CVE-2018-9353
published 2024-11-27CVE-2018-9353: In ihevcd_parse_slice_data of ihevcd_parse_slice.c there is a possible heap buffer out of bound read due to a missing bounds check. This could lead to remote…
PriorityP432medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.30%
22.0th percentile
In ihevcd_parse_slice_data of ihevcd_parse_slice.c there is a possible heap buffer out of bound read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-1098 etcd: Cross-site request forgery via crafted local POST forms
bugzilla·2018-03-07·CVSS 8.8
CVE-2018-1098 [HIGH] CVE-2018-1098 etcd: Cross-site request forgery via crafted local POST forms
CVE-2018-1098 etcd: Cross-site request forgery via crafted local POST forms
A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can't PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.
Upstream bug:
https://github.com/coreos/etcd/issues/9353
Discussion:
Created etcd tracking bugs for this issue:
Affects: fedora-all [bug 1552720]
---
Reference:
https://www.twistlock.com/2018/02/28/dear-developers-beware-dns-rebinding/
---
If etcd supports the new v3 API, the attacker can run more operations through POST, as described in the reference blog post.
---
Mitiga
Bugzilla
CVE-2018-1099 etcd: DNS rebinding vulnerability in etcd server
bugzilla·2018-03-07·CVSS 5.5
CVE-2018-1099 [MEDIUM] CVE-2018-1099 etcd: DNS rebinding vulnerability in etcd server
CVE-2018-1099 etcd: DNS rebinding vulnerability in etcd server
etcd 3.3.1 and earlier does not correctly restrict access to resources based on
the hostname, thus allowing a DNS rebinding attack. An attacker can control his
DNS records and trick the browser into sending requests to an etcd server on an
internal network and bypassing the same-origin policy.
Upstream issue:
https://github.com/coreos/etcd/issues/9353
Discussion:
Created etcd tracking bugs for this issue:
Affects: fedora-all [bug 1552720]
---
Patch:
https://github.com/coreos/etcd/commit/a7e5790c82039945639798ae9a3289fe787f5e56
---
Reference:
https://www.twistlock.com/2018/02/28/dear-developers-beware-dns-rebinding/
---
Mitigation:
Configure and enable authentication on the etcd server or secure your client connectio
2024-11-27
Published