Vulnerabilidades

*** Pendiente de traducción *** Unrestricted resource allocation in AMD uProf may be exploitable to consume excessive system resources, potentially leading to a loss of availability.

*** Pendiente de traducción *** Improper access control in AMD uProf may allow a local attacker with user privileges to write to the kernel-shared memory section, potentially resulting in crash or denial of service.

*** Pendiente de traducción *** Improper access control for register interface in the input-output memory management unit (IOMMU) could allow a privileged attacker to cause non-coherent accesses by the AMD secure processor (ASP) potentially resulting in loss of integrity.

*** Pendiente de traducción *** Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.

*** Pendiente de traducción *** An unauthenticated user on the local network can gain control of the router and make unauthorized changes to its operation.

*** Pendiente de traducción *** Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

*** Pendiente de traducción *** A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper with traffic between the router and the Internet, to execute code on the device.

*** Pendiente de traducción *** Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

*** Pendiente de traducción *** Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)<br /> processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK<br /> cipher can trigger a heap out-of-bounds read in kek_unwrap_key().<br /> <br /> Impact summary: A heap buffer over-read may trigger a crash which leads to<br /> Denial of Service for an application if the input buffer ends at a memory<br /> page boundary and the following page is unmapped. There is no information<br /> disclosure as the over-read bytes are not revealed to the attacker.<br /> <br /> The key unwrapping function performs a check-byte test as specified in the<br /> RFC that reads 7 bytes from a heap allocation that is based on the wrapped<br /> key length from the message. There is a minimum length check based on the<br /> block length of the wrapping cipher. However the cipher is selected from<br /> an OID carried in the attacker&amp;#39;s PWRI keyEncryptionAlgorithm with no<br /> requirement that the cipher be a block cipher. When an attacker selects<br /> a stream-mode cipher the guard will be ineffective and the allocated buffer<br /> containing the unwrapped key can be too small to fit the check-bytes<br /> specified in the RFC and a buffer over-read can happen.<br /> <br /> Applications calling CMS_decrypt() or CMS_decrypt_set1_password()<br /> (equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS<br /> data are vulnerable to this issue. No password knowledge is required: the<br /> over-read happens during the unwrap attempt before any authentication<br /> succeeds.<br /> <br /> The over-read is limited to a few bytes and is not written to output, so<br /> there is no information disclosure. Triggering a crash requires the<br /> allocation to border unmapped memory, which is unlikely with the normal<br /> allocator.<br /> <br /> The FIPS modules are not affected by this issue.

*** Pendiente de traducción *** Issue summary: A signed integer overflow when sizing the destination<br /> buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap<br /> buffer overflow.<br /> <br /> Impact summary: A heap buffer overflow may lead to a crash or possibly<br /> attacker controlled code execution or other undefined behaviour.<br /> <br /> In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination<br /> size for Unicode output is computed in a signed int: by left shift<br /> of the input character count for BMPSTRING (UTF-16) and<br /> UNIVERSALSTRING (UTF-32), and by summing per-character byte counts<br /> for UTF8STRING. The calculation overflows when the input reaches<br /> around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30<br /> characters) the size wraps to zero, OPENSSL_malloc(1) is called, and<br /> the subsequent character copy writes several gigabytes past the<br /> one-byte allocation.<br /> <br /> X.509 certificate processing routes through ASN1_STRING_set_by_NID(),<br /> whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID<br /> size limits cap the input length; no network protocol or<br /> certificate-handling path in OpenSSL exercises the overflow.<br /> Triggering the bug requires an application that calls<br /> ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers<br /> a custom string type via ASN1_STRING_TABLE_add(), with<br /> attacker-controlled input on the order of half a gigabyte or more.<br /> For these reasons this issue was assigned Low severity.<br /> <br /> The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by<br /> this issue, as the affected code is outside the OpenSSL FIPS module<br /> boundary.

*** Pendiente de traducción *** Hermes WebUI before version 0.51.303 contains a time-of-check time-of-use (TOCTOU) race condition vulnerability in the git_discard function within api/workspace_git.py that allows attackers to delete files outside the configured workspace boundary by replacing a validated path component with a symlink after validation but before deletion. Attackers can substitute a workspace-controlled path component with a symlink pointing to an external directory between the safe_resolve_ws() validation step and the subsequent Path.unlink() or shutil.rmtree() deletion call, causing the delete operation to follow the symlink and remove arbitrary files outside the workspace.

*** Pendiente de traducción *** Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository&amp;#39;s .git/config file. Attackers can exploit Git subprocess invocations in api/workspace_git.py through vectors such as core.fsmonitor during git status, protocol.ext.allow with ext:: remotes during git fetch, credential.helper, core.askPass, core.gitProxy, or inherited environment variables including GIT_SSH_COMMAND to achieve arbitrary command execution on the host running the application.