Publication Date: |
|
Last Update: |
|
Current Version: | V1.9 |
CVSS v3.1 Base Score: | 9.8 |
CVSS v4.0 Base Score: | 9.4 |
Affected Product and Versions | Remediation |
---|---|
|
Currently no fix is available
|
Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk:
Please follow the General Security Recommendations.
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.
CVSS v3.1 Base Score | 9.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C |
CVSS v4.0 Base Score | 8.8 |
CVSS v4.0 Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N |
CWE | CWE-611: Improper Restriction of XML External Entity Reference |
CVSS v3.1 Base Score | 4.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CVSS v4.0 Base Score | 5.7 |
CVSS v4.0 Vector | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
CWE | CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition |
CVSS v3.1 Base Score | 9.0 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C |
CVSS v4.0 Base Score | 9.4 |
CVSS v4.0 Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
CWE | CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') |
CVSS v3.1 Base Score | 7.6 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L/E:P/RL:O/RC:C |
CWE | CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 6.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-611: Improper Restriction of XML External Entity Reference |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-611: Improper Restriction of XML External Entity Reference |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CVSS v4.0 Base Score | 6.9 |
CVSS v4.0 Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-770: Allocation of Resources Without Limits or Throttling |
CVSS v3.1 Base Score | 4.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-203: Observable Discrepancy |
CVSS v3.1 Base Score | 8.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-209: Generation of Error Message Containing Sensitive Information |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 4.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-611: Improper Restriction of XML External Entity Reference |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 9.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 9.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 9.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 9.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 9.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 8.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 3.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-427: Uncontrolled Search Path Element |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-415: Double Free |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 6.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-116: Improper Encoding or Escaping of Output |
CVSS v3.1 Base Score | 6.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-838: Inappropriate Encoding for Output Context |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-404: Improper Resource Shutdown or Release |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 6.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 6.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') |
CVSS v3.1 Base Score | 9.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-172: Encoding Error |
CVSS v3.1 Base Score | 4.2 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-668: Exposure of Resource to Wrong Sphere |
CVSS v3.1 Base Score | 4.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 6.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-203: Observable Discrepancy |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-331: Insufficient Entropy |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-369: Divide By Zero |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 8.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 8.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 5.4 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-273: Improper Check for Dropped Privileges |
CVSS v3.1 Base Score | 6.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
CVSS v3.1 Base Score | 3.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-665: Improper Initialization |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-681: Incorrect Conversion between Numeric Types |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-674: Uncontrolled Recursion |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-754: Improper Check for Unusual or Exceptional Conditions |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-755: Improper Handling of Exceptional Conditions |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-434: Unrestricted Upload of File with Dangerous Type |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C |
CWE | CWE-772: Missing Release of Resource after Effective Lifetime |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-755: Improper Handling of Exceptional Conditions |
CVSS v3.1 Base Score | 9.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-401: Missing Release of Memory after Effective Lifetime |
CVSS v3.1 Base Score | 4.4 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-330: Use of Insufficiently Random Values |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 5.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 7.0 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 8.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-195: Signed to Unsigned Conversion Error |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C |
CWE | CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
CWE | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVSS v3.1 Base Score | 7.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 3.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C |
CWE | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-674: Uncontrolled Recursion |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C |
CWE | CWE-295: Improper Certificate Validation |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-427: Uncontrolled Search Path Element |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 8.2 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-704: Incorrect Type Conversion or Cast |
CVSS v3.1 Base Score | 8.6 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 7.4 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-330: Use of Insufficiently Random Values |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-665: Improper Initialization |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-674: Uncontrolled Recursion |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 6.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-290: Authentication Bypass by Spoofing |
CVSS v3.1 Base Score | 7.0 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 6.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-269: Improper Privilege Management |
CVSS v3.1 Base Score | 7.4 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-327: Use of a Broken or Risky Cryptographic Algorithm |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-203: Observable Discrepancy |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-682: Incorrect Calculation |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-427: Uncontrolled Search Path Element |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-426: Untrusted Search Path |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 3.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-617: Reachable Assertion |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-617: Reachable Assertion |
CVSS v3.1 Base Score | 7.2 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-674: Uncontrolled Recursion |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 4.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-617: Reachable Assertion |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-191: Integer Underflow (Wrap or Wraparound) |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-617: Reachable Assertion |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-763: Release of Invalid Pointer or Reference |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-415: Double Free |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-191: Integer Underflow (Wrap or Wraparound) |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-617: Reachable Assertion |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-617: Reachable Assertion |
CVSS v3.1 Base Score | 5.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 8.6 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C |
CWE | CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-674: Uncontrolled Recursion |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-193: Off-by-one Error |
CVSS v3.1 Base Score | 4.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-345: Insufficient Verification of Data Authenticity |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-252: Unchecked Return Value |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 8.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVSS v3.1 Base Score | 3.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-290: Authentication Bypass by Spoofing |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-668: Exposure of Resource to Wrong Sphere |
NOTE: CVE-2021-22898 is an incomplete fix (see https://hackerone.com/reports/1223882)! Check if affected products also have fixed CVE-22925 instead! Do not use CVE-2021-22898 in public advisories!
curl 7.7 through 7.76.1 suffers from an information disclosure when the -t
command line option, known as CURLOPT_TELNETOPTIONS
in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.
CVSS v3.1 Base Score | 3.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-909: Missing Initialization of Resource |
CVSS v3.1 Base Score | 8.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-354: Improper Validation of Integrity Check Value |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-522: Insufficiently Protected Credentials |
CVSS v3.1 Base Score | 3.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-706: Use of Incorrectly-Resolved Name or Reference |
-t
command line option, known as CURLOPT_TELNETOPTIONS
in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers. Due to flaw in the option parser for sending NEW_ENV
variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol. This could happen because curl did not call and use sscanf() correctly when parsing the string provided by the application.CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-908: Use of Uninitialized Resource |
CURLOPT_SSLCERT
option (--cert
with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like /tmp
), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-295: Improper Certificate Validation |
CVSS v3.1 Base Score | 9.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-415: Double Free |
--ssl-reqd
on the command line orCURLOPT_USE_SSL
set to CURLUSESSL_CONTROL
or CURLUSESSL_ALL
withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations withoutTLS contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-319: Cleartext Transmission of Sensitive Information |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-345: Insufficient Verification of Data Authenticity |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H/E:P/RL:U/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-617: Reachable Assertion |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-681: Incorrect Conversion between Numeric Types |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-681: Incorrect Conversion between Numeric Types |
CVSS v3.1 Base Score | 2.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-415: Double Free |
CVSS v3.1 Base Score | 7.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-415: Double Free |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-59: Improper Link Resolution Before File Access ('Link Following') |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-295: Improper Certificate Validation |
CVSS v3.1 Base Score | 7.4 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-601: URL Redirection to Untrusted Site ('Open Redirect') |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-203: Observable Discrepancy |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-770: Allocation of Resources Without Limits or Throttling |
CVSS v3.1 Base Score | 9.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 3.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 3.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 3.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 3.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 7.0 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-674: Uncontrolled Recursion |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-770: Allocation of Resources Without Limits or Throttling |
CVSS v3.1 Base Score | 9.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-193: Off-by-one Error |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-209: Generation of Error Message Containing Sensitive Information |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v4.0 Base Score | 8.7 |
CVSS v4.0 Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
CWE | CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-295: Improper Certificate Validation |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-327: Use of a Broken or Risky Cryptographic Algorithm |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-404: Improper Resource Shutdown or Release |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-326: Inadequate Encryption Strength |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-415: Double Free |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-193: Off-by-one Error |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-326: Inadequate Encryption Strength |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-415: Double Free |
CVSS v3.1 Base Score | 8.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-287: Improper Authentication |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-116: Improper Encoding or Escaping of Output |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-668: Exposure of Resource to Wrong Sphere |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 7.0 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-426: Untrusted Search Path |
CVSS v3.1 Base Score | 5.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-522: Insufficiently Protected Credentials |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-522: Insufficiently Protected Credentials |
--no-clobber
is used together with --remove-on-error
.CVSS v3.1 Base Score | 8.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-706: Use of Incorrectly-Resolved Name or Reference |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
http://example.com%2F127.0.0.1/
, would be allowed bythe parser and get transposed into http://example.com/127.0.0.1/
. This flawcan be used to circumvent filters, checks and more.CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-918: Server-Side Request Forgery (SSRF) |
CURLOPT_CERTINFO
option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-295: Improper Certificate Validation |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-674: Uncontrolled Recursion |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-287: Improper Authentication |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 4.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-319: Cleartext Transmission of Sensitive Information |
CVSS v3.1 Base Score | 4.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-770: Allocation of Resources Without Limits or Throttling |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-770: Allocation of Resources Without Limits or Throttling |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-276: Incorrect Default Permissions |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CURLOPT_READFUNCTION
) to ask for data to send, even when the CURLOPT_POSTFIELDS
option has been set, if the same handle previously was used to issue a PUT
request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent POST
request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.CVSS v3.1 Base Score | 8.2 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-440: Expected Behavior Violation |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C |
CWE | CWE-1286: Improper Validation of Syntactic Correctness of Input |
.netrc
file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.CVSS v3.1 Base Score | 8.6 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C |
CWE | CWE-121: Stack-based Buffer Overflow |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-129: Improper Validation of Array Index |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-415: Double Free |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C |
CWE | CWE-415: Double Free |
CVSS v3.1 Base Score | 9.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C |
CWE | CWE-319: Cleartext Transmission of Sensitive Information |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-319: Cleartext Transmission of Sensitive Information |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-407: Inefficient Algorithmic Complexity |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 7.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 7.4 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 7.4 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-203: Observable Discrepancy |
A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems.
Policy processing is disabled by default but can be enabled by passing the -policy
argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()
function.
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-295: Improper Certificate Validation |
Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks.
Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether.
Policy processing is disabled by default but can be enabled by passing
the -policy
argument to the command line utilities or by calling the
X509_VERIFY_PARAM_set1_policies()
function.
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-295: Improper Certificate Validation |
The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification.
As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function.
Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument.
Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-295: Improper Certificate Validation |
CVSS v3.1 Base Score | 4.6 |
CVSS v3.1 Vector | CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L |
CWE | CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') |
CVSS v3.1 Base Score | 5.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-770: Allocation of Resources Without Limits or Throttling |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 4.4 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-1333: Inefficient Regular Expression Complexity |
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.
If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.
The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-834: Excessive Iteration |
CVSS v3.1 Base Score | 2.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L |
CWE | CWE-122: Heap-based Buffer Overflow |
A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables.
The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity.
CVSS v3.1 Base Score | 4.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
CWE | CWE-693: Protection Mechanism Failure |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H |
CWE | CWE-125: Out-of-bounds Read |
A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.
If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.
We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-121: Stack-based Buffer Overflow |
A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.
When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue().
We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8.
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
CWE | CWE-401: Missing Release of Memory after Effective Lifetime |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-754: Improper Check for Unusual or Exceptional Conditions |
A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation.
If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer.
We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-203: Observable Discrepancy |
CVSS v3.1 Base Score | 4.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
CWE | CWE-20: Improper Input Validation |
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.
We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a.
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CWE | CWE-416: Use After Free |
A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation.
A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().
We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CWE | CWE-787: Out-of-bounds Write |
A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation.
A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread.
We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 9.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-319: Cleartext Transmission of Sensitive Information |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-319: Cleartext Transmission of Sensitive Information |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-770: Allocation of Resources Without Limits or Throttling |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P/RL:O/RC:C |
CWE | CWE-415: Double Free |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AC:H/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-287: Improper Authentication |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-287: Improper Authentication |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-415: Double Free |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 3.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-415: Double Free |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-369: Divide By Zero |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 4.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
CWE | CWE-122: Heap-based Buffer Overflow |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-502: Deserialization of Untrusted Data |
The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire packet being split into as many pieces as permitted by the protocol, yet still being smaller than the area that's specially dealt with to keep all (possible) headers together. Such an unusual packet would therefore trigger a buffer overrun in the driver.
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CWE | CWE-787: Out-of-bounds Write |
RST_STREAM
immediately followed by the GOAWAY
frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWAY
frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to GOAWAY
frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 7.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.
When curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255 bytes.
If the hostname is detected to be longer than 255 bytes, curl switches to local name resolving and instead passes on the resolved address only to the proxy. Due to a bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long hostname to the target buffer instead of copying just the resolved address there.
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-122: Heap-based Buffer Overflow |
This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.
libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers.
libcurl provides a function call that duplicates en easy handle called curl_easy_duphandle.
If a transfer has cookies enabled when the handle is duplicated, the
cookie-enable state is also cloned - but without cloning the actual
cookies. If the source handle did not read any cookies from a specific file on
disk, the cloned version of the handle would instead store the file name as
none
(using the four ASCII letters, no quotes).
Subsequent use of the cloned handle that does not explicitly set a source to
load cookies from would then inadvertently load cookies from a file named
none
- if such a file exists and is readable in the current directory of the
program using libcurl. And if using the correct file format of course.
CVSS v3.1 Base Score | 3.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-73: External Control of File Name or Path |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 5.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 6.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 6.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 3.2 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
rsvp_classify
function. This issue may allow a local user to crash the system and cause a denial of service.CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H |
CWE | CWE-125: Out-of-bounds Read |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CVSS v4.0 Base Score | 8.7 |
CVSS v4.0 Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
domain=co.UK
when the URL used a lower case hostname curl.co.uk
, even though co.uk
is listed as a PSL domain.CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-311: Missing Encryption of Sensitive Data |
CVSS v3.1 Base Score | 4.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C |
CVSS v4.0 Base Score | 8.2 |
CVSS v4.0 Vector | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
CWE | CWE-222: Truncation of Security-relevant Information |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
CWE | CWE-416: Use After Free |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 4.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
CWE | CWE-295: Improper Certificate Validation |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-772: Missing Release of Resource after Effective Lifetime |
CVSS v3.1 Base Score | 7.1 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N/E:P/RL:O/RC:C |
CWE | CWE-297: Improper Validation of Certificate with Host Mismatch |
Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.
CVSS v3.1 Base Score | 3.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
CWE | CWE-787: Out-of-bounds Write |
CVSS v3.1 Base Score | 5.9 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
CWE | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVSS v3.1 Base Score | 4.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N |
CWE | CWE-377: Insecure Temporary File |
CVSS v3.1 Base Score | 7.0 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H |
CWE | CWE-364: Signal Handler Race Condition |
GTime2str()
function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the time fraction, leading to a strlen()
getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when CURLINFO_CERTINFO is used.CVSS v3.1 Base Score | 3.7 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
CVSS v4.0 Base Score | 6.3 |
CVSS v4.0 Vector | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
CWE | CWE-295: Improper Certificate Validation |
CVSS v3.1 Base Score | 8.8 |
CVSS v3.1 Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
CWE | CWE-770: Allocation of Resources Without Limits or Throttling |
CVSS v3.1 Base Score | 7.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') |
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C |
CWE | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVSS v3.1 Base Score | 5.0 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CWE | CWE-248: Uncaught Exception |
nscd: Stack-based buffer overflow in netgroup cache
If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd.
This vulnerability is only present in the nscd binary.
CVSS v3.1 Base Score | 7.6 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C |
CWE | CWE-121: Stack-based Buffer Overflow |
nscd: Null pointer crashes after notfound response
If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd.
This vulnerability is only present in the nscd binary.
CVSS v3.1 Base Score | 5.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C |
CWE | CWE-476: NULL Pointer Dereference |
nscd: netgroup cache may terminate daemon on memory allocation failure
The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in glibc 2.15 when the cache was added to nscd.
This vulnerability is only present in the nscd binary.
CVSS v3.1 Base Score | 4.0 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C |
CWE | CWE-617: Reachable Assertion |
nscd: netgroup cache assumes NSS callback uses in-buffer strings
The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd.
This vulnerability is only present in the nscd binary.
CVSS v3.1 Base Score | 4.0 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C |
CWE | CWE-466: Return of Pointer Value Outside of Expected Range |
CVSS v3.1 Base Score | 5.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C |
CWE | CWE-126: Buffer Over-read |
CVSS v3.1 Base Score | 7.4 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C |
CVSS v4.0 Base Score | 8.3 |
CVSS v4.0 Vector | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
CWE | CWE-130: Improper Handling of Length Parameter Inconsistency |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C |
CVSS v4.0 Base Score | 7.1 |
CVSS v4.0 Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
CWE | CWE-130: Improper Handling of Length Parameter Inconsistency |
CVSS v3.1 Base Score | 9.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CWE | CWE-131: Incorrect Calculation of Buffer Size |
CVSS v3.1 Base Score | 7.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
CWE | CWE-190: Integer Overflow or Wraparound |
CVSS v3.1 Base Score | 7.3 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
CWE | CWE-190: Integer Overflow or Wraparound |
This SSA advises vulnerabilities for firmware version V3.1 only; for versions < V3.1 refer to Siemens Security Bulletin SSB-439005 (https://cert-portal.siemens.com/productcert/html/ssb-439005.html).
V1.0 (2023-12-12): | Publication Date |
V1.1 (2024-01-09): | Added CVE-2021-44879, CVE-2023-46218, CVE-2023-46219, and CVE-2023-48795 |
V1.2 (2024-02-13): | Added CVE-2023-45898, CVE-2023-46862, CVE-2023-6121, CVE-2023-6817, CVE-2023-6931, CVE-2023-6932, CVE-2024-0584 |
V1.3 (2024-03-12): | Added CVE-2023-52425, CVE-2023-52426, CVE-2023-45918 |
V1.4 (2024-04-09): | Added CVE-2024-28757 |
V1.5 (2024-05-14): | Added CVE-2024-2004, CVE-2024-2379, CVE-2024-2398, CVE-2024-2466, CVE-2024-2511, CVE-2024-28085, CVE-2024-28182, CVE-2024-28834, CVE-2024-28835 |
V1.6 (2024-06-11): | Added CVE-2024-2961, CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2024-33602, CVE-2024-34459 |
V1.7 (2024-07-09): | Added CVE-2024-5535, CVE-2024-5742 |
V1.8 (2024-08-13): | Added CVE-2017-15422, CVE-2024-7264, CVE-2024-37370, CVE-2024-37371 |
V1.9 (2024-10-08): | Added CVE-2024-6409, CVE-2024-8096, CVE-2024-45490, CVE-2024-45491, CVE-2024-45492 |