mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-07-11 16:13:34 +00:00
Auto-Update: 2024-06-30T14:00:42.073265+00:00
This commit is contained in:
cad-safe-bot
parent
dc342d0f1b
commit
78d2d733b1
@ -2,12 +2,13 @@
|
||||
"id": "CVE-2024-38439",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2024-06-16T13:15:53.030",
|
||||
"lastModified": "2024-06-19T15:15:59.810",
|
||||
"lastModified": "2024-06-30T12:15:02.293",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Netatalk 3.2.0 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\\0' in FPLoginExt in login in etc/uams/uams_pam.c."
|
||||
"value": "Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\\0' in FPLoginExt in login in etc/uams/uams_pam.c. 2.4.1 and 3.1.19 are also fixed versions."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
@ -23,6 +24,14 @@
|
||||
{
|
||||
"url": "https://github.com/Netatalk/netatalk/issues/1096",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/Netatalk/netatalk/security/advisories/GHSA-8r68-857c-4rqc",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://netatalk.io/security/CVE-2024-38439",
|
||||
"source": "cve@mitre.org"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,12 +2,13 @@
|
||||
"id": "CVE-2024-38440",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2024-06-16T13:15:53.147",
|
||||
"lastModified": "2024-06-19T15:15:59.913",
|
||||
"lastModified": "2024-06-30T12:15:02.377",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Netatalk 3.2.0 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly using FPLoginExt in BN_bin2bn in etc/uams/uams_dhx_pam.c. The original issue 1097 report stated: 'The latest version of Netatalk (v3.2.0) contains a security vulnerability. This vulnerability arises due to a lack of validation for the length field after parsing user-provided data, leading to an out-of-bounds heap write of one byte (\\0). Under specific configurations, this can result in reading metadata of the next heap block, potentially causing a Denial of Service (DoS) under certain heap layouts or with ASAN enabled. ... The vulnerability is located in the FPLoginExt operation of Netatalk, in the BN_bin2bn function found in /etc/uams/uams_dhx_pam.c ... if (!(bn = BN_bin2bn((unsigned char *)ibuf, KEYSIZE, NULL))) ... threads ... [#0] Id 1, Name: \"afpd\", stopped 0x7ffff4304e58 in ?? (), reason: SIGSEGV ... [#0] 0x7ffff4304e58 mov BYTE PTR [r14+0x8], 0x0 ... mov rdx, QWORD PTR [rsp+0x18] ... afp_login_ext(obj=<optimized out>, ibuf=0x62d000010424 \"\", ibuflen=0xffffffffffff0015, rbuf=<optimized out>, rbuflen=<optimized out>) ... afp_over_dsi(obj=0x5555556154c0 <obj>).'"
|
||||
"value": "Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly using FPLoginExt in BN_bin2bn in etc/uams/uams_dhx_pam.c. The original issue 1097 report stated: 'The latest version of Netatalk (v3.2.0) contains a security vulnerability. This vulnerability arises due to a lack of validation for the length field after parsing user-provided data, leading to an out-of-bounds heap write of one byte (\\0). Under specific configurations, this can result in reading metadata of the next heap block, potentially causing a Denial of Service (DoS) under certain heap layouts or with ASAN enabled. ... The vulnerability is located in the FPLoginExt operation of Netatalk, in the BN_bin2bn function found in /etc/uams/uams_dhx_pam.c ... if (!(bn = BN_bin2bn((unsigned char *)ibuf, KEYSIZE, NULL))) ... threads ... [#0] Id 1, Name: \"afpd\", stopped 0x7ffff4304e58 in ?? (), reason: SIGSEGV ... [#0] 0x7ffff4304e58 mov BYTE PTR [r14+0x8], 0x0 ... mov rdx, QWORD PTR [rsp+0x18] ... afp_login_ext(obj=<optimized out>, ibuf=0x62d000010424 \"\", ibuflen=0xffffffffffff0015, rbuf=<optimized out>, rbuflen=<optimized out>) ... afp_over_dsi(obj=0x5555556154c0 <obj>).' 2.4.1 and 3.1.19 are also fixed versions."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
@ -23,6 +24,14 @@
|
||||
{
|
||||
"url": "https://github.com/Netatalk/netatalk/issues/1097",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/Netatalk/netatalk/security/advisories/GHSA-mxx4-9fhm-r3w5",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://netatalk.io/security/CVE-2024-38440",
|
||||
"source": "cve@mitre.org"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,12 +2,13 @@
|
||||
"id": "CVE-2024-38441",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2024-06-16T13:15:53.230",
|
||||
"lastModified": "2024-06-19T15:16:00.040",
|
||||
"lastModified": "2024-06-30T12:15:02.427",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Netatalk 3.2.0 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\\0' in FPMapName in afp_mapname in etc/afpd/directory.c."
|
||||
"value": "Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\\0' in FPMapName in afp_mapname in etc/afpd/directory.c. 2.4.1 and 3.1.19 are also fixed versions."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
@ -23,6 +24,14 @@
|
||||
{
|
||||
"url": "https://github.com/Netatalk/netatalk/issues/1098",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/Netatalk/netatalk/security/advisories/GHSA-mj6v-cr68-mj9q",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://netatalk.io/security/CVE-2024-38441",
|
||||
"source": "cve@mitre.org"
|
||||
}
|
||||
]
|
||||
}
|
||||
10
README.md
10
README.md
@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
|
||||
### Last Repository Update
|
||||
|
||||
```plain
|
||||
2024-06-30T12:00:40.301466+00:00
|
||||
2024-06-30T14:00:42.073265+00:00
|
||||
```
|
||||
|
||||
### Most recent CVE Modification Timestamp synchronized with NVD
|
||||
|
||||
```plain
|
||||
2024-06-30T11:15:09.780000+00:00
|
||||
2024-06-30T12:15:02.427000+00:00
|
||||
```
|
||||
|
||||
### Last Data Feed Release
|
||||
@ -44,9 +44,11 @@ Recently added CVEs: `0`
|
||||
|
||||
### CVEs modified in the last Commit
|
||||
|
||||
Recently modified CVEs: `1`
|
||||
Recently modified CVEs: `3`
|
||||
|
||||
- [CVE-2020-36829](CVE-2020/CVE-2020-368xx/CVE-2020-36829.json) (`2024-06-30T11:15:09.780`)
|
||||
- [CVE-2024-38439](CVE-2024/CVE-2024-384xx/CVE-2024-38439.json) (`2024-06-30T12:15:02.293`)
|
||||
- [CVE-2024-38440](CVE-2024/CVE-2024-384xx/CVE-2024-38440.json) (`2024-06-30T12:15:02.377`)
|
||||
- [CVE-2024-38441](CVE-2024/CVE-2024-384xx/CVE-2024-38441.json) (`2024-06-30T12:15:02.427`)
|
||||
|
||||
|
||||
## Download and Usage
|
||||
|
||||
@ -159286,7 +159286,7 @@ CVE-2020-36825,0,0,11fd8bfa5fd2d4cc998966e9cf3841111405b021462997cacb9442811ebd2
|
||||
CVE-2020-36826,0,0,0e31ad1f2936d026f31ea8a8c60fd59484d066fc31980942e49d09e9fe78ef75,2024-05-17T01:48:58.757000
|
||||
CVE-2020-36827,0,0,85af821d9eb495826ed1ba9a91785e23077914210ba31b106d9f6119fa8ab1a2,2024-03-25T01:51:01.223000
|
||||
CVE-2020-36828,0,0,1ef1be7e7b2ae938902b8d1465831da75638f338eae1e3e5e8f488ed8cff3335,2024-05-17T01:48:58.900000
|
||||
CVE-2020-36829,0,1,3ca13c61892895ada7d1a3b1786c7a67bdf7a987ac0afcce0d1cf2e7ae3d5086,2024-06-30T11:15:09.780000
|
||||
CVE-2020-36829,0,0,3ca13c61892895ada7d1a3b1786c7a67bdf7a987ac0afcce0d1cf2e7ae3d5086,2024-06-30T11:15:09.780000
|
||||
CVE-2020-3684,0,0,931f112566786124f7d6fcb2bd46c9dcab315dc8e46c2a552446825ac25c83c4,2020-11-06T16:29:14.480000
|
||||
CVE-2020-3685,0,0,d53e7f1d143037625a0e7accdd772a2ca67acd945a19ee6a44795cb898b977ad,2021-01-29T23:46:03.037000
|
||||
CVE-2020-3686,0,0,2751b7fc7694785f090b1a831e3239e3ac41b203ebf4010fe60035bec637d53b,2021-01-30T00:10:19.887000
|
||||
@ -253540,10 +253540,10 @@ CVE-2024-3841,0,0,115f766a88fd32831299505e83a1207ec4bfedfbb7b32163caf9b2dcda1420
|
||||
CVE-2024-38427,0,0,732204cceeb6abe7907342f21e7efa4f2a18a21658ab4ca99d4398a365d436c7,2024-06-17T12:42:04.623000
|
||||
CVE-2024-38428,0,0,3714727f8bfcc9e282c2717dad223df765a696413b267002faf1df27a5ac73ea,2024-06-17T12:42:04.623000
|
||||
CVE-2024-3843,0,0,e2f9823881882a7119ad05ef8bacfc680d4c49d84fc3cf5b87bbb0f45959dd0d,2024-05-03T03:16:29.117000
|
||||
CVE-2024-38439,0,0,a9f5cbb56ea3354c25c241d88facaddb20ea92e5059cfc2e43e865c8797b6720,2024-06-19T15:15:59.810000
|
||||
CVE-2024-38439,0,1,8231c3155c8c2b9187a625bff6a8697fe632a7e4deddc7a4e816a03d1932df66,2024-06-30T12:15:02.293000
|
||||
CVE-2024-3844,0,0,557b2843dd1fca85a530c46acabf2e2b3fe4cb4e29b4ec8be3ca0b11ef97034e,2024-05-03T03:16:29.163000
|
||||
CVE-2024-38440,0,0,81c16272bce02d8f590661e69377efd9d4a75b6b13fedd48324b80c4cc1b2dfe,2024-06-19T15:15:59.913000
|
||||
CVE-2024-38441,0,0,8774b6986ddfd4d93147ecf78ef7ec770ec6154755fdfb7857334702b7a334c6,2024-06-19T15:16:00.040000
|
||||
CVE-2024-38440,0,1,6eeed0e96f15416f894572035c480d139cdee0086e466e03019ce412c35c715a,2024-06-30T12:15:02.377000
|
||||
CVE-2024-38441,0,1,2efce111268ac0468f1041a0c4ddb93e500f0656d65384e0b3d02b47425911d5,2024-06-30T12:15:02.427000
|
||||
CVE-2024-38443,0,0,1d75cfa177cf692b67a12f7bd5c673225dc4008379121d75b6d5d0686ab9a220,2024-06-17T12:42:04.623000
|
||||
CVE-2024-38448,0,0,66ae408cb06bbe5b04615772f5468e0f5bb5c8f2d46df318fd238e60dfb550e8,2024-06-17T12:42:04.623000
|
||||
CVE-2024-38449,0,0,d69089b504731433d7b543e10e4b6e57d1623551f30ae8f192ba71fc59819634,2024-06-20T12:44:22.977000
|
||||
|
||||
|
Can't render this file because it is too large.
|
Loading…
x
Reference in New Issue
Block a user