Fedoraproject: >> Fedora >> 38 Security Vulnerabilities
x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one entrypath performs its speculation-safety actions too late. In some configurations, there is an unprotected RET instruction which can be attacked with a variety of speculative attacks.
CVSS Score
5.5
EPSS Score
0.003
Published
2023-03-21
x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Shadow mode maintains a pool of memory used for both shadow page tables as well as auxiliary data structures. To migrate or snapshot guests, Xen additionally runs them in so called log-dirty mode. The data structures needed by the log-dirty tracking are part of aformentioned auxiliary data. In order to keep error handling efforts within reasonable bounds, for operations which may require memory allocations shadow mode logic ensures up front that enough memory is available for the worst case requirements. Unfortunately, while page table memory is properly accounted for on the code path requiring the potential establishing of new shadows, demands by the log-dirty infrastructure were not taken into consideration. As a result, just established shadow page tables could be freed again immediately, while other code is still accessing them on the assumption that they would remain allocated.
CVSS Score
7.8
EPSS Score
0.003
Published
2023-03-21
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392.
CVSS Score
6.6
EPSS Score
0.004
Published
2023-03-07
Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.
CVSS Score
7.3
EPSS Score
0.004
Published
2023-03-04
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.
CVSS Score
7.3
EPSS Score
0.005
Published
2023-03-03
LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125.
CVSS Score
6.8
EPSS Score
0.004
Published
2023-03-03
A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
CVSS Score
8.8
EPSS Score
0.011
Published
2023-03-02
An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service.
CVSS Score
5.5
EPSS Score
0.003
Published
2023-02-28
Sudo before 1.9.13p2 has a double free in the per-command chroot feature.
CVSS Score
7.2
EPSS Score
0.017
Published
2023-02-28
A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.
CVSS Score
5.5
EPSS Score
0.002
Published
2023-02-27