cn1610_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/cn1610_firmware/ Sun, 26 Feb 2023 06:48:45 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png cn1610_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/cn1610_firmware/ 32 32 CVE-2018-20839 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-20839/ Sun, 26 Feb 2023 06:48:45 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-20839/ systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.

The post CVE-2018-20839 appeared first on CVE Vulnerability.

]]> systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.

The post CVE-2018-20839 appeared first on CVE Vulnerability.

]]> CVE-2018-20669 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-20669/ Sun, 26 Feb 2023 06:48:41 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-20669/ An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Linux kernel through 4.19.13. A local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation.

The post CVE-2018-20669 appeared first on CVE Vulnerability.

]]> An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Linux kernel through 4.19.13. A local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation.

The post CVE-2018-20669 appeared first on CVE Vulnerability.

]]> CVE-2018-0734 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-0734/ Sun, 26 Feb 2023 06:44:20 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-0734/ The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).

The post CVE-2018-0734 appeared first on CVE Vulnerability.

]]> The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).

The post CVE-2018-0734 appeared first on CVE Vulnerability.

]]> CVE-2018-0735 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-0735/ Sun, 26 Feb 2023 06:44:20 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-0735/ The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).

The post CVE-2018-0735 appeared first on CVE Vulnerability.

]]> The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).

The post CVE-2018-0735 appeared first on CVE Vulnerability.

]]> CVE-2019-9162 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-9162/ Sun, 26 Feb 2023 06:34:52 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-9162/ In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has insufficient ASN.1 length checks (aka an array index error), making out-of-bounds read and write operations possible, leading to an OOPS or local privilege escalation. This affects snmp_version and snmp_helper.

The post CVE-2019-9162 appeared first on CVE Vulnerability.

]]> In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has insufficient ASN.1 length checks (aka an array index error), making out-of-bounds read and write operations possible, leading to an OOPS or local privilege escalation. This affects snmp_version and snmp_helper.

The post CVE-2019-9162 appeared first on CVE Vulnerability.

]]> CVE-2019-9003 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-9003/ Sun, 26 Feb 2023 06:34:48 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-9003/ In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a “service ipmievd restart” loop.

The post CVE-2019-9003 appeared first on CVE Vulnerability.

]]> In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a “service ipmievd restart” loop.

The post CVE-2019-9003 appeared first on CVE Vulnerability.

]]> CVE-2019-3900 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-3900/ Sun, 26 Feb 2023 06:33:16 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-3900/ An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net […]

The post CVE-2019-3900 appeared first on CVE Vulnerability.

]]> An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario.

The post CVE-2019-3900 appeared first on CVE Vulnerability.

]]> CVE-2019-3901 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-3901/ Sun, 26 Feb 2023 06:33:16 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-3901/ A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to […]

The post CVE-2019-3901 appeared first on CVE Vulnerability.

]]> A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls. This issue affects kernel versions before 4.8.

The post CVE-2019-3901 appeared first on CVE Vulnerability.

]]> CVE-2019-3843 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-3843/ Sun, 26 Feb 2023 06:33:15 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-3843/ It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, […]

The post CVE-2019-3843 appeared first on CVE Vulnerability.

]]> It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.

The post CVE-2019-3843 appeared first on CVE Vulnerability.

]]> CVE-2019-3844 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-3844/ Sun, 26 Feb 2023 06:33:15 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-3844/ It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially […]

The post CVE-2019-3844 appeared first on CVE Vulnerability.

]]> It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.

The post CVE-2019-3844 appeared first on CVE Vulnerability.

]]>