Fedoraproject Fedora vulnerabilities

CVE-2022-29900 [MEDIUM] CWE-212 CVE-2022-29900: Mis-trained branch predictions for return instructions may allow arbitrary speculative code executio Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.

CVE-2009-0115 [HIGH] CWE-732 CVE-2009-0115: The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as use The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath

CVE-2022-0367 [HIGH] CWE-119 CVE-2022-0367: A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c. A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

CVE-2014-3219 [HIGH] CWE-59 CVE-2014-3219: fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fi fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.

CVE-2011-2520 [HIGH] CWE-502 CVE-2011-2520: fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely durin fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privileges via a crafted serialized object.

CVE-2021-39251 [HIGH] CWE-476 CVE-2021-39251: A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 202 A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22.

CVE-2022-24958 [HIGH] CWE-763 CVE-2022-24958: drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release. drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.

CVE-2014-7271 [HIGH] CWE-306 CVE-2014-7271: Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" with Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication.

CVE-2024-4140 [HIGH] CWE-770 CVE-2024-4140: An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.

CVE-2020-6581 [HIGH] CVE-2020-6581: Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sequence). This can cause command injection.

CVE-2020-27671 [HIGH] CVE-2020-27671: An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a den An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because coalescing of per-page IOMMU TLB flushes is mishandled.

CVE-2024-2002 [HIGH] CWE-415 CVE-2024-2002: A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf ma A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.

CVE-2019-5780 [HIGH] CWE-20 CVE-2019-5780: Insufficient restrictions on what can be done with Apple Events in Google Chrome on macOS prior to 7 Insufficient restrictions on what can be done with Apple Events in Google Chrome on macOS prior to 72.0.3626.81 allowed a local attacker to execute JavaScript via Apple Events.

CVE-2023-3106 [HIGH] CWE-476 CVE-2023-3106: A NULL pointer dereference vulnerability was found in netlink_dump. This issue can occur when the Ne A NULL pointer dereference vulnerability was found in netlink_dump. This issue can occur when the Netlink socket receives the message(sendmsg) for the XFRM_MSG_GETSA, XFRM_MSG_GETPOLICY type message, and the DUMP flag is set and can cause a denial of service or possibly another unspecified impact. Due to the nature of the flaw, privilege escalation cann

CVE-2024-1622 [HIGH] CWE-253 CVE-2024-1622: Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is res Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after opening.

CVE-2020-27670 [HIGH] CWE-345 CVE-2020-27670: An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of servi An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because an AMD IOMMU page-table entry can be half-updated.

CVE-2020-15980 [HIGH] CVE-2020-15980: Insufficient policy enforcement in Intents in Google Chrome on Android prior to 86.0.4240.75 allowed Insufficient policy enforcement in Intents in Google Chrome on Android prior to 86.0.4240.75 allowed a local attacker to bypass navigation restrictions via crafted Intents.

CVE-2020-6546 [HIGH] CWE-59 CVE-2020-6546: Inappropriate implementation in installer in Google Chrome prior to 84.0.4147.125 allowed a local at Inappropriate implementation in installer in Google Chrome prior to 84.0.4147.125 allowed a local attacker to potentially elevate privilege via a crafted filesystem.

CVE-2024-25978 [HIGH] CWE-400 CVE-2024-25978: Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functi Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.

CVE-2012-1170 [HIGH] CWE-354 CVE-2012-1170: Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough