Gnu Archives - CVE Vulnerability

CVE-2008-5659

Sun, 26 Feb 2023 09:11:07 +0000

The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.

The post CVE-2008-5659 appeared first on CVE Vulnerability.

CVE-2008-4100

Sun, 26 Feb 2023 09:10:23 +0000

GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product’s intended role in a trusted environment.

The post CVE-2008-4100 appeared first on CVE Vulnerability.

CVE-2008-3916

Sun, 26 Feb 2023 09:10:16 +0000

Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename. NOTE: since ed itself does not typically run with special privileges, this issue only crosses privilege boundaries when ed is invoked as a third-party component.

The post CVE-2008-3916 appeared first on CVE Vulnerability.

CVE-2008-1946

Sun, 26 Feb 2023 09:09:16 +0000

The default configuration of su in /etc/pam.d/su in GNU coreutils 5.2.1 allows local users to gain the privileges of a (1) locked or (2) expired account by entering the account name on the command line, related to improper use of the pam_succeed_if.so module.

The post CVE-2008-1946 appeared first on CVE Vulnerability.

CVE-2020-35448

Sun, 26 Feb 2023 06:41:16 +0000

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.

The post CVE-2020-35448 appeared first on CVE Vulnerability.

CVE-2020-24240

Sun, 26 Feb 2023 06:39:23 +0000

GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a ” byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.

The post CVE-2020-24240 appeared first on CVE Vulnerability.

CVE-2020-23856

Sun, 26 Feb 2023 06:39:20 +0000

Use-after-Free vulnerability in cflow 1.6 in the void call(char *name, int line) function at src/parser.c, which could cause a denial of service via the pointer variable caller->callee.

The post CVE-2020-23856 appeared first on CVE Vulnerability.

CVE-2020-16593

Sun, 26 Feb 2023 06:38:13 +0000

A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can cause a denial of service via a crafted file.

The post CVE-2020-16593 appeared first on CVE Vulnerability.

CVE-2020-16592

Sun, 26 Feb 2023 06:38:13 +0000

A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.

The post CVE-2020-16592 appeared first on CVE Vulnerability.

CVE-2020-16591

Sun, 26 Feb 2023 06:38:13 +0000

A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to an invalid read in process_symbol_table, as demonstrated in readeif.

The post CVE-2020-16591 appeared first on CVE Vulnerability.