318 matches found
Heap overflow
The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the 'servergetspec' function via the 'gfgetspecreq' RPC message. A remote authenticated attacker could exploit this to cause a denial of service or other potential unspecified impact...
CVE-2018-14652
The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code handling the 'GFXATTRCLRLKCMD' xattr in the 'plgetxattr' function. A remote authenticated attacker could exploit this on a mounted volume to cause a denial of...
CVE-2018-14653
The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the 'servergetspec' function via the 'gfgetspecreq' RPC message. A remote authenticated attacker could exploit this to cause a denial of service or other potential unspecified impact...
UBUNTU-CVE-2018-14659
The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GFXATTRIOSTATSDUMPKEY' xattr. A remote, authenticated attacker could exploit this by mounting a Gluster volume and repeatedly calling 'setxattr2' to trigger a state dump and create...
UBUNTU-CVE-2018-14654
The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could exploit this via the 'GFXATTROPENTRYINKEY' xattrop to create arbitrary, empty files on the target server...
CVE-2018-14659
The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GFXATTRIOSTATSDUMPKEY' xattr. A remote, authenticated attacker could exploit this by mounting a Gluster volume and repeatedly calling 'setxattr2' to trigger a state dump and create...
DEBIAN-CVE-2018-14653
The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the 'servergetspec' function via the 'gfgetspecreq' RPC message. A remote authenticated attacker could exploit this to cause a denial of service or other potential unspecified impact...
CVE-2018-14652
CVE-2018-14652 affects GlusterFS up to 3.12 and 4.1.4. A buffer overflow can occur in the features/index translator via GF_XATTR_CLRLK_CMD in pl_getxattr, allowing a remote authenticated attacker to cause a denial of service on a mounted volume. The provided documents do not include specifics on ...
CVE-2018-14659
The CVE-2018-14659 vulnerability affects GlusterFS up to versions 4.1.4 and 3.1.2. An authenticated, remote attacker could mount a Gluster volume and repeatedly call setxattr via GF_XATTR_IOSTATS_DUMP_KEY to trigger a state dump and create an arbitrary number of files in the server runtime direct...
CVE-2018-14653
The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the 'servergetspec' function via the 'gfgetspecreq' RPC message. A remote authenticated attacker could exploit this to cause a denial of service or other potential unspecified impact...
CVE-2018-14659
The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GFXATTRIOSTATSDUMPKEY' xattr. A remote, authenticated attacker could exploit this by mounting a Gluster volume and repeatedly calling 'setxattr2' to trigger a state dump and create...
CVE-2018-14654
CVE-2018-14654 affects GlusterFS (up to 4.1.x) via the GF_XATTROP_ENTRY_IN_KEY path in the translator used during mounting, allowing a remote attacker with access to mounted volumes to create arbitrary, empty files on the server. Exploitation details are not provided in the given documents. Remed...
CVE-2018-14654
The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could exploit this via the 'GFXATTROPENTRYINKEY' xattrop to create arbitrary, empty files on the target server...
CVE-2018-14659
The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GFXATTRIOSTATSDUMPKEY' xattr. A remote, authenticated attacker could exploit this by mounting a Gluster volume and repeatedly calling 'setxattr2' to trigger a state dump and create...
CVE-2018-14652
The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code handling the 'GFXATTRCLRLKCMD' xattr in the 'plgetxattr' function. A remote authenticated attacker could exploit this on a mounted volume to cause a denial of...
CVE-2018-14652
The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code handling the 'GFXATTRCLRLKCMD' xattr in the 'plgetxattr' function. A remote authenticated attacker could exploit this on a mounted volume to cause a denial of...
CVE-2018-14653
The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the 'servergetspec' function via the 'gfgetspecreq' RPC message. A remote authenticated attacker could exploit this to cause a denial of service or other potential unspecified impact...
CVE-2018-14654
The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could exploit this via the 'GFXATTROPENTRYINKEY' xattrop to create arbitrary, empty files on the target server...
CVE-2018-14653
CVE-2018-14653 affects GlusterFS up to versions 4.1.4 and 3.12, with a heap-based buffer overflow in the __server_getspec path triggered by the gf_getspec_req RPC message. A remote authenticated attacker could cause a denial of service and potentially other unspecified impact. Connected advisorie...
CVE-2018-14654: Improper Limitation of a Pathname to a Restricted Directory
The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could exploit this via the 'GFXATTROPENTRYINKEY' xattrop to create arbitrary, empty files on the target server...