom_err@1.42.9-13.el7
  • Fixed in: 0:1.42.9-19.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcom_err@1.42.9-13.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcom_err package and not the libcom_err package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Remediation

Upgrade Centos:7 libcom_err to version 0:1.42.9-19.el7 or higher.

References

medium severity

OS Command Injection

  • Vulnerable module: libmount
  • Introduced through: libmount@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libmount@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libmount package and not the libmount package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.

Remediation

There is no fixed version for Centos:7 libmount.

References

medium severity

OS Command Injection

  • Vulnerable module: libuuid
  • Introduced through: libuuid@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libuuid@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libuuid package and not the libuuid package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.

Remediation

There is no fixed version for Centos:7 libuuid.

References

medium severity

OS Command Injection

  • Vulnerable module: util-linux
  • Introduced through: util-linux@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 util-linux@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.

Remediation

There is no fixed version for Centos:7 util-linux.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7
  • Fixed in: 0:7.29.0-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

Remediation

Upgrade Centos:7 curl to version 0:7.29.0-59.el7 or higher.

References

medium severity

Out-of-Bounds

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3
  • Fixed in: 0:2.1.0-11.el7

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.

Remediation

Upgrade Centos:7 expat to version 0:2.1.0-11.el7 or higher.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7
  • Fixed in: 0:7.29.0-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

Remediation

Upgrade Centos:7 libcurl to version 0:7.29.0-59.el7 or higher.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: nspr
  • Introduced through: nspr@4.19.0-1.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nspr@4.19.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nspr package and not the nspr package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.

Remediation

There is no fixed version for Centos:7 nspr.

References

medium severity

Link Following

  • Vulnerable module: rpm
  • Introduced through: rpm@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm package and not the rpm package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

There is no fixed version for Centos:7 rpm.

References

medium severity

Link Following

  • Vulnerable module: rpm-build-libs
  • Introduced through: rpm-build-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-build-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-build-libs package and not the rpm-build-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

medium severity

Link Following

  • Vulnerable module: rpm-libs
  • Introduced through: rpm-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-libs package and not the rpm-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

medium severity

Link Following

  • Vulnerable module: rpm-python
  • Introduced through: rpm-python@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-python@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-python package and not the rpm-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

There is no fixed version for Centos:7 rpm-python.

References

medium severity

Reachable Assertion

  • Vulnerable module: dbus
  • Introduced through: dbus@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.

Remediation

There is no fixed version for Centos:7 dbus.

References

medium severity

Reachable Assertion

  • Vulnerable module: dbus-libs
  • Introduced through: dbus-libs@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus-libs@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: gmp
  • Introduced through: gmp@1:6.0.0-15.el7

Detailed paths

  • Introduced through: centos@7.6.1810 gmp@1:6.0.0-15.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream gmp package and not the gmp package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.

Remediation

There is no fixed version for Centos:7 gmp.

References

medium severity

Resource Exhaustion

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

Cleartext Transmission of Sensitive Information

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got before the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Missing Authorization

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7
  • Fixed in: 0:2.56.1-7.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user.

Remediation

Upgrade Centos:7 glib2 to version 0:2.56.1-7.el7 or higher.

References

medium severity

Cleartext Transmission of Sensitive Information

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got before the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Cross-site Scripting (XSS)

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

Remediation

There is no fixed version for Centos:7 libgcc.

References

medium severity

Information Exposure

  • Vulnerable module: libgcrypt
  • Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcrypt@1.5.3-14.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt package and not the libgcrypt package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

medium severity

Cross-site Scripting (XSS)

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

medium severity

Cross-site Scripting (XSS)

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Possible cross-site scripting vulnerability in libxml after commit 960f0e2.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Cross-site Scripting (XSS)

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Possible cross-site scripting vulnerability in libxml after commit 960f0e2.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Incorrect Conversion between Numeric Types

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result "POINT_AT_INFINITY" when it should not. A man-in-the-middle attacker could use this to interfere with a connection, resulting in an attacked party computing an incorrect shared secret. This vulnerability affects Firefox < 55.

Remediation

There is no fixed version for Centos:7 nss-softokn.

References

medium severity

Incorrect Conversion between Numeric Types

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result "POINT_AT_INFINITY" when it should not. A man-in-the-middle attacker could use this to interfere with a connection, resulting in an attacked party computing an incorrect shared secret. This vulnerability affects Firefox < 55.

Remediation

There is no fixed version for Centos:7 nss-softokn-freebl.

References

medium severity

Cross-site Scripting (XSS)

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-89.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-89.el7 or higher.

References

medium severity

Cross-site Scripting (XSS)

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-89.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-89.el7 or higher.

References

medium severity

Missing Authentication for Critical Function

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.

Remediation

There is no fixed version for Centos:7 systemd.

References

medium severity

Missing Authentication for Critical Function

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

medium severity

Resource Exhaustion

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.9.4-73.el7_6

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind-9.9.4-65.el7 -> bind-9.9.4-72.el7. No ISC releases are affected. Other packages from other distributions who made the same error may also be affected.

Remediation

Upgrade Centos:7 bind-license to version 32:9.9.4-73.el7_6 or higher.

References

medium severity

Authentication Bypass by Primary Weakness

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Authentication Bypass by Primary Weakness

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Improper Certificate Validation

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with xn-- and should not be allowed to pattern match, but the wildcard check in curl could still check for x*, which would match even though the IDN name most likely contained nothing even resembling an x.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Improper Input Validation

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7
  • Fixed in: 0:2.17-292.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.

Remediation

Upgrade Centos:7 glibc to version 0:2.17-292.el7 or higher.

References

medium severity

Stack-based Buffer Overflow

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets.

Remediation

There is no fixed version for Centos:7 glibc.

References

medium severity

Use After Free

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss_gethostbyname2_r and nss_getcanonname_r hooks without implementing the nss*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

Remediation

There is no fixed version for Centos:7 glibc.

References

medium severity

Use After Free

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

Remediation

There is no fixed version for Centos:7 glibc.

References

medium severity

Improper Input Validation

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7
  • Fixed in: 0:2.17-292.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.

Remediation

Upgrade Centos:7 glibc-common to version 0:2.17-292.el7 or higher.

References

medium severity

Stack-based Buffer Overflow

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

medium severity

Use After Free

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss_gethostbyname2_r and nss_getcanonname_r hooks without implementing the nss*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

medium severity

Use After Free

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

medium severity

Improper Verification of Cryptographic Signature

  • Vulnerable module: gnupg2
  • Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 gnupg2@2.0.22-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.

Remediation

There is no fixed version for Centos:7 gnupg2.

References

medium severity

Authentication Bypass by Primary Weakness

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Authentication Bypass by Primary Weakness

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Improper Certificate Validation

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with xn-- and should not be allowed to pattern match, but the wildcard check in curl could still check for x*, which would match even though the IDN name most likely contained nothing even resembling an x.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.

Remediation

There is no fixed version for Centos:7 libgcc.

References

medium severity

Covert Timing Channel

  • Vulnerable module: libgcrypt
  • Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcrypt@1.5.3-14.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt package and not the libgcrypt package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

medium severity
new

Covert Timing Channel

  • Vulnerable module: libgcrypt
  • Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcrypt@1.5.3-14.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt package and not the libgcrypt package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: libgcrypt
  • Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcrypt@1.5.3-14.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt package and not the libgcrypt package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

medium severity

Truncation of Security-relevant Information

  • Vulnerable module: libssh2
  • Introduced through: libssh2@1.4.3-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libssh2@1.4.3-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.

Remediation

There is no fixed version for Centos:7 libssh2.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

medium severity

Off-by-one Error

  • Vulnerable module: libtasn1
  • Introduced through: libtasn1@4.10-1.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libtasn1@4.10-1.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libtasn1 package and not the libtasn1 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.

Remediation

There is no fixed version for Centos:7 libtasn1.

References

medium severity

Improper Input Validation

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Improper Input Validation

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Improper Input Validation

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Improper Input Validation

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Information Exposure

  • Vulnerable module: nspr
  • Introduced through: nspr@4.19.0-1.el7_5
  • Fixed in: 0:4.21.0-1.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nspr@4.19.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nspr package and not the nspr package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.

Remediation

Upgrade Centos:7 nspr to version 0:4.21.0-1.el7 or higher.

References

medium severity

Information Exposure

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.44.0-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.

Remediation

Upgrade Centos:7 nss to version 0:3.44.0-4.el7 or higher.

References

medium severity

Missing Required Cryptographic Step

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.

Remediation

There is no fixed version for Centos:7 nss.

References

medium severity

Information Exposure

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5
  • Fixed in: 0:3.44.0-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.

Remediation

Upgrade Centos:7 nss-softokn to version 0:3.44.0-5.el7 or higher.

References

medium severity

Information Exposure

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5
  • Fixed in: 0:3.44.0-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.

Remediation

Upgrade Centos:7 nss-softokn-freebl to version 0:3.44.0-5.el7 or higher.

References

medium severity

Information Exposure

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.44.0-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.44.0-4.el7 or higher.

References

medium severity

Missing Required Cryptographic Step

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

medium severity

Information Exposure

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.44.0-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.44.0-4.el7 or higher.

References

medium severity

Missing Required Cryptographic Step

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.

Remediation

There is no fixed version for Centos:7 nss-tools.

References

medium severity

Information Exposure

  • Vulnerable module: nss-util
  • Introduced through: nss-util@3.36.0-1.el7_5
  • Fixed in: 0:3.44.0-3.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-util@3.36.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-util package and not the nss-util package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.

Remediation

Upgrade Centos:7 nss-util to version 0:3.44.0-3.el7 or higher.

References

medium severity

Information Exposure

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.

For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

medium severity

Missing Required Cryptographic Step

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7
  • Fixed in: 1:1.0.2k-19.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-19.el7 or higher.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7
  • Fixed in: 1:1.0.2k-22.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-22.el7_9 or higher.

References

medium severity

Buffer Overflow

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-92.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-92.el7_9 or higher.

References

medium severity

HTTP Request Smuggling

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

Race Condition

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

Buffer Overflow

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-92.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-92.el7_9 or higher.

References

medium severity

HTTP Request Smuggling

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Race Condition

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Improper Validation of Array Index

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: libcom_err
  • Introduced through: libcom_err@1.42.9-13.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcom_err@1.42.9-13.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcom_err package and not the libcom_err package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.

Remediation

There is no fixed version for Centos:7 libcom_err.

References

medium severity

Stack-based Buffer Overflow

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7
  • Fixed in: 0:2.17-322.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.

Remediation

Upgrade Centos:7 glibc to version 0:2.17-322.el7_9 or higher.

References

medium severity

Stack-based Buffer Overflow

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7
  • Fixed in: 0:2.17-322.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.

Remediation

Upgrade Centos:7 glibc-common to version 0:2.17-322.el7_9 or higher.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.

Remediation

There is no fixed version for Centos:7 expat.

References

medium severity

Improper Input Validation

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL command that triggers an API call with a crafted pointer value in the second argument.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

Directory Traversal

  • Vulnerable module: tar
  • Introduced through: tar@2:1.26-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 tar@2:1.26-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.

Remediation

There is no fixed version for Centos:7 tar.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599.

Remediation

There is no fixed version for Centos:7 binutils.

References

medium severity

Use After Free

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.

Remediation

There is no fixed version for Centos:7 binutils.

References

medium severity

Use After Free

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35 in the process_symbol_table, as demonstrated in readelf, via a crafted file.

Remediation

There is no fixed version for Centos:7 binutils.

References

medium severity
new

Directory Traversal

  • Vulnerable module: cpio
  • Introduced through: cpio@2.11-27.el7

Detailed paths

  • Introduced through: centos@7.6.1810 cpio@2.11-27.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream cpio package and not the cpio package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames.

Remediation

There is no fixed version for Centos:7 cpio.

References

medium severity

Authentication Bypass by Primary Weakness

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

Remediation

There is no fixed version for Centos:7 expat.

References

medium severity

Information Exposure

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition.

Remediation

There is no fixed version for Centos:7 glib2.

References

medium severity

Information Exposure

  • Vulnerable module: libblkid
  • Introduced through: libblkid@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libblkid@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libblkid package and not the libblkid package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

Remediation

There is no fixed version for Centos:7 libblkid.

References

medium severity

Authentication Bypass by Primary Weakness

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Information Exposure

  • Vulnerable module: libmount
  • Introduced through: libmount@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libmount@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libmount package and not the libmount package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

Remediation

There is no fixed version for Centos:7 libmount.

References

medium severity

Information Exposure

  • Vulnerable module: libuuid
  • Introduced through: libuuid@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libuuid@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libuuid package and not the libuuid package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

Remediation

There is no fixed version for Centos:7 libuuid.

References

medium severity

Out-of-bounds Write

  • Vulnerable module: lua
  • Introduced through: lua@5.1.4-15.el7

Detailed paths

  • Introduced through: centos@7.6.1810 lua@5.1.4-15.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream lua package and not the lua package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.

Remediation

There is no fixed version for Centos:7 lua.

References

medium severity

Client-Side Enforcement of Server-Side Security

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

medium severity

Insecure Inherited Permissions

  • Vulnerable module: pam
  • Introduced through: pam@1.1.8-22.el7

Detailed paths

  • Introduced through: centos@7.6.1810 pam@1.1.8-22.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream pam package and not the pam package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

Remediation

There is no fixed version for Centos:7 pam.

References

medium severity

Directory Traversal

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

Directory Traversal

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Improper Input Validation

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

Uncontrolled Recursion

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.

Remediation

There is no fixed version for Centos:7 sqlite.

References

medium severity

Deadlock

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file.

Remediation

There is no fixed version for Centos:7 systemd.

References

medium severity

Information Exposure

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.

Remediation

There is no fixed version for Centos:7 systemd.

References

medium severity

Off-by-one Error

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.

Remediation

There is no fixed version for Centos:7 systemd.

References

medium severity

Uncontrolled Recursion

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.

Remediation

There is no fixed version for Centos:7 systemd.

References

medium severity

Deadlock

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file.

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

medium severity

Information Exposure

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

medium severity

Off-by-one Error

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

medium severity

Uncontrolled Recursion

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

medium severity

Out-of-Bounds

  • Vulnerable module: tar
  • Introduced through: tar@2:1.26-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 tar@2:1.26-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

Remediation

There is no fixed version for Centos:7 tar.

References

medium severity

Information Exposure

  • Vulnerable module: util-linux
  • Introduced through: util-linux@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 util-linux@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

Remediation

There is no fixed version for Centos:7 util-linux.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

medium severity

Arbitrary Code Injection

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7
  • Fixed in: 0:7.29.0-59.el7_9.1

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

Remediation

Upgrade Centos:7 curl to version 0:7.29.0-59.el7_9.1 or higher.

References

medium severity

Arbitrary Code Injection

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7
  • Fixed in: 0:7.29.0-59.el7_9.1

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

Remediation

Upgrade Centos:7 libcurl to version 0:7.29.0-59.el7_9.1 or higher.

References

medium severity

Out-of-Bounds

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for Centos:7 ncurses.

References

medium severity

Out-of-Bounds

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

medium severity

Out-of-Bounds

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

medium severity

Information Exposure

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

Information Exposure

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Improper Input Validation

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.

Remediation

There is no fixed version for Centos:7 bind-license.

References

medium severity

Improper Input Validation

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-26.P2.el7_9.13

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.13 or higher.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is a heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap in archive64.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in process_mips_specific in readelf.c via a malformed MIPS option section.

Remediation

There is no fixed version for Centos:7 binutils.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm.

Remediation

There is no fixed version for Centos:7 binutils.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an out-of-bounds read leading to a SEGV in bfd_getl32 in libbfd.c, when called from pex64_get_runtime_function in pei-x86_64.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

medium severity

Directory Traversal

  • Vulnerable module: cpio
  • Introduced through: cpio@2.11-27.el7

Detailed paths

  • Introduced through: centos@7.6.1810 cpio@2.11-27.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream cpio package and not the cpio package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, this allows writing files in arbitrary directories through symlinks.

Remediation

There is no fixed version for Centos:7 cpio.

References

medium severity

Cleartext Transmission of Sensitive Information

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and not using thetrailing dot in the URL.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Improper Enforcement of Message Integrity During Transmission in a Communication Channel

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Improper Input Validation

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Improper Input Validation

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Resource Injection

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Use After Free

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The libcurl API function called curl_maprintf() before version 7.51.0 can be tricked into doing a double-free due to an unsafe size_t multiplication, on systems using 32 bit size_t variables.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Use After Free

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The function read_data() in security.c in curl before version 7.51.0 is vulnerable to memory double free.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.

Remediation

There is no fixed version for Centos:7 glibc.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: gnupg2
  • Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 gnupg2@2.0.22-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Remediation

There is no fixed version for Centos:7 gnupg2.

References

medium severity

Reachable Assertion

  • Vulnerable module: krb5-libs
  • Introduced through: krb5-libs@1.15.1-34.el7
  • Fixed in: 0:1.15.1-37.el7_7.2

Detailed paths

  • Introduced through: centos@7.6.1810 krb5-libs@1.15.1-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.

Remediation

Upgrade Centos:7 krb5-libs to version 0:1.15.1-37.el7_7.2 or higher.

References

medium severity

Cleartext Transmission of Sensitive Information

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and not using thetrailing dot in the URL.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Improper Enforcement of Message Integrity During Transmission in a Communication Channel

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Improper Input Validation

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Improper Input Validation

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Resource Injection

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Use After Free

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The function read_data() in security.c in curl before version 7.51.0 is vulnerable to memory double free.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Use After Free

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The libcurl API function called curl_maprintf() before version 7.51.0 can be tricked into doing a double-free due to an unsafe size_t multiplication, on systems using 32 bit size_t variables.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm.

Remediation

There is no fixed version for Centos:7 libgcc.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

medium severity

Use After Free

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7_9.6

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.

Remediation

Upgrade Centos:7 libxml2 to version 0:2.9.1-6.el7_9.6 or higher.

References

medium severity

Use After Free

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7_9.6

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.

Remediation

Upgrade Centos:7 libxml2-python to version 0:2.9.1-6.el7_9.6 or higher.

References

medium severity

Out-of-Bounds

  • Vulnerable module: lua
  • Introduced through: lua@5.1.4-15.el7

Detailed paths

  • Introduced through: centos@7.6.1810 lua@5.1.4-15.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream lua package and not the lua package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.

Remediation

There is no fixed version for Centos:7 lua.

References

medium severity

Out-of-Bounds

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for Centos:7 ncurses.

References

medium severity

Stack-based Buffer Overflow

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

medium severity

Out-of-Bounds

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

medium severity

Stack-based Buffer Overflow

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

medium severity

Out-of-Bounds

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

medium severity

Stack-based Buffer Overflow

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

medium severity

Improper Authentication

  • Vulnerable module: nspr
  • Introduced through: nspr@4.19.0-1.el7_5
  • Fixed in: 0:4.25.0-2.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nspr@4.19.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nspr package and not the nspr package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

Remediation

Upgrade Centos:7 nspr to version 0:4.25.0-2.el7_9 or higher.

References

medium severity

Improper Authentication

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

Remediation

Upgrade Centos:7 nss to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Improper Authentication

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

Remediation

Upgrade Centos:7 nss-softokn to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Improperly Implemented Security Check for Standard

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.

Remediation

There is no fixed version for Centos:7 nss-softokn.

References

medium severity

Improper Authentication

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

Remediation

Upgrade Centos:7 nss-softokn-freebl to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Improperly Implemented Security Check for Standard

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.

Remediation

There is no fixed version for Centos:7 nss-softokn-freebl.

References

medium severity

Improper Authentication

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Improper Authentication

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Improper Authentication

  • Vulnerable module: nss-util
  • Introduced through: nss-util@3.36.0-1.el7_5
  • Fixed in: 0:3.53.1-1.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-util@3.36.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-util package and not the nss-util package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

Remediation

Upgrade Centos:7 nss-util to version 0:3.53.1-1.el7_9 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: p11-kit
  • Introduced through: p11-kit@0.23.5-3.el7

Detailed paths

  • Introduced through: centos@7.6.1810 p11-kit@0.23.5-3.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream p11-kit package and not the p11-kit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation.

Remediation

There is no fixed version for Centos:7 p11-kit.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: p11-kit-trust
  • Introduced through: p11-kit-trust@0.23.5-3.el7

Detailed paths

  • Introduced through: centos@7.6.1810 p11-kit-trust@0.23.5-3.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream p11-kit-trust package and not the p11-kit-trust package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation.

Remediation

There is no fixed version for Centos:7 p11-kit-trust.

References

medium severity

Arbitrary Code Injection

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

Cryptographic Issues

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

Improper Initialization

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-86.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-86.el7 or higher.

References

medium severity

Improper Input Validation

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7
  • Fixed in: 0:2.7.5-88.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.

Remediation

Upgrade Centos:7 python to version 0:2.7.5-88.el7 or higher.

References

medium severity

Improper Input Validation

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

Unchecked Return Value

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

Arbitrary Code Injection

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Cryptographic Issues

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Improper Initialization

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-86.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-86.el7 or higher.

References

medium severity

Improper Input Validation

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7
  • Fixed in: 0:2.7.5-88.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.

Remediation

Upgrade Centos:7 python-libs to version 0:2.7.5-88.el7 or higher.

References

medium severity

Improper Input Validation

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Unchecked Return Value

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Unchecked Error Condition

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

medium severity

OS Command Injection

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: zlib
  • Introduced through: zlib@1.2.7-18.el7

Detailed paths

  • Introduced through: centos@7.6.1810 zlib@1.2.7-18.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

Remediation

There is no fixed version for Centos:7 zlib.

References

medium severity

CVE-2014-3477

  • Vulnerable module: dbus
  • Introduced through: dbus@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.

Remediation

There is no fixed version for Centos:7 dbus.

References

medium severity

CVE-2014-3477

  • Vulnerable module: dbus-libs
  • Introduced through: dbus-libs@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus-libs@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

medium severity

Information Exposure

  • Vulnerable module: nspr
  • Introduced through: nspr@4.19.0-1.el7_5
  • Fixed in: 0:4.21.0-1.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nspr@4.19.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nspr package and not the nspr package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

Remediation

Upgrade Centos:7 nspr to version 0:4.21.0-1.el7 or higher.

References

medium severity

Information Exposure

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.44.0-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

Remediation

Upgrade Centos:7 nss to version 0:3.44.0-4.el7 or higher.

References

medium severity

Information Exposure

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5
  • Fixed in: 0:3.44.0-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

Remediation

Upgrade Centos:7 nss-softokn to version 0:3.44.0-5.el7 or higher.

References

medium severity

Information Exposure

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5
  • Fixed in: 0:3.44.0-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

Remediation

Upgrade Centos:7 nss-softokn-freebl to version 0:3.44.0-5.el7 or higher.

References

medium severity

Information Exposure

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.44.0-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.44.0-4.el7 or higher.

References

medium severity

Information Exposure

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.44.0-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.44.0-4.el7 or higher.

References

medium severity

Information Exposure

  • Vulnerable module: nss-util
  • Introduced through: nss-util@3.36.0-1.el7_5
  • Fixed in: 0:3.44.0-3.el7

Detailed paths

  • Introduced through: centos@7.6.1810 nss-util@3.36.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-util package and not the nss-util package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

Remediation

Upgrade Centos:7 nss-util to version 0:3.44.0-3.el7 or higher.

References

medium severity

Covert Timing Channel

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7
  • Fixed in: 1:1.0.2k-16.el7_6.1

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-16.el7_6.1 or higher.

References

medium severity

Covert Timing Channel

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7
  • Fixed in: 1:1.0.2k-19.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-19.el7 or higher.

References

medium severity

Insufficiently Protected Credentials

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Insufficiently Protected Credentials

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: libssh2
  • Introduced through: libssh2@1.4.3-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libssh2@1.4.3-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Remediation

There is no fixed version for Centos:7 libssh2.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: libssh2
  • Introduced through: libssh2@1.4.3-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libssh2@1.4.3-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Remediation

There is no fixed version for Centos:7 libssh2.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: libssh2
  • Introduced through: libssh2@1.4.3-12.el7
  • Fixed in: 0:1.8.0-3.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libssh2@1.4.3-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Remediation

Upgrade Centos:7 libssh2 to version 0:1.8.0-3.el7 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: libssh2
  • Introduced through: libssh2@1.4.3-12.el7
  • Fixed in: 0:1.8.0-3.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libssh2@1.4.3-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

Remediation

Upgrade Centos:7 libssh2 to version 0:1.8.0-3.el7 or higher.

References

medium severity

Reachable Assertion

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-16.P2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

"managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys which use an unsupported algorithm. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-16.P2.el7 or higher.

References

medium severity

Out-of-Bounds

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7
  • Fixed in: 0:2.17-322.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.

Remediation

Upgrade Centos:7 glibc to version 0:2.17-322.el7_9 or higher.

References

medium severity

Stack-based Buffer Overflow

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name.

Remediation

There is no fixed version for Centos:7 glibc.

References

medium severity

Out-of-Bounds

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7
  • Fixed in: 0:2.17-322.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.

Remediation

Upgrade Centos:7 glibc-common to version 0:2.17-322.el7_9 or higher.

References

medium severity

Stack-based Buffer Overflow

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

medium severity

Improper Authentication

  • Vulnerable module: libssh2
  • Introduced through: libssh2@1.4.3-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libssh2@1.4.3-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in thepki_verify_data_signature function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value rc, which is initialized to SSH_ERROR and later rewritten to save the return value of the function call pki_key_check_hash_compatible. The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls goto error returning SSH_OK.

Remediation

There is no fixed version for Centos:7 libssh2.

References

medium severity

Information Exposure

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7
  • Fixed in: 1:1.0.2k-16.el7_6.1

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

Remediation

Upgrade Centos:7 openssl-libs to version 1:1.0.2k-16.el7_6.1 or higher.

References

medium severity

Improper Authorization

  • Vulnerable module: shared-mime-info
  • Introduced through: shared-mime-info@1.8-4.el7
  • Fixed in: 0:1.8-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 shared-mime-info@1.8-4.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream shared-mime-info package and not the shared-mime-info package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions.

Remediation

Upgrade Centos:7 shared-mime-info to version 0:1.8-5.el7 or higher.

References

medium severity

Improper Verification of Cryptographic Signature

  • Vulnerable module: rpm
  • Introduced through: rpm@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm package and not the rpm package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.

Remediation

There is no fixed version for Centos:7 rpm.

References

medium severity

Improper Verification of Cryptographic Signature

  • Vulnerable module: rpm-build-libs
  • Introduced through: rpm-build-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-build-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-build-libs package and not the rpm-build-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

medium severity

Improper Verification of Cryptographic Signature

  • Vulnerable module: rpm-libs
  • Introduced through: rpm-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-libs package and not the rpm-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

medium severity

Improper Verification of Cryptographic Signature

  • Vulnerable module: rpm-python
  • Introduced through: rpm-python@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-python@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-python package and not the rpm-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.

Remediation

There is no fixed version for Centos:7 rpm-python.

References

medium severity

CVE-2017-10140

  • Vulnerable module: libdb
  • Introduced through: libdb@5.3.21-24.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libdb@5.3.21-24.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libdb package and not the libdb package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.

Remediation

There is no fixed version for Centos:7 libdb.

References

medium severity

CVE-2017-10140

  • Vulnerable module: libdb-utils
  • Introduced through: libdb-utils@5.3.21-24.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libdb-utils@5.3.21-24.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libdb-utils package and not the libdb-utils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.

Remediation

There is no fixed version for Centos:7 libdb-utils.

References

medium severity

Incorrect Authorization

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".

Remediation

There is no fixed version for Centos:7 systemd.

References

medium severity

Incorrect Authorization

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nspr
  • Introduced through: nspr@4.19.0-1.el7_5
  • Fixed in: 0:4.25.0-2.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nspr@4.19.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nspr package and not the nspr package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. Note: An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.

Remediation

Upgrade Centos:7 nspr to version 0:4.25.0-2.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nspr
  • Introduced through: nspr@4.19.0-1.el7_5
  • Fixed in: 0:4.25.0-2.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nspr@4.19.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nspr package and not the nspr package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nspr to version 0:4.25.0-2.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nspr
  • Introduced through: nspr@4.19.0-1.el7_5
  • Fixed in: 0:4.25.0-2.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nspr@4.19.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nspr package and not the nspr package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nspr to version 0:4.25.0-2.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nspr
  • Introduced through: nspr@4.19.0-1.el7_5
  • Fixed in: 0:4.25.0-2.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nspr@4.19.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nspr package and not the nspr package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nspr to version 0:4.25.0-2.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. Note: An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.

Remediation

Upgrade Centos:7 nss to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss-softokn to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss-softokn to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. Note: An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.

Remediation

Upgrade Centos:7 nss-softokn to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss-softokn to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss-softokn-freebl to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. Note: An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.

Remediation

Upgrade Centos:7 nss-softokn-freebl to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss-softokn-freebl to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss-softokn-freebl to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. Note: An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. Note: An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-util
  • Introduced through: nss-util@3.36.0-1.el7_5
  • Fixed in: 0:3.53.1-1.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-util@3.36.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-util package and not the nss-util package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss-util to version 0:3.53.1-1.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-util
  • Introduced through: nss-util@3.36.0-1.el7_5
  • Fixed in: 0:3.53.1-1.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-util@3.36.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-util package and not the nss-util package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss-util to version 0:3.53.1-1.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-util
  • Introduced through: nss-util@3.36.0-1.el7_5
  • Fixed in: 0:3.53.1-1.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-util@3.36.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-util package and not the nss-util package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Remediation

Upgrade Centos:7 nss-util to version 0:3.53.1-1.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-util
  • Introduced through: nss-util@3.36.0-1.el7_5
  • Fixed in: 0:3.53.1-1.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-util@3.36.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-util package and not the nss-util package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. Note: An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.

Remediation

Upgrade Centos:7 nss-util to version 0:3.53.1-1.el7_9 or higher.

References

medium severity

Improper Verification of Cryptographic Signature

  • Vulnerable module: rpm
  • Introduced through: rpm@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm package and not the rpm package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

Remediation

There is no fixed version for Centos:7 rpm.

References

medium severity

Improper Verification of Cryptographic Signature

  • Vulnerable module: rpm-build-libs
  • Introduced through: rpm-build-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-build-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-build-libs package and not the rpm-build-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

medium severity

Improper Verification of Cryptographic Signature

  • Vulnerable module: rpm-libs
  • Introduced through: rpm-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-libs package and not the rpm-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

medium severity

Improper Verification of Cryptographic Signature

  • Vulnerable module: rpm-python
  • Introduced through: rpm-python@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-python@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-python package and not the rpm-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

Remediation

There is no fixed version for Centos:7 rpm-python.

References

medium severity

Execution with Unnecessary Privileges

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7
  • Fixed in: 0:219-67.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.

Remediation

Upgrade Centos:7 systemd to version 0:219-67.el7 or higher.

References

medium severity

Time-of-check Time-of-use (TOCTOU)

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.

Remediation

There is no fixed version for Centos:7 systemd.

References

medium severity

Execution with Unnecessary Privileges

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7
  • Fixed in: 0:219-67.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.

Remediation

Upgrade Centos:7 systemd-libs to version 0:219-67.el7 or higher.

References

medium severity

Time-of-check Time-of-use (TOCTOU)

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

medium severity

Improper Neutralization of Special Elements

  • Vulnerable module: audit-libs
  • Introduced through: audit-libs@2.8.4-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 audit-libs@2.8.4-4.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream audit-libs package and not the audit-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.

Remediation

There is no fixed version for Centos:7 audit-libs.

References

medium severity

Resource Exhaustion

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-26.P2.el7_9.2

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-26.P2.el7_9.2 or higher.

References

medium severity

Information Exposure

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Information Exposure

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Insufficiently Protected Credentials

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

medium severity

CVE-2013-0341

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Remediation

There is no fixed version for Centos:7 expat.

References

medium severity

Insufficient Entropy

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.

Remediation

There is no fixed version for Centos:7 expat.

References

medium severity

Use of Insufficiently Random Values

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.

Remediation

There is no fixed version for Centos:7 expat.

References

medium severity

XML External Entity (XXE) Injection

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

Remediation

There is no fixed version for Centos:7 expat.

References

medium severity

Algorithmic Complexity

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Remediation

There is no fixed version for Centos:7 glib2.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.

Remediation

There is no fixed version for Centos:7 glib2.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Remediation

There is no fixed version for Centos:7 glib2.

References

medium severity

Uncontrolled Recursion

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Remediation

There is no fixed version for Centos:7 glib2.

References

medium severity

Uncontrolled Recursion

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Remediation

There is no fixed version for Centos:7 glib2.

References

medium severity

Uncontrolled Recursion

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\.|([^\\W_])?)+)+$/.

Remediation

There is no fixed version for Centos:7 glib2.

References

medium severity

Access of Resource Using Incompatible Type ('Type Confusion')

  • Vulnerable module: krb5-libs
  • Introduced through: krb5-libs@1.15.1-34.el7

Detailed paths

  • Introduced through: centos@7.6.1810 krb5-libs@1.15.1-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

medium severity

Access of Resource Using Incompatible Type ('Type Confusion')

  • Vulnerable module: krb5-libs
  • Introduced through: krb5-libs@1.15.1-34.el7

Detailed paths

  • Introduced through: centos@7.6.1810 krb5-libs@1.15.1-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: krb5-libs
  • Introduced through: krb5-libs@1.15.1-34.el7

Detailed paths

  • Introduced through: centos@7.6.1810 krb5-libs@1.15.1-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

medium severity

Information Exposure

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Information Exposure

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Insufficiently Protected Credentials

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: libtasn1
  • Introduced through: libtasn1@4.10-1.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libtasn1@4.10-1.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libtasn1 package and not the libtasn1 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service (infinite recursion) via a crafted certificate.

Remediation

There is no fixed version for Centos:7 libtasn1.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627.

Remediation

There is no fixed version for Centos:7 libxml2.

References

medium severity

Resource Exhaustion

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.4

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

Remediation

Upgrade Centos:7 libxml2 to version 0:2.9.1-6.el7.4 or higher.

References

medium severity

Unchecked Return Value

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.4

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.

Remediation

Upgrade Centos:7 libxml2 to version 0:2.9.1-6.el7.4 or higher.

References

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

medium severity

Resource Exhaustion

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.4

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

Remediation

Upgrade Centos:7 libxml2-python to version 0:2.9.1-6.el7.4 or higher.

References

medium severity

Unchecked Return Value

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.4

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.

Remediation

Upgrade Centos:7 libxml2-python to version 0:2.9.1-6.el7.4 or higher.

References

medium severity

Information Exposure

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121.

Remediation

There is no fixed version for Centos:7 nss.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

Remediation

There is no fixed version for Centos:7 nss.

References

medium severity

Information Exposure

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121.

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

medium severity

Information Exposure

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121.

Remediation

There is no fixed version for Centos:7 nss-tools.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

Remediation

There is no fixed version for Centos:7 nss-tools.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

medium severity

Out-of-Bounds

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

Remediation

There is no fixed version for Centos:7 python.

References

medium severity

Out-of-Bounds

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

Remediation

There is no fixed version for Centos:7 python-libs.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7
  • Fixed in: 0:219-67.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.

Remediation

Upgrade Centos:7 systemd to version 0:219-67.el7 or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7
  • Fixed in: 0:219-67.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.

Remediation

Upgrade Centos:7 systemd-libs to version 0:219-67.el7 or higher.

References

medium severity

Link Following

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

Remediation

There is no fixed version for Centos:7 binutils.

References

medium severity

Race Condition

  • Vulnerable module: coreutils
  • Introduced through: coreutils@8.22-23.el7

Detailed paths

  • Introduced through: centos@7.6.1810 coreutils@8.22-23.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream coreutils package and not the coreutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

Remediation

There is no fixed version for Centos:7 coreutils.

References

medium severity

Improper Input Validation

  • Vulnerable module: dbus
  • Introduced through: dbus@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.

Remediation

There is no fixed version for Centos:7 dbus.

References

medium severity

Improper Input Validation

  • Vulnerable module: dbus
  • Introduced through: dbus@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message containing an invalid file descriptor.

Remediation

There is no fixed version for Centos:7 dbus.

References

medium severity

Improper Input Validation

  • Vulnerable module: dbus-libs
  • Introduced through: dbus-libs@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus-libs@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message containing an invalid file descriptor.

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

medium severity

Improper Input Validation

  • Vulnerable module: dbus-libs
  • Introduced through: dbus-libs@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus-libs@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

medium severity

Improper Access Control

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7
  • Fixed in: 32:9.11.4-16.P2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465.

Remediation

Upgrade Centos:7 bind-license to version 32:9.11.4-16.P2.el7 or higher.

References

medium severity

Improper Certificate Validation

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths case insensitively,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Information Exposure

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the PWD command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit 415d2e7cb7, March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Improper Certificate Validation

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths case insensitively,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Information Exposure

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the PWD command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit 415d2e7cb7, March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Covert Timing Channel

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

Remediation

There is no fixed version for Centos:7 nss.

References

medium severity

Covert Timing Channel

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

medium severity

Covert Timing Channel

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

Remediation

There is no fixed version for Centos:7 nss-tools.

References

medium severity

Improper Input Validation

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7
  • Fixed in: 0:219-67.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.

Remediation

Upgrade Centos:7 systemd to version 0:219-67.el7 or higher.

References

medium severity

Improper Input Validation

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7
  • Fixed in: 0:219-67.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.

Remediation

Upgrade Centos:7 systemd-libs to version 0:219-67.el7 or higher.

References

medium severity

Resource Exhaustion

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.4

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.

Remediation

Upgrade Centos:7 libxml2 to version 0:2.9.1-6.el7.4 or higher.

References

medium severity

Resource Exhaustion

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3
  • Fixed in: 0:2.9.1-6.el7.4

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.

Remediation

Upgrade Centos:7 libxml2-python to version 0:2.9.1-6.el7.4 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nspr
  • Introduced through: nspr@4.19.0-1.el7_5
  • Fixed in: 0:4.25.0-2.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nspr@4.19.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nspr package and not the nspr package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Remediation

Upgrade Centos:7 nspr to version 0:4.25.0-2.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Remediation

Upgrade Centos:7 nss to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Remediation

Upgrade Centos:7 nss-softokn to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5
  • Fixed in: 0:3.53.1-6.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Remediation

Upgrade Centos:7 nss-softokn-freebl to version 0:3.53.1-6.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Remediation

Upgrade Centos:7 nss-sysinit to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5
  • Fixed in: 0:3.53.1-3.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Remediation

Upgrade Centos:7 nss-tools to version 0:3.53.1-3.el7_9 or higher.

References

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: nss-util
  • Introduced through: nss-util@3.36.0-1.el7_5
  • Fixed in: 0:3.53.1-1.el7_9

Detailed paths

  • Introduced through: centos@7.6.1810 nss-util@3.36.0-1.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-util package and not the nss-util package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Remediation

Upgrade Centos:7 nss-util to version 0:3.53.1-1.el7_9 or higher.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7
  • Fixed in: 0:2.27-41.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump.

Remediation

Upgrade Centos:7 binutils to version 0:2.27-41.base.el7 or higher.

References

medium severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7
  • Fixed in: 0:2.27-41.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_arm_hp_template, demangle_class_name, demangle_fund_type, do_type, do_arg, demangle_args, and demangle_nested_args. This can occur during execution of nm-new.

Remediation

Upgrade Centos:7 binutils to version 0:2.27-41.base.el7 or higher.

References

medium severity

Out-of-bounds Write

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via CURLOPT_USERNAME.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Out-of-bounds Write

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via CURLOPT_USERNAME.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Information Exposure

  • Vulnerable module: libgcrypt
  • Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcrypt@1.5.3-14.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt package and not the libgcrypt package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

medium severity

Out-of-Bounds

  • Vulnerable module: libsepol
  • Introduced through: libsepol@2.5-10.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libsepol@2.5-10.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libsepol package and not the libsepol package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

Remediation

There is no fixed version for Centos:7 libsepol.

References

medium severity

Use After Free

  • Vulnerable module: libsepol
  • Introduced through: libsepol@2.5-10.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libsepol@2.5-10.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libsepol package and not the libsepol package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).

Remediation

There is no fixed version for Centos:7 libsepol.

References

medium severity

Use After Free

  • Vulnerable module: libsepol
  • Introduced through: libsepol@2.5-10.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libsepol@2.5-10.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libsepol package and not the libsepol package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).

Remediation

There is no fixed version for Centos:7 libsepol.

References

medium severity

Use After Free

  • Vulnerable module: libsepol
  • Introduced through: libsepol@2.5-10.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libsepol@2.5-10.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libsepol package and not the libsepol package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).

Remediation

There is no fixed version for Centos:7 libsepol.

References

medium severity

Information Exposure

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.

Remediation

There is no fixed version for Centos:7 curl.

References

medium severity

Information Exposure

  • Vulnerable module: krb5-libs
  • Introduced through: krb5-libs@1.15.1-34.el7

Detailed paths

  • Introduced through: centos@7.6.1810 krb5-libs@1.15.1-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

medium severity

Information Exposure

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.

Remediation

There is no fixed version for Centos:7 libcurl.

References

medium severity

Use of Externally-Controlled Format String

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

medium severity

Use of Externally-Controlled Format String

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

medium severity

Use of Externally-Controlled Format String

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: expat
  • Introduced through: expat@2.1.0-10.el7_3

Detailed paths

  • Introduced through: centos@7.6.1810 expat@2.1.0-10.el7_3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.

Remediation

There is no fixed version for Centos:7 expat.

References

low severity

Out-of-bounds Write

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Insufficient Verification of Data Authenticity

  • Vulnerable module: ca-certificates
  • Introduced through: ca-certificates@2018.2.22-70.0.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 ca-certificates@2018.2.22-70.0.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream ca-certificates package and not the ca-certificates package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.

Remediation

There is no fixed version for Centos:7 ca-certificates.

References

low severity

Stack-based Buffer Overflow

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Privilege Dropping / Lowering Errors

  • Vulnerable module: bash
  • Introduced through: bash@4.2.46-31.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bash@4.2.46-31.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bash package and not the bash package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

Remediation

There is no fixed version for Centos:7 bash.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Stack-based Buffer Overflow

  • Vulnerable module: libtasn1
  • Introduced through: libtasn1@4.10-1.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libtasn1@4.10-1.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libtasn1 package and not the libtasn1 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.

Remediation

There is no fixed version for Centos:7 libtasn1.

References

low severity

Buffer Over-read

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Over-read in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Buffer Over-read

low severity

Divide By Zero

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

low severity

Heap-based Buffer Overflow

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Heap-based Buffer Overflow

low severity

Heap-based Buffer Overflow

low severity

Heap-based Buffer Overflow

low severity

Heap-based Buffer Overflow

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

low severity

Integer Overflow or Wraparound

low severity

Out-of-Bounds

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Out-of-bounds Read

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Out-of-bounds Read

low severity

Out-of-bounds Read

low severity

Out-of-bounds Read

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Out-of-bounds Read

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Out-of-bounds Read

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Out-of-bounds Write

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Out-of-bounds Write

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Stack-based Buffer Overflow

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

low severity

Unchecked Return Value

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use After Free in GitHub repository vim/vim prior to 9.0.0046.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use After Free in GitHub repository vim/vim prior to 9.0.0213.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use After Free in GitHub repository vim/vim prior to 9.0.0225.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use After Free in GitHub repository vim/vim prior to 9.0.0246.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use After Free in GitHub repository vim/vim prior to 9.0.0221.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use After Free in GitHub repository vim/vim prior to 9.0.0490.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use After Free in GitHub repository vim/vim prior to 9.0.0614.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use After Free in GitHub repository vim/vim prior to 9.0.0530.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use After Free in GitHub repository vim/vim prior to 9.0.0882.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use After Free in GitHub repository vim/vim prior to 9.0.0789.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Incorrect Calculation of Buffer Size

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7
  • Fixed in: 0:7.29.0-51.el7_6.3

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)

Remediation

Upgrade Centos:7 curl to version 0:7.29.0-51.el7_6.3 or higher.

References

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libcurl provides the CURLOPT_CERTINFO option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

Out-of-bounds Read

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf8_str().

Remediation

There is no fixed version for Centos:7 glib2.

References

low severity
new

Memory Leak

  • Vulnerable module: krb5-libs
  • Introduced through: krb5-libs@1.15.1-34.el7

Detailed paths

  • Introduced through: centos@7.6.1810 krb5-libs@1.15.1-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

low severity
new

Memory Leak

  • Vulnerable module: krb5-libs
  • Introduced through: krb5-libs@1.15.1-34.el7

Detailed paths

  • Introduced through: centos@7.6.1810 krb5-libs@1.15.1-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

low severity
new

Memory Leak

  • Vulnerable module: krb5-libs
  • Introduced through: krb5-libs@1.15.1-34.el7

Detailed paths

  • Introduced through: centos@7.6.1810 krb5-libs@1.15.1-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

low severity

Incorrect Calculation of Buffer Size

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7
  • Fixed in: 0:7.29.0-51.el7_6.3

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)

Remediation

Upgrade Centos:7 libcurl to version 0:7.29.0-51.el7_6.3 or higher.

References

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libcurl provides the CURLOPT_CERTINFO option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

Out-of-Bounds

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.

Remediation

There is no fixed version for Centos:7 libgcc.

References

low severity

Out-of-Bounds

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5 incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() functions (as well as other similarly named encryption and decryption initialisation functions). Instead of using the custom cipher directly it incorrectly tries to fetch an equivalent cipher from the available providers. An equivalent cipher is found based on the NID passed to EVP_CIPHER_meth_new(). This NID is supposed to represent the unique NID for a given cipher. However it is possible for an application to incorrectly pass NID_undef as this value in the call to EVP_CIPHER_meth_new(). When NID_undef is used in this way the OpenSSL encryption/decryption initialisation function will match the NULL cipher as being equivalent and will fetch this from the available providers. This will succeed if the default provider has been loaded (or if a third party provider has been loaded that offers this cipher). Using the NULL cipher means that the plaintext is emitted as the ciphertext. Applications are only affected by this issue if they call EVP_CIPHER_meth_new() using NID_undef and subsequently use it in a call to an encryption/decryption initialisation function. Applications that only use SSL/TLS are not impacted by this issue. Fixed in OpenSSL 3.0.6 (Affected 3.0.0-3.0.5).

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

low severity

Improper Handling of Highly Compressed Data (Data Amplification)

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.

Remediation

There is no fixed version for Centos:7 python.

References

low severity

Improper Handling of Highly Compressed Data (Data Amplification)

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.

Remediation

There is no fixed version for Centos:7 python-libs.

References

low severity

Improper Input Validation

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.

Remediation

There is no fixed version for Centos:7 sqlite.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing.

Remediation

There is no fixed version for Centos:7 sqlite.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: libcom_err
  • Introduced through: libcom_err@1.42.9-13.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcom_err@1.42.9-13.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcom_err package and not the libcom_err package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247.

Remediation

There is no fixed version for Centos:7 libcom_err.

References

low severity

Divide By Zero

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

low severity

Heap-based Buffer Overflow

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Out-of-Bounds

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

vim is vulnerable to Heap-based Buffer Overflow

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.

Remediation

There is no fixed version for Centos:7 openldap.

References

low severity

Out-of-bounds Read

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

low severity

Out-of-bounds Read

low severity

Heap-based Buffer Overflow

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7
  • Fixed in: 0:7.29.0-57.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

Remediation

Upgrade Centos:7 curl to version 0:7.29.0-57.el7 or higher.

References

low severity

Use After Free

  • Vulnerable module: dbus
  • Introduced through: dbus@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors

Remediation

There is no fixed version for Centos:7 dbus.

References

low severity

Use After Free

  • Vulnerable module: dbus-libs
  • Introduced through: dbus-libs@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus-libs@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7
  • Fixed in: 0:7.29.0-57.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

Remediation

Upgrade Centos:7 libcurl to version 0:7.29.0-57.el7 or higher.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. The name of the patch is d0fab10ed2a86698937e3c3fed2f10bd9bb5e731. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-212324.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Out-of-Bounds

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Improper Input Validation

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message.

Remediation

There is no fixed version for Centos:7 bind-license.

References

low severity

Resource Exhaustion

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.

Remediation

There is no fixed version for Centos:7 glib2.

References

low severity

Resource Exhaustion

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

Remediation

There is no fixed version for Centos:7 glib2.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Out-of-bounds Read

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Resource Exhaustion

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Stack-based Buffer Overflow

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Out-of-bounds Read

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Resource Exhaustion

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Stack-based Buffer Overflow

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Out-of-bounds Read

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Resource Exhaustion

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Stack-based Buffer Overflow

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Reversible One-Way Hash

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions.

Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences.

The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the contents of vector registers in a different order than they are saved. Thus the contents of some of these vector registers are corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions.

The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service.

The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3. If this cipher is enabled on the server a malicious client can influence whether this AEAD cipher is used. This implies that TLS server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 python.

References

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 python-libs.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.

Remediation

There is no fixed version for Centos:7 glib2.

References

low severity

Resource Exhaustion

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.

Remediation

There is no fixed version for Centos:7 glib2.

References

low severity

Out-of-bounds Write

  • Vulnerable module: gnupg2
  • Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 gnupg2@2.0.22-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

Remediation

There is no fixed version for Centos:7 gnupg2.

References

low severity

Use of Uninitialized Resource

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: gawk
  • Introduced through: gawk@4.0.2-4.el7_3.1

Detailed paths

  • Introduced through: centos@7.6.1810 gawk@4.0.2-4.el7_3.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream gawk package and not the gawk package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.

Remediation

There is no fixed version for Centos:7 gawk.

References

low severity

Buffer Over-read

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to the "demangling of virtual tables."

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to inconsistent use of the long and int types for lengths.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

Use After Free

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7
  • Fixed in: 0:7.29.0-59.el7_9.2

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use after free vulnerability exists in curl <7.87.0. Curl can be asked to tunnel virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.

Remediation

Upgrade Centos:7 curl to version 0:7.29.0-59.el7_9.2 or higher.

References

low severity

Use After Free

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Remediation

There is no fixed version for Centos:7 glibc.

References

low severity

Use After Free

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

Use After Free

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7
  • Fixed in: 0:7.29.0-59.el7_9.2

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A use after free vulnerability exists in curl <7.87.0. Curl can be asked to tunnel virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.

Remediation

Upgrade Centos:7 libcurl to version 0:7.29.0-59.el7_9.2 or higher.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to inconsistent use of the long and int types for lengths.

Remediation

There is no fixed version for Centos:7 libgcc.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to the "demangling of virtual tables."

Remediation

There is no fixed version for Centos:7 libgcc.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to the "demangling of virtual tables."

Remediation

There is no fixed version for Centos:7 libstdc++.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to inconsistent use of the long and int types for lengths.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

low severity

Use After Free

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

Remediation

There is no fixed version for Centos:7 libxml2.

References

low severity

Use After Free

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

low severity

Covert Timing Channel

  • Vulnerable module: nss
  • Introduced through: nss@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites.

Remediation

There is no fixed version for Centos:7 nss.

References

low severity

Covert Timing Channel

  • Vulnerable module: nss-sysinit
  • Introduced through: nss-sysinit@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-sysinit@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites.

Remediation

There is no fixed version for Centos:7 nss-sysinit.

References

low severity

Covert Timing Channel

  • Vulnerable module: nss-tools
  • Introduced through: nss-tools@3.36.0-7.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-tools@3.36.0-7.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-tools package and not the nss-tools package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites.

Remediation

There is no fixed version for Centos:7 nss-tools.

References

low severity

Covert Timing Channel

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

low severity

Resource Exhaustion

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A security vulnerability has been identified in all supported versions

of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems.

Policy processing is disabled by default but can be enabled by passing the -policy&#39; argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

low severity

Buffer Overflow

  • Vulnerable module: file-libs
  • Introduced through: file-libs@5.11-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 file-libs@5.11-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream file-libs package and not the file-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.

Remediation

There is no fixed version for Centos:7 file-libs.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: gpgme
  • Introduced through: gpgme@1.3.2-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 gpgme@1.3.2-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream gpgme package and not the gpgme package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Multiple heap-based buffer overflows in the status_handler function in (1) engine-gpgsm.c and (2) engine-uiserver.c in GPGME before 1.5.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to "different line lengths in a specific order."

Remediation

There is no fixed version for Centos:7 gpgme.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Improper Input Validation

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, has an unchecked strnlen operation. Remote attackers could leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Improper Input Validation

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can cause a denial of service via a crafted file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new, that can cause a denial of service via a crafted file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability. This flaw affects binutils versions prior to 2.34.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to an invalid read in process_symbol_table, as demonstrated in readeif.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Uncontrolled Recursion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Information Exposure

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

Out-of-bounds Read

  • Vulnerable module: file-libs
  • Introduced through: file-libs@5.11-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 file-libs@5.11-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream file-libs package and not the file-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.

Remediation

There is no fixed version for Centos:7 file-libs.

References

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.

Remediation

There is no fixed version for Centos:7 glibc.

References

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

low severity

Information Exposure

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

Resource Exhaustion

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

Remediation

There is no fixed version for Centos:7 libgcc.

References

low severity

Resource Exhaustion

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser.

Remediation

There is no fixed version for Centos:7 libxml2.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack

Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly.

A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue.

OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass().

We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant.

The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

low severity

Out-of-Bounds

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Remediation

There is no fixed version for Centos:7 sqlite.

References

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: tar
  • Introduced through: tar@2:1.26-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 tar@2:1.26-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).

Remediation

There is no fixed version for Centos:7 tar.

References

low severity

Incorrect Privilege Assignment

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Incorrect Privilege Assignment

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

low severity

NULL Pointer Dereference

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

vim 8.2.2348 is affected by null pointer dereference, allows local attackers to cause a denial of service (DoS) via the ex_buffer_all method.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Out-of-bounds Read

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

vim is vulnerable to Heap-based Buffer Overflow

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Undefined Behavior for Input to API

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Out-of-bounds Read

  • Vulnerable module: file-libs
  • Introduced through: file-libs@5.11-35.el7
  • Fixed in: 0:5.11-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 file-libs@5.11-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream file-libs package and not the file-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.

Remediation

Upgrade Centos:7 file-libs to version 0:5.11-36.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.

Remediation

There is no fixed version for Centos:7 libxml2.

References

low severity

Out-of-bounds Read

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted binary.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Use After Free

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "btypevec."

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Use After Free

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "ktypevec."

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The curl_getdate function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

Link Following

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)

Remediation

There is no fixed version for Centos:7 glib2.

References

low severity

Out-of-bounds Read

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The curl_getdate function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

Out-of-bounds Read

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted binary.

Remediation

There is no fixed version for Centos:7 libgcc.

References

low severity

Out-of-bounds Read

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary.

Remediation

There is no fixed version for Centos:7 libgcc.

References

low severity

Use After Free

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "ktypevec."

Remediation

There is no fixed version for Centos:7 libgcc.

References

low severity

Use After Free

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "btypevec."

Remediation

There is no fixed version for Centos:7 libgcc.

References

low severity

Out-of-bounds Read

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted binary.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

low severity

Out-of-bounds Read

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

low severity

Use After Free

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "ktypevec."

Remediation

There is no fixed version for Centos:7 libstdc++.

References

low severity

Use After Free

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "btypevec."

Remediation

There is no fixed version for Centos:7 libstdc++.

References

low severity

Excessive Iteration

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Issue summary: Checking excessively long DH keys or parameters may be very slow.

Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.

The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p.

An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack.

The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check().

Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

low severity

Improper Certificate Validation

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification.

As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function.

Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument.

Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

low severity

Improper Certificate Validation

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks.

Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether.

Policy processing is disabled by default but can be enabled by passing the -policy&#39; argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

low severity

Missing Required Cryptographic Step

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow.

Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.

While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters.

Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q.

An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack.

DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().

Also vulnerable are the OpenSSL pkey command line application when using the "-pubcheck" option, as well as the OpenSSL genpkey command line application.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

low severity

Resource Exhaustion

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Issue summary: Checking excessively long DH keys or parameters may be very slow.

Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.

The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length.

However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large.

An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack.

The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check().

Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option.

The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

low severity

Integer Overflow or Wraparound

low severity

Heap-based Buffer Overflow

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

low severity

Heap-based Buffer Overflow

low severity

Incorrect Calculation of Buffer Size

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Out-of-bounds Write

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Information Exposure

  • Vulnerable module: readline
  • Introduced through: readline@6.2-10.el7

Detailed paths

  • Introduced through: centos@7.6.1810 readline@6.2-10.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream readline package and not the readline package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo.

Remediation

There is no fixed version for Centos:7 readline.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: coreutils
  • Introduced through: coreutils@8.22-23.el7

Detailed paths

  • Introduced through: centos@7.6.1810 coreutils@8.22-23.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream coreutils package and not the coreutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings.

Remediation

There is no fixed version for Centos:7 coreutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: coreutils
  • Introduced through: coreutils@8.22-23.el7

Detailed paths

  • Introduced through: centos@7.6.1810 coreutils@8.22-23.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream coreutils package and not the coreutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified other impact via long strings.

Remediation

There is no fixed version for Centos:7 coreutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: libblkid
  • Introduced through: libblkid@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libblkid@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libblkid package and not the libblkid package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.

Remediation

There is no fixed version for Centos:7 libblkid.

References

low severity

Out-of-Bounds

  • Vulnerable module: libmount
  • Introduced through: libmount@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libmount@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libmount package and not the libmount package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.

Remediation

There is no fixed version for Centos:7 libmount.

References

low severity

Out-of-Bounds

  • Vulnerable module: libuuid
  • Introduced through: libuuid@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libuuid@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libuuid package and not the libuuid package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.

Remediation

There is no fixed version for Centos:7 libuuid.

References

low severity

Out-of-Bounds

  • Vulnerable module: util-linux
  • Introduced through: util-linux@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 util-linux@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.

Remediation

There is no fixed version for Centos:7 util-linux.

References

low severity

Improper Authentication

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

Out-of-bounds Read

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

Improper Authentication

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

Out-of-bounds Read

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

Stack-based Buffer Overflow

  • Vulnerable module: libxml2
  • Introduced through: libxml2@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.

Remediation

There is no fixed version for Centos:7 libxml2.

References

low severity

Stack-based Buffer Overflow

  • Vulnerable module: libxml2-python
  • Introduced through: libxml2-python@2.9.1-6.el7_2.3

Detailed paths

  • Introduced through: centos@7.6.1810 libxml2-python@2.9.1-6.el7_2.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2-python package and not the libxml2-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.

Remediation

There is no fixed version for Centos:7 libxml2-python.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

low severity

Use After Free

low severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption problem caused by the cplus_demangle_type function making recursive calls to itself in certain scenarios involving many 'P' characters.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Improper Input Validation

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Use of Uninitialized Variable

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in Binutils. The field the_bfd of asymbolstruct is uninitialized in the bfd_mach_o_get_synthetic_symtab function, which may lead to an application crash and local denial of service.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Use of Uninitialized Variable

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: libblkid
  • Introduced through: libblkid@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libblkid@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libblkid package and not the libblkid package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

Remediation

There is no fixed version for Centos:7 libblkid.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: libmount
  • Introduced through: libmount@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libmount@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libmount package and not the libmount package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

Remediation

There is no fixed version for Centos:7 libmount.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: libuuid
  • Introduced through: libuuid@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libuuid@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libuuid package and not the libuuid package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

Remediation

There is no fixed version for Centos:7 libuuid.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_match that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-party

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_match that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-party

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_match that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-party

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Incorrect Implementation of Authentication Algorithm

  • Vulnerable module: shadow-utils
  • Introduced through: shadow-utils@2:4.1.5.1-25.el7

Detailed paths

  • Introduced through: centos@7.6.1810 shadow-utils@2:4.1.5.1-25.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream shadow-utils package and not the shadow-utils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

Remediation

There is no fixed version for Centos:7 shadow-utils.

References

low severity

Use After Free

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.

Remediation

There is no fixed version for Centos:7 sqlite.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: util-linux
  • Introduced through: util-linux@2.23.2-59.el7

Detailed paths

  • Introduced through: centos@7.6.1810 util-linux@2.23.2-59.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

Remediation

There is no fixed version for Centos:7 util-linux.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a :s command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive :s call causes free-ing of memory which may later then be accessed by the initial :s command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as demonstrated by nm.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. The vulnerability can trigger program crashes. It may lead to an information leak as well.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2line, size, and strings. It could lead to information disclosure as well.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Incorrect Permission Assignment for Critical Resource

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.

Remediation

There is no fixed version for Centos:7 glib2.

References

low severity

Improper Initialization

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.

Remediation

There is no fixed version for Centos:7 libgcc.

References

low severity

Improper Initialization

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

low severity

Stack-based Buffer Overflow

  • Vulnerable module: procps-ng
  • Introduced through: procps-ng@3.3.10-23.el7

Detailed paths

  • Introduced through: centos@7.6.1810 procps-ng@3.3.10-23.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream procps-ng package and not the procps-ng package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.

Remediation

There is no fixed version for Centos:7 procps-ng.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use After Free in GitHub repository vim/vim prior to 9.0.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The get_count function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31, allows remote attackers to cause a denial of service (malloc called with the result of an integer-overflowing calculation) or possibly have unspecified other impact via a crafted string, as demonstrated by c++filt.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions next_is_type_qual() and cplus_demangle_type() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there is a stack consumption problem caused by recursive stack frames: cplus_demangle_type, d_bare_function_type, d_function_type.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions d_name(), d_encoding(), and d_local_name() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Use After Free

  • Vulnerable module: bzip2-libs
  • Introduced through: bzip2-libs@1.0.6-13.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bzip2-libs@1.0.6-13.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bzip2-libs package and not the bzip2-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.

Remediation

There is no fixed version for Centos:7 bzip2-libs.

References

low severity

Out-of-bounds Write

  • Vulnerable module: cpio
  • Introduced through: cpio@2.11-27.el7

Detailed paths

  • Introduced through: centos@7.6.1810 cpio@2.11-27.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream cpio package and not the cpio package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.

Remediation

There is no fixed version for Centos:7 cpio.

References

low severity

Use After Free

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.

Remediation

Upgrade Centos:7 elfutils-default-yama-scope to version 0:0.176-2.el7 or higher.

References

low severity

Use After Free

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.

Remediation

Upgrade Centos:7 elfutils-libelf to version 0:0.176-2.el7 or higher.

References

low severity

Use After Free

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.

Remediation

Upgrade Centos:7 elfutils-libs to version 0:0.176-2.el7 or higher.

References

low severity

Memory Leak

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.

Remediation

There is no fixed version for Centos:7 sqlite.

References

low severity

Improper Handling of Exceptional Conditions

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling is enabled and the cpo-settings include the 'n' flag. This may happen when a window border is present and when the wrapped line continues on the next physical line directly in the window border because the 'cpo' setting includes the 'n' flag. Only users with non-default settings are affected and the exception should only result in a crash. This issue has been addressed in commit cb0b99f0 which has been included in release version 9.0.2107. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit 58f9befca1 which has been included in release version 9.0.2109. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the overflow. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit 060623e which has been included in release version 9.0.2110. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit ac6378773 which has been included in release version 9.0.2108. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has been addressed in commit 73b2d379 which has been included in release version 9.0.2111. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit 6bf131888 which has been included in version 9.0.2112. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit 25aabc2b which has been included in release version 9.0.2106. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Improper Validation of Certificate with Host Mismatch

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

Remediation

There is no fixed version for Centos:7 openldap.

References

low severity

Out-of-bounds Write

  • Vulnerable module: bzip2-libs
  • Introduced through: bzip2-libs@1.0.6-13.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bzip2-libs@1.0.6-13.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bzip2-libs package and not the bzip2-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

Remediation

There is no fixed version for Centos:7 bzip2-libs.

References

low severity

Link Following

  • Vulnerable module: cpio
  • Introduced through: cpio@2.11-27.el7

Detailed paths

  • Introduced through: centos@7.6.1810 cpio@2.11-27.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream cpio package and not the cpio package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

Remediation

There is no fixed version for Centos:7 cpio.

References

low severity

Out-of-bounds Write

  • Vulnerable module: cracklib
  • Introduced through: cracklib@2.9.0-11.el7

Detailed paths

  • Introduced through: centos@7.6.1810 cracklib@2.9.0-11.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream cracklib package and not the cracklib package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack-based buffer overflow in the FascistGecosUser function in lib/fascist.c in cracklib allows local users to cause a denial of service (application crash) or gain privileges via a long GECOS field, involving longbuffer.

Remediation

There is no fixed version for Centos:7 cracklib.

References

low severity

Out-of-bounds Write

  • Vulnerable module: cracklib-dicts
  • Introduced through: cracklib-dicts@2.9.0-11.el7

Detailed paths

  • Introduced through: centos@7.6.1810 cracklib-dicts@2.9.0-11.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream cracklib-dicts package and not the cracklib-dicts package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack-based buffer overflow in the FascistGecosUser function in lib/fascist.c in cracklib allows local users to cause a denial of service (application crash) or gain privileges via a long GECOS field, involving longbuffer.

Remediation

There is no fixed version for Centos:7 cracklib-dicts.

References

low severity

Algorithmic Complexity

  • Vulnerable module: dbus
  • Introduced through: dbus@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a denial of service (CPU consumption) via a large number of method calls.

Remediation

There is no fixed version for Centos:7 dbus.

References

low severity

Resource Exhaustion

  • Vulnerable module: dbus
  • Introduced through: dbus@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor.

Remediation

There is no fixed version for Centos:7 dbus.

References

low severity

Resource Exhaustion

  • Vulnerable module: dbus
  • Introduced through: dbus@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.

Remediation

There is no fixed version for Centos:7 dbus.

References

low severity

Resource Management Errors

  • Vulnerable module: dbus
  • Introduced through: dbus@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descriptors for a single sendmsg call.

Remediation

There is no fixed version for Centos:7 dbus.

References

low severity

Algorithmic Complexity

  • Vulnerable module: dbus-libs
  • Introduced through: dbus-libs@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus-libs@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a denial of service (CPU consumption) via a large number of method calls.

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

low severity

Resource Exhaustion

  • Vulnerable module: dbus-libs
  • Introduced through: dbus-libs@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus-libs@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor.

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

low severity

Resource Exhaustion

  • Vulnerable module: dbus-libs
  • Introduced through: dbus-libs@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus-libs@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

low severity

Resource Management Errors

  • Vulnerable module: dbus-libs
  • Introduced through: dbus-libs@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus-libs@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descriptors for a single sendmsg call.

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

low severity

Out-of-Bounds

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

low severity

Resource Exhaustion

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) via crafted file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

low severity

Out-of-Bounds

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

low severity

Resource Exhaustion

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) via crafted file.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

low severity

Out-of-Bounds

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

low severity

Resource Exhaustion

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) via crafted file.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.

Remediation

There is no fixed version for Centos:7 glibc.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

low severity

Improper Input Validation

  • Vulnerable module: libtasn1
  • Introduced through: libtasn1@4.10-1.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libtasn1@4.10-1.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libtasn1 package and not the libtasn1 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.

Remediation

There is no fixed version for Centos:7 libtasn1.

References

low severity

Information Exposure

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command.

Remediation

There is no fixed version for Centos:7 systemd.

References

low severity

Information Exposure

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command.

Remediation

There is no fixed version for Centos:7 systemd-libs.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function ga_grow_inner in in the file src/alloc.c at line 748, which is freed in the file src/ex_docmd.c in the function do_cmdline at line 1010 and then used again in src/cmdhist.c at line 759. When using the :history command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: procps-ng
  • Introduced through: procps-ng@3.3.10-23.el7

Detailed paths

  • Introduced through: centos@7.6.1810 procps-ng@3.3.10-23.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream procps-ng package and not the procps-ng package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).

Remediation

There is no fixed version for Centos:7 procps-ng.

References

low severity

Time-of-check Time-of-use (TOCTOU)

  • Vulnerable module: procps-ng
  • Introduced through: procps-ng@3.3.10-23.el7

Detailed paths

  • Introduced through: centos@7.6.1810 procps-ng@3.3.10-23.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream procps-ng package and not the procps-ng package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.

Remediation

There is no fixed version for Centos:7 procps-ng.

References

low severity

Authentication Bypass

  • Vulnerable module: bind-license
  • Introduced through: bind-license@32:9.9.4-72.el7

Detailed paths

  • Introduced through: centos@7.6.1810 bind-license@32:9.9.4-72.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Cache Poisoning issue exists in DNS Response Rate Limiting.

Remediation

There is no fixed version for Centos:7 bind-license.

References

low severity

Improper Input Validation

  • Vulnerable module: coreutils
  • Introduced through: coreutils@8.22-23.el7

Detailed paths

  • Introduced through: centos@7.6.1810 coreutils@8.22-23.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream coreutils package and not the coreutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command.

Remediation

There is no fixed version for Centos:7 coreutils.

References

low severity

Directory Traversal

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde () character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /2/foo while accessing a server with a specific user.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

Expected Behavior Violation

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

External Control of File Name or Path

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers.

libcurl provides a function call that duplicates en easy handle called curl_easy_duphandle.

If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as none (using the four ASCII letters, no quotes).

Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named none - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

Improper Authentication

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The URL percent-encoding decode function in libcurl before 7.51.0 is called curl_easy_unescape. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

Untrusted Pointer Dereference

low severity

Buffer Overflow

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Remediation

There is no fixed version for Centos:7 glib2.

References

low severity

Improper Input Validation

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file.

Remediation

There is no fixed version for Centos:7 glib2.

References

low severity

Improper Input Validation

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.

Remediation

There is no fixed version for Centos:7 glib2.

References

low severity

Improper Input Validation

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.

Remediation

There is no fixed version for Centos:7 glib2.

References

low severity

Use After Free

  • Vulnerable module: krb5-libs
  • Introduced through: krb5-libs@1.15.1-34.el7

Detailed paths

  • Introduced through: centos@7.6.1810 krb5-libs@1.15.1-34.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.

Remediation

There is no fixed version for Centos:7 krb5-libs.

References

low severity

Directory Traversal

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde () character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /2/foo while accessing a server with a specific user.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

Expected Behavior Violation

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

External Control of File Name or Path

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers.

libcurl provides a function call that duplicates en easy handle called curl_easy_duphandle.

If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as none (using the four ASCII letters, no quotes).

Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named none - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

Improper Authentication

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The URL percent-encoding decode function in libcurl before 7.51.0 is called curl_easy_unescape. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

Untrusted Pointer Dereference

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

low severity

Improper Input Validation

  • Vulnerable module: libidn
  • Introduced through: libidn@1.28-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libidn@1.28-4.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libidn package and not the libidn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.

Remediation

There is no fixed version for Centos:7 libidn.

References

low severity

Out-of-bounds Read

  • Vulnerable module: libidn
  • Introduced through: libidn@1.28-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libidn@1.28-4.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libidn package and not the libidn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read.

Remediation

There is no fixed version for Centos:7 libidn.

References

low severity

Out-of-bounds Read

  • Vulnerable module: libidn
  • Introduced through: libidn@1.28-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libidn@1.28-4.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libidn package and not the libidn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read.

Remediation

There is no fixed version for Centos:7 libidn.

References

low severity

Out-of-bounds Read

  • Vulnerable module: libidn
  • Introduced through: libidn@1.28-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libidn@1.28-4.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libidn package and not the libidn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read, a different vulnerability than CVE-2015-8948.

Remediation

There is no fixed version for Centos:7 libidn.

References

low severity

Out-of-bounds Read

  • Vulnerable module: libidn
  • Introduced through: libidn@1.28-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libidn@1.28-4.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libidn package and not the libidn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.

Remediation

There is no fixed version for Centos:7 libidn.

References

low severity

Unchecked Return Value

  • Vulnerable module: libssh2
  • Introduced through: libssh2@1.4.3-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libssh2@1.4.3-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

Remediation

There is no fixed version for Centos:7 libssh2.

References

low severity

Incorrect Calculation

  • Vulnerable module: nss-softokn
  • Introduced through: nss-softokn@3.36.0-5.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn package and not the nss-softokn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, improperly divides numbers, which might make it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging use of the (1) mp_div or (2) mp_exptmod function.

Remediation

There is no fixed version for Centos:7 nss-softokn.

References

low severity

Incorrect Calculation

  • Vulnerable module: nss-softokn-freebl
  • Introduced through: nss-softokn-freebl@3.36.0-5.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 nss-softokn-freebl@3.36.0-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-softokn-freebl package and not the nss-softokn-freebl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, improperly divides numbers, which might make it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging use of the (1) mp_div or (2) mp_exptmod function.

Remediation

There is no fixed version for Centos:7 nss-softokn-freebl.

References

low severity

Information Exposure

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

low severity

Improper Input Validation

  • Vulnerable module: pcre
  • Introduced through: pcre@8.32-17.el7

Detailed paths

  • Introduced through: centos@7.6.1810 pcre@8.32-17.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre package and not the pcre package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.

Remediation

There is no fixed version for Centos:7 pcre.

References

low severity

Improper Input Validation

  • Vulnerable module: pcre
  • Introduced through: pcre@8.32-17.el7

Detailed paths

  • Introduced through: centos@7.6.1810 pcre@8.32-17.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre package and not the pcre package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.

Remediation

There is no fixed version for Centos:7 pcre.

References

low severity

Improper Input Validation

  • Vulnerable module: pcre
  • Introduced through: pcre@8.32-17.el7

Detailed paths

  • Introduced through: centos@7.6.1810 pcre@8.32-17.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre package and not the pcre package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file.

Remediation

There is no fixed version for Centos:7 pcre.

References

low severity

Out-of-bounds Read

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7
  • Fixed in: 0:7.29.0-54.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

Remediation

Upgrade Centos:7 curl to version 0:7.29.0-54.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7
  • Fixed in: 0:7.29.0-54.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

Remediation

Upgrade Centos:7 libcurl to version 0:7.29.0-54.el7 or higher.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: python
  • Introduced through: python@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python package and not the python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.

Remediation

There is no fixed version for Centos:7 python.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: python-libs
  • Introduced through: python-libs@2.7.5-76.el7

Detailed paths

  • Introduced through: centos@7.6.1810 python-libs@2.7.5-76.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-libs package and not the python-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.

Remediation

There is no fixed version for Centos:7 python-libs.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.

Remediation

There is no fixed version for Centos:7 sqlite.

References

low severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNU Binutils 2.28 allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file with many program headers, related to the get_program_headers function in readelf.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Divide By Zero

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the PLT section size, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to elf_i386_get_synthetic_symtab in elf32-i386.c and elf_x86_64_get_synthetic_symtab in elf64-x86-64.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The _bfd_elf_parse_attributes function in elf-attrs.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (_bfd_elf_attr_strdup heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The pe_print_idata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles HintName vector entries, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PE file, related to the bfd_getl16 function.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

bfd_get_debug_link_info_1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to bfd_getl32.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The read_section function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (parse_comp_unit heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a length calculation, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to read_1_byte.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The decode_line_info function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (read_1_byte heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file, related to parse_die and parse_line_table, as demonstrated by a parse_die heap-based buffer over-read.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The _bfd_coff_read_string_table function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not properly validate the size of the external string table, which allows remote attackers to cause a denial of service (excessive memory consumption, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted COFF binary.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 does not have integer-overflow protection on 32-bit platforms, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that is vulnerable to a heap-based buffer over-read (off-by-one) because of an incomplete check for invalid string offsets while loading symbols, leading to a GNU linker (ld) program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to the byte_get_little_endian function in elfcomm.c, the get_unwind_section_word function in readelf.c, and ARM unwind information that contains invalid word offsets.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to MIPS GOT mishandling in the process_mips_specific function in readelf.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write of 8 bytes. This can occur during execution of objdump.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Improper Input Validation

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The load_debug_section function in readelf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via an ELF file that lacks section headers.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Improper Input Validation

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The coff_slurp_line_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted PE file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Improper Input Validation

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (memory access violation) or possibly have unspecified other impact via a COFF binary in which a relocation refers to a location after the end of the to-be-relocated section.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Improper Input Validation

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

readelf.c in GNU Binutils 2017-04-12 has a "shift exponent too large for type unsigned long" issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Improper Input Validation

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Improper Null Termination

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNU linker (ld) in GNU Binutils 2.28 is vulnerable to a heap-based buffer overflow while processing a bogus input script, leading to a program crash. This relates to lack of '\0' termination of a name field in ldlex.l.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Incorrect Type Conversion or Cast

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

readelf.c in GNU Binutils 2017-04-12 has a "cannot be represented in type long" issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpret a -1 value as a sorting count instead of an error flag, which allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate the symbol count, which allows remote attackers to cause a denial of service (integer overflow and application crash, or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The display_debug_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (integer overflow and heap-based buffer over-read, and application crash) or possibly have unspecified other impact via a crafted ELF file, related to print_debug_frame.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The pe_bfd_read_buildid function in peicode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate size and offset values in the data dictionary, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA macro in elf.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

process_debug_info in dwarf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file that contains a negative size value in a CU structure.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a group section that is too small.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The bfd_make_section_with_flags function in section.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a NULL dereference via a crafted file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

scan_unit_for_symbols in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles NULL files in a .debug_line file table, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename. NOTE: this issue is caused by an incomplete fix for CVE-2017-15023.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandle the failure of a certain canonicalization step, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the DW_AT_name data type, which allows remote attackers to cause a denial of service (bfd_hash_hash NULL pointer dereference, or out-of-bounds access, and application crash) via a crafted ELF file, related to scan_unit_for_symbols and parse_comp_unit.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not properly validate the format count, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The coff_slurp_reloc_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted COFF based file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The find_nearest_line function in addr2line in GNU Binutils 2.28 does not handle the case where the main file name and the directory name are both empty, triggering a NULL pointer dereference and an invalid write, and leading to a program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The dump_section_as_bytes function in readelf in GNU Binutils 2.28 accesses a NULL pointer while reading section contents in a corrupt binary, leading to a program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member access within null pointer" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an "int main() {return 0;}" program.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNU Binutils 2017-04-03 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash), related to the process_mips_specific function in readelf.c, via a crafted ELF file that triggers a large memory-allocation attempt.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 4 due to NULL pointer dereferencing of _bfd_elf_large_com_section. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 8 because of missing a check to determine whether symbols are NULL in the _bfd_dwarf2_find_nearest_line function. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in elf_link_input_bfd in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the merge_strings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in work_stuff_copy_to_from when called from iterate_demangle_function.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Off-by-one Error

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that has an off-by-one vulnerability because it does not carefully check the string offset. The vulnerability could lead to a GNU linker (ld) program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The elf_read_notesfunction in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggers a "buffer overflow on fuzzed archive header," related to an uninitialized variable, an improper conditional jump, and the get_archive_member_name, process_archive_index_and_symbols, and setup_archive functions.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

nm.c and objdump.c in GNU Binutils 2.29.1 mishandle certain global symbols, which allows remote attackers to cause a denial of service (_bfd_elf_get_symbol_version_string buffer over-read and application crash) or possibly have unspecified other impact via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The sh_elf_set_mach_from_flags function in bfd/elf32-sh.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The print_insn_score32 function in opcodes/score7-dis.c:552 in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. NOTE: this may be related to a compiler bug.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The versados_mkobject function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not initialize a certain data structure, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of rae insns printing for this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The _bfd_vms_slurp_etir function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The process_otr function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not validate a certain offset, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

opcodes/i386-dis.c in GNU Binutils 2.28 does not consider the number of registers for bnd mode, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The regs macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The score_opcodes function in opcodes/score7-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The ieee_archive_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. NOTE: this may be related to a compiler bug.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file in the _bfd_vms_get_value and _bfd_vms_slurp_etir functions during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

opcodes/rl78-decode.opc in GNU Binutils 2.28 has an unbounded GETBYTE macro, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executable objdump.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted mach-o file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted nlm file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds stack read via a crafted COFF image file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The _bfd_elf_parse_gnu_properties function in elf-properties.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not prevent negative pointers, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, miscalculates DW_FORM_ref_addr die refs in the case of a relocatable object file, which allows remote attackers to cause a denial of service (find_abstract_instance_name invalid memory read, segmentation fault, and application crash).

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate sizes of core notes, which allows remote attackers to cause a denial of service (bfd_getl32 heap-based buffer over-read and application crash) via a crafted object file, related to elfcore_grok_netbsd_procinfo, elfcore_grok_openbsd_procinfo, and elfcore_grok_nto_status.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an invalid read (of size 8) because the code to emit relocs (bfd_elf_final_link function in bfd/elflink.c) does not check the format of the input file before trying to read the ELF reloc section header. The vulnerability leads to a GNU linker (ld) program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 4) because of missing a check (in the find_link function) for null headers before attempting to match them. This vulnerability causes Binutils utilities like strip to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 8) because of missing a check (in the copy_special_section_fields function) for an invalid sh_link field before attempting to follow it. This vulnerability causes Binutils utilities like strip to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

objdump in GNU Binutils 2.28 is vulnerable to multiple heap-based buffer over-reads (of size 1 and size 8) while handling corrupt STABS enum type strings in a crafted object file, leading to program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip, that SHT_REL/SHR_RELA sections are always named starting with a .rel/.rela prefix. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy and strip, to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a swap_std_reloc_out function in bfd/aoutx.h that is vulnerable to an invalid read (of size 4) because of missing checks for relocs that could not be recognised. This vulnerability causes Binutils utilities like strip to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 and an invalid write of size 1 during processing of a corrupt binary containing reloc(s) with negative addresses. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The print_symbol_for_build_attribute function in readelf.c in GNU Binutils 2017-04-12 allows remote attackers to cause a denial of service (invalid read and SEGV) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 because the existing reloc offset range tests didn't catch small negative offsets less than the size of the reloc field. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

dwarf.c in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. This vulnerability causes programs that conduct an analysis of binary programs, such as objdump and readelf, to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The get_build_id function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file in which a certain size field is larger than a corresponding data field, as demonstrated by mishandling within the objdump program.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The getvalue function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted tekhex file, as demonstrated by mishandling within the nm program.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Read

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, because _bfd_add_merge_section mishandles section merges when size is not a multiple of entsize. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Write

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow (of size 1) while attempting to unget an EOF character from the input stream, potentially leading to a program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Write

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The find_nearest_line function in objdump in GNU Binutils 2.28 is vulnerable to an invalid write (of size 1) while disassembling a corrupt binary that contains an empty function name, leading to a program crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-bounds Write

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid write of size 8 because of missing a malloc() return-value check to see if memory had actually been allocated in the _bfd_generic_get_section_contents function. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Memory leak in decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

_bfd_dwarf2_cleanup_debug_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (memory leak) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

_bfd_elf_slurp_version_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to cause a denial of service (excessive memory allocation, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PE file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory exhaustion in objdump via a crafted PE file. Additional validation in dump_relocs_in_section in objdump.c can resolve this.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) during the "Create an array for saving the template argument values" XNEWVEC call. This can occur during execution of objdump.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Resource Exhaustion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted ELF file, leading to a denial of service (memory consumption), as demonstrated by nm.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Uncontrolled Recursion

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

find_abstract_instance_name in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Use After Free

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The aout_get_external_symbols function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (slurp_symtab invalid free and application crash) or possibly have unspecified other impact via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Use After Free

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

Improper Authorization

  • Vulnerable module: dbus
  • Introduced through: dbus@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus package and not the dbus package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.

Remediation

There is no fixed version for Centos:7 dbus.

References

low severity

Improper Authorization

  • Vulnerable module: dbus-libs
  • Introduced through: dbus-libs@1:1.10.24-12.el7

Detailed paths

  • Introduced through: centos@7.6.1810 dbus-libs@1:1.10.24-12.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-libs package and not the dbus-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.

Remediation

There is no fixed version for Centos:7 dbus-libs.

References

low severity

Divide By Zero

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.

Remediation

Upgrade Centos:7 elfutils-default-yama-scope to version 0:0.176-2.el7 or higher.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.

Remediation

Upgrade Centos:7 elfutils-default-yama-scope to version 0:0.176-2.el7 or higher.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.

Remediation

Upgrade Centos:7 elfutils-default-yama-scope to version 0:0.176-2.el7 or higher.

References

low severity

Improper Input Validation

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

low severity

Improper Input Validation

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

low severity

Out-of-Bounds

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The __libelf_set_rawdata_wrlock function in elf_getdata.c in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted (1) sh_off or (2) sh_size ELF header value, which triggers a memory allocation failure.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

low severity

Out-of-Bounds

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The allocate_elf function in common.h in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted ELF file, which triggers a memory allocation failure.

Remediation

There is no fixed version for Centos:7 elfutils-default-yama-scope.

References

low severity

Out-of-Bounds

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.

Remediation

Upgrade Centos:7 elfutils-default-yama-scope to version 0:0.176-2.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.

Remediation

Upgrade Centos:7 elfutils-default-yama-scope to version 0:0.176-2.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.

Remediation

Upgrade Centos:7 elfutils-default-yama-scope to version 0:0.176-2.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.

Remediation

Upgrade Centos:7 elfutils-default-yama-scope to version 0:0.176-2.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.

Remediation

Upgrade Centos:7 elfutils-default-yama-scope to version 0:0.176-2.el7 or higher.

References

low severity

Out-of-bounds Write

  • Vulnerable module: elfutils-default-yama-scope
  • Introduced through: elfutils-default-yama-scope@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-default-yama-scope@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-default-yama-scope package and not the elfutils-default-yama-scope package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).

Remediation

Upgrade Centos:7 elfutils-default-yama-scope to version 0:0.176-2.el7 or higher.

References

low severity

Divide By Zero

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.

Remediation

Upgrade Centos:7 elfutils-libelf to version 0:0.176-2.el7 or higher.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.

Remediation

Upgrade Centos:7 elfutils-libelf to version 0:0.176-2.el7 or higher.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.

Remediation

Upgrade Centos:7 elfutils-libelf to version 0:0.176-2.el7 or higher.

References

low severity

Improper Input Validation

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

low severity

Improper Input Validation

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

low severity

Out-of-Bounds

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The allocate_elf function in common.h in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted ELF file, which triggers a memory allocation failure.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

low severity

Out-of-Bounds

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The __libelf_set_rawdata_wrlock function in elf_getdata.c in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted (1) sh_off or (2) sh_size ELF header value, which triggers a memory allocation failure.

Remediation

There is no fixed version for Centos:7 elfutils-libelf.

References

low severity

Out-of-Bounds

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.

Remediation

Upgrade Centos:7 elfutils-libelf to version 0:0.176-2.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.

Remediation

Upgrade Centos:7 elfutils-libelf to version 0:0.176-2.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.

Remediation

Upgrade Centos:7 elfutils-libelf to version 0:0.176-2.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.

Remediation

Upgrade Centos:7 elfutils-libelf to version 0:0.176-2.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.

Remediation

Upgrade Centos:7 elfutils-libelf to version 0:0.176-2.el7 or higher.

References

low severity

Out-of-bounds Write

  • Vulnerable module: elfutils-libelf
  • Introduced through: elfutils-libelf@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libelf@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libelf package and not the elfutils-libelf package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).

Remediation

Upgrade Centos:7 elfutils-libelf to version 0:0.176-2.el7 or higher.

References

low severity

Divide By Zero

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.

Remediation

Upgrade Centos:7 elfutils-libs to version 0:0.176-2.el7 or higher.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.

Remediation

Upgrade Centos:7 elfutils-libs to version 0:0.176-2.el7 or higher.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.

Remediation

Upgrade Centos:7 elfutils-libs to version 0:0.176-2.el7 or higher.

References

low severity

Improper Input Validation

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

low severity

Improper Input Validation

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

low severity

Out-of-Bounds

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The allocate_elf function in common.h in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted ELF file, which triggers a memory allocation failure.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

low severity

Out-of-Bounds

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The __libelf_set_rawdata_wrlock function in elf_getdata.c in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted (1) sh_off or (2) sh_size ELF header value, which triggers a memory allocation failure.

Remediation

There is no fixed version for Centos:7 elfutils-libs.

References

low severity

Out-of-Bounds

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.

Remediation

Upgrade Centos:7 elfutils-libs to version 0:0.176-2.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.

Remediation

Upgrade Centos:7 elfutils-libs to version 0:0.176-2.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.

Remediation

Upgrade Centos:7 elfutils-libs to version 0:0.176-2.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.

Remediation

Upgrade Centos:7 elfutils-libs to version 0:0.176-2.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.

Remediation

Upgrade Centos:7 elfutils-libs to version 0:0.176-2.el7 or higher.

References

low severity

Out-of-bounds Write

  • Vulnerable module: elfutils-libs
  • Introduced through: elfutils-libs@0.172-2.el7
  • Fixed in: 0:0.176-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 elfutils-libs@0.172-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils-libs package and not the elfutils-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).

Remediation

Upgrade Centos:7 elfutils-libs to version 0:0.176-2.el7 or higher.

References

low severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: file-libs
  • Introduced through: file-libs@5.11-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 file-libs@5.11-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream file-libs package and not the file-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of service via a large number of notes.

Remediation

There is no fixed version for Centos:7 file-libs.

References

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7
  • Fixed in: 0:2.56.1-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An error within the "parse_rollei()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger an infinite loop.

Remediation

Upgrade Centos:7 glib2 to version 0:2.56.1-5.el7 or higher.

References

low severity

Resource Exhaustion

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7
  • Fixed in: 0:2.56.1-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An error within the "parse_sinar_ia()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU resources.

Remediation

Upgrade Centos:7 glib2 to version 0:2.56.1-5.el7 or higher.

References

low severity

Uncontrolled Recursion

  • Vulnerable module: glib2
  • Introduced through: glib2@2.56.1-2.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glib2@2.56.1-2.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

Remediation

There is no fixed version for Centos:7 glib2.

References

low severity

Improper Data Handling

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Remediation

There is no fixed version for Centos:7 glibc.

References

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.

Remediation

There is no fixed version for Centos:7 glibc.

References

low severity

Resource Exhaustion

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak).

Remediation

There is no fixed version for Centos:7 glibc.

References

low severity

Improper Data Handling

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

low severity

Resource Exhaustion

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak).

Remediation

There is no fixed version for Centos:7 glibc-common.

References

low severity

Memory Leak

  • Vulnerable module: libcap
  • Introduced through: libcap@2.22-9.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcap@2.22-9.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcap package and not the libcap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

Remediation

There is no fixed version for Centos:7 libcap.

References

low severity

Use After Free

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

Improper Access Control

  • Vulnerable module: libdb
  • Introduced through: libdb@5.3.21-24.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libdb@5.3.21-24.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libdb package and not the libdb package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Remediation

There is no fixed version for Centos:7 libdb.

References

low severity

Improper Access Control

  • Vulnerable module: libdb-utils
  • Introduced through: libdb-utils@5.3.21-24.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libdb-utils@5.3.21-24.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libdb-utils package and not the libdb-utils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Remediation

There is no fixed version for Centos:7 libdb-utils.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.

Remediation

There is no fixed version for Centos:7 libgcc.

References

low severity

Improper Input Validation

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.

Remediation

There is no fixed version for Centos:7 libgcc.

References

low severity

Resource Exhaustion

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.

Remediation

There is no fixed version for Centos:7 libgcc.

References

low severity

Uncontrolled Recursion

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.

Remediation

There is no fixed version for Centos:7 libgcc.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: libidn
  • Introduced through: libidn@1.28-4.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libidn@1.28-4.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libidn package and not the libidn package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.

Remediation

There is no fixed version for Centos:7 libidn.

References

low severity

Heap-based Buffer Overflow

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

low severity

Improper Input Validation

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

low severity

Resource Exhaustion

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

low severity

Uncontrolled Recursion

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.

Remediation

There is no fixed version for Centos:7 libstdc++.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: libtasn1
  • Introduced through: libtasn1@4.10-1.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libtasn1@4.10-1.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libtasn1 package and not the libtasn1 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1_node structure. It may lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 libtasn1.

References

low severity

Improper Input Validation

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Improper Input Validation

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Improper Input Validation

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Out-of-Bounds

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Improper Certificate Validation

  • Vulnerable module: openssl-libs
  • Introduced through: openssl-libs@1:1.0.2k-16.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openssl-libs@1:1.0.2k-16.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. OpenSSL does not class this issue as a security vulnerability. The trusted CA store should not contain anything that the user does not trust to issue other certificates. Notes: https://github.com/openssl/openssl/issues/5236#issuecomment-119646061

Remediation

There is no fixed version for Centos:7 openssl-libs.

References

low severity

Improper Initialization

  • Vulnerable module: pcre
  • Introduced through: pcre@8.32-17.el7

Detailed paths

  • Introduced through: centos@7.6.1810 pcre@8.32-17.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre package and not the pcre package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.

Remediation

There is no fixed version for Centos:7 pcre.

References

low severity

Uncontrolled Recursion

  • Vulnerable module: pcre
  • Introduced through: pcre@8.32-17.el7

Detailed paths

  • Introduced through: centos@7.6.1810 pcre@8.32-17.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre package and not the pcre package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

Remediation

There is no fixed version for Centos:7 pcre.

References

low severity

Out-of-Bounds

  • Vulnerable module: procps-ng
  • Introduced through: procps-ng@3.3.10-23.el7

Detailed paths

  • Introduced through: centos@7.6.1810 procps-ng@3.3.10-23.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream procps-ng package and not the procps-ng package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap.

Remediation

There is no fixed version for Centos:7 procps-ng.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where sqlite3_step(pStmt)==SQLITE_ROW is false and a data structure is never initialized.

Remediation

There is no fixed version for Centos:7 sqlite.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted file.

Remediation

There is no fixed version for Centos:7 sqlite.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.

Remediation

There is no fixed version for Centos:7 sqlite.

References

low severity

Memory Leak

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7
  • Fixed in: 0:219-62.el7_6.3

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c does not free the memory allocated by set_iovec_field_free() to store the _CMDLINE= entry. A local attacker may use this flaw to make systemd-journald crash. This issue only affects versions shipped with Red Hat Enterprise since v219-62.2.

Remediation

Upgrade Centos:7 systemd to version 0:219-62.el7_6.3 or higher.

References

low severity

Memory Leak

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7
  • Fixed in: 0:219-62.el7_6.3

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c does not free the memory allocated by set_iovec_field_free() to store the _CMDLINE= entry. A local attacker may use this flaw to make systemd-journald crash. This issue only affects versions shipped with Red Hat Enterprise since v219-62.2.

Remediation

Upgrade Centos:7 systemd-libs to version 0:219-62.el7_6.3 or higher.

References

low severity

Memory Leak

  • Vulnerable module: tar
  • Introduced through: tar@2:1.26-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 tar@2:1.26-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 tar.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: tar
  • Introduced through: tar@2:1.26-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 tar@2:1.26-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.

Remediation

There is no fixed version for Centos:7 tar.

References

low severity

Stack-based Buffer Overflow

  • Vulnerable module: tar
  • Introduced through: tar@2:1.26-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 tar@2:1.26-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.

Remediation

There is no fixed version for Centos:7 tar.

References

low severity

NULL Pointer Dereference

low severity

NULL Pointer Dereference

low severity

Out-of-bounds Read

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file. NOTE: there might be a limited number of scenarios in which this has security relevance.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Use After Free

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Use After Free in GitHub repository vim/vim prior to v9.0.2010.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Improper Validation of Syntactic Correctness of Input

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

Use of Uninitialized Resource

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

Use of Uninitialized Resource

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl supports the -t command line option, known as CURLOPT_TELNETOPTIONSin libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending NEW_ENV variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

Improper Validation of Syntactic Correctness of Input

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

Use of Uninitialized Resource

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

Use of Uninitialized Resource

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

curl supports the -t command line option, known as CURLOPT_TELNETOPTIONSin libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending NEW_ENV variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

Out-of-bounds Read

  • Vulnerable module: rpm
  • Introduced through: rpm@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm package and not the rpm package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 rpm.

References

low severity

Out-of-bounds Read

  • Vulnerable module: rpm-build-libs
  • Introduced through: rpm-build-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-build-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-build-libs package and not the rpm-build-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 rpm-build-libs.

References

low severity

Out-of-bounds Read

  • Vulnerable module: rpm-libs
  • Introduced through: rpm-libs@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-libs@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-libs package and not the rpm-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 rpm-libs.

References

low severity

Out-of-bounds Read

  • Vulnerable module: rpm-python
  • Introduced through: rpm-python@4.11.3-35.el7

Detailed paths

  • Introduced through: centos@7.6.1810 rpm-python@4.11.3-35.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-python package and not the rpm-python package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Centos:7 rpm-python.

References

low severity

Stack-based Buffer Overflow

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

ihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Improper Input Validation

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7
  • Fixed in: 0:2.17-317.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

Remediation

Upgrade Centos:7 glibc to version 0:2.17-317.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern, which triggers an out-of-bounds read.

Remediation

There is no fixed version for Centos:7 glibc.

References

low severity

Improper Input Validation

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7
  • Fixed in: 0:2.17-317.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

Remediation

Upgrade Centos:7 glibc-common to version 0:2.17-317.el7 or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern, which triggers an out-of-bounds read.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

low severity

Incorrect Calculation of Buffer Size

  • Vulnerable module: gnupg2
  • Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 gnupg2@2.0.22-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service (invalid read operation) via a crafted keyring file, related to sign extensions and "memcpy with overlapping ranges."

Remediation

There is no fixed version for Centos:7 gnupg2.

References

low severity

Information Exposure

  • Vulnerable module: gnupg2
  • Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 gnupg2@2.0.22-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

Remediation

There is no fixed version for Centos:7 gnupg2.

References

low severity

Information Exposure

  • Vulnerable module: gnupg2
  • Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 gnupg2@2.0.22-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."

Remediation

There is no fixed version for Centos:7 gnupg2.

References

low severity

Use After Free

  • Vulnerable module: gnupg2
  • Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 gnupg2@2.0.22-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.

Remediation

There is no fixed version for Centos:7 gnupg2.

References

low severity

Information Exposure

  • Vulnerable module: libgcrypt
  • Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcrypt@1.5.3-14.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt package and not the libgcrypt package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

low severity

Information Exposure

  • Vulnerable module: libgcrypt
  • Introduced through: libgcrypt@1.5.3-14.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcrypt@1.5.3-14.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt package and not the libgcrypt package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."

Remediation

There is no fixed version for Centos:7 libgcrypt.

References

low severity

Use After Free

low severity

NULL Pointer Dereference

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Buffer Under-read

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

low severity

Heap-based Buffer Overflow

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Incorrect Permission Assignment for Critical Resource

  • Vulnerable module: openldap
  • Introduced through: openldap@2.4.44-20.el7

Detailed paths

  • Introduced through: centos@7.6.1810 openldap@2.4.44-20.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

/usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between the creation of the certificate, and the chmod to protect it.

Remediation

There is no fixed version for Centos:7 openldap.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability.

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Arbitrary Code Injection

  • Vulnerable module: glibc
  • Introduced through: glibc@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.

Remediation

There is no fixed version for Centos:7 glibc.

References

low severity

Arbitrary Code Injection

  • Vulnerable module: glibc-common
  • Introduced through: glibc-common@2.17-260.el7

Detailed paths

  • Introduced through: centos@7.6.1810 glibc-common@2.17-260.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.

Remediation

There is no fixed version for Centos:7 glibc-common.

References

low severity

Stack-based Buffer Overflow

  • Vulnerable module: ncurses
  • Introduced through: ncurses@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.

Remediation

There is no fixed version for Centos:7 ncurses.

References

low severity

Stack-based Buffer Overflow

  • Vulnerable module: ncurses-base
  • Introduced through: ncurses-base@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-base@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.

Remediation

There is no fixed version for Centos:7 ncurses-base.

References

low severity

Stack-based Buffer Overflow

  • Vulnerable module: ncurses-libs
  • Introduced through: ncurses-libs@5.9-14.20130511.el7_4

Detailed paths

  • Introduced through: centos@7.6.1810 ncurses-libs@5.9-14.20130511.el7_4

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.

Remediation

There is no fixed version for Centos:7 ncurses-libs.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: vim-minimal
  • Introduced through: vim-minimal@2:7.4.160-5.el7

Detailed paths

  • Introduced through: centos@7.6.1810 vim-minimal@2:7.4.160-5.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-minimal package and not the vim-minimal package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.

Remediation

There is no fixed version for Centos:7 vim-minimal.

References

low severity

Out-of-bounds Read

  • Vulnerable module: curl
  • Introduced through: curl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 curl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.

Remediation

There is no fixed version for Centos:7 curl.

References

low severity

Out-of-bounds Read

  • Vulnerable module: libcurl
  • Introduced through: libcurl@7.29.0-51.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libcurl@7.29.0-51.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.

Remediation

There is no fixed version for Centos:7 libcurl.

References

low severity

Resource Exhaustion

  • Vulnerable module: systemd
  • Introduced through: systemd@219-62.el7
  • Fixed in: 0:219-78.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.

Remediation

Upgrade Centos:7 systemd to version 0:219-78.el7 or higher.

References

low severity

Resource Exhaustion

  • Vulnerable module: systemd-libs
  • Introduced through: systemd-libs@219-62.el7
  • Fixed in: 0:219-78.el7

Detailed paths

  • Introduced through: centos@7.6.1810 systemd-libs@219-62.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.

Remediation

Upgrade Centos:7 systemd-libs to version 0:219-78.el7 or higher.

References

low severity

Missing Release of Resource after Effective Lifetime

  • Vulnerable module: device-mapper
  • Introduced through: device-mapper@7:1.02.149-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 device-mapper@7:1.02.149-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream device-mapper package and not the device-mapper package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. NOTE: RedHat disputes CVE-2020-8991 as not being a vulnerability since there’s no apparent route to either privilege escalation or to denial of service through the bug

Remediation

There is no fixed version for Centos:7 device-mapper.

References

low severity

Missing Release of Resource after Effective Lifetime

  • Vulnerable module: device-mapper-libs
  • Introduced through: device-mapper-libs@7:1.02.149-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 device-mapper-libs@7:1.02.149-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream device-mapper-libs package and not the device-mapper-libs package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. NOTE: RedHat disputes CVE-2020-8991 as not being a vulnerability since there’s no apparent route to either privilege escalation or to denial of service through the bug

Remediation

There is no fixed version for Centos:7 device-mapper-libs.

References

low severity

Missing Required Cryptographic Step

  • Vulnerable module: gnupg2
  • Introduced through: gnupg2@2.0.22-5.el7_5

Detailed paths

  • Introduced through: centos@7.6.1810 gnupg2@2.0.22-5.el7_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.

Remediation

There is no fixed version for Centos:7 gnupg2.

References

low severity

Insecure Temporary File

  • Vulnerable module: sqlite
  • Introduced through: sqlite@3.7.17-8.el7

Detailed paths

  • Introduced through: centos@7.6.1810 sqlite@3.7.17-8.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite package and not the sqlite package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files.

Remediation

There is no fixed version for Centos:7 sqlite.

References

low severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.27-34.base.el7

Detailed paths

  • Introduced through: centos@7.6.1810 binutils@2.27-34.base.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The d_print_comp function in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, which triggers infinite recursion and a buffer overflow, related to a node having "itself as ancestor more than once."

Remediation

There is no fixed version for Centos:7 binutils.

References

low severity

Out-of-Bounds

  • Vulnerable module: libgcc
  • Introduced through: libgcc@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libgcc@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The d_print_comp function in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, which triggers infinite recursion and a buffer overflow, related to a node having "itself as ancestor more than once."

Remediation

There is no fixed version for Centos:7 libgcc.

References

low severity

Out-of-Bounds

  • Vulnerable module: libstdc++
  • Introduced through: libstdc++@4.8.5-36.el7

Detailed paths

  • Introduced through: centos@7.6.1810 libstdc++@4.8.5-36.el7

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

The d_print_comp function in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, which triggers infinite recursion and a buffer overflow, related to a node having "itself as ancestor more than once."

Remediation

There is no fixed version for Centos:7 libstdc++.

References