CVE-2022-1292

CVE-2022-1292 describes a command-injection risk in the OpenSSL c_rehash script due to improper sanitization of shell metacharacters. The issue can allow local attackers to run arbitrary commands with the script’s privileges on systems where c_rehash runs automatically. Fixes are published in Ope...

CVE-2022-2068

The Connected documents corroborate CVE-2022-2068 as a real OpenSSL issue: c_rehash can pass certificate filenames to shell commands, enabling local command execution. Fixed in OpenSSL 3.0.4 (affecting 3.0.0–3.0.3), in OpenSSL 1.1.1p (affecting 1.1.1–1.1.1o), and in OpenSSL 1.0.2zf (affecting 1.0...

CVE-2020-10732

CVE-2020-10732 describes a Linux Kernel flaw in the Userspace core dumps implementation. According to connected IBM bulletin entries, the issue: allows a local authenticated attacker to obtain sensitive information or cause a program crash by exploiting the core-dump handling path. The vulnerabil...

CVE-2022-36879

CVE-2022-36879 affects the Linux kernel: a flaw in xfrm_policy handling (xfrm_expand_policies) can cause a refcount to be dropped twice in net/xfrm/xfrm_policy.c. This is a local vulnerability with an availability impact (as per CVSS: 5.5, MEDIUM). The issue exists through kernel versions up to 5...

CVE-2020-15436

The CVE-2020-15436 entry is confirmed by connected sources as a Linux kernel local-use-after-free vulnerability in fs/block_dev.c (pre-5.8). It enables a local attacker to gain elevated privileges or cause a denial of service by abusing improper access to a particular error field. The Linux kerne...

CVE-2019-19448

CVE-2019-19448 is a use-after-free in Linux kernel’s Btrfs code (try_merge_free_space in fs/btrfs/free-space-cache.c). It can be triggered by mounting a crafted Btrfs image and performing operations followed by a syncfs, due to a pointer alias between left and right data structures. Affected: Lin...

CVE-2022-1473

Summary: CVE-2022-1473 concerns a bug in the OPENSSL_LH_flush() function in OpenSSL 3.0 that breaks reuse of memory for removed hash table entries, used when decoding certificates or keys, leading to unbounded memory growth and potential DoS in long-lived processes (e.g., TLS clients/servers). Wh...

CVE-2020-8832

The CVE-2020-8832 entry concerns the Ubuntu 18.04 LTS Linux kernel where the fix for CVE-2019-14615 (clearing data structures on context switches for certain Intel graphics processors) was incomplete. The vulnerability affects kernels prior to 4.15.0-91.92, enabling a local attacker to expose sen...

CVE-2022-1343

Summary: CVE-2022-1343 affects the OpenSSL OCSP verification path. When the non-default OCSP_NOCHECKS flag is used, OCSP_basic_verify may return a positive verification result even if the signer certificate cannot be verified, leading to an incorrect success signal in OCSP checks (including the O...

CVE-2022-0742

CVE-2022-0742: Memory leak in Linux kernel ICMPv6 implementation (Linux kernel 5.13+) can allow a remote attacker to cause a DoS by flooding with ICMPv6 packets of type 130/131, exhausting memory. The advisory references a fix via a commit: 2d3916f3189172d5c69d33065c3c21119fe539fc. Connected sour...

CVE-2022-1434

The CVE-2022-1434 issue affects the RC4-MD5 ciphersuite in OpenSSL 3.0, where the AAD data is incorrectly used as the MAC key, allowing an attacker to modify data in transit without decrypting it. The vulnerability requires both endpoints to negotiate RC4-MD5, and it is not exploitable when TLSv1...

CVE-2019-25045

CVE-2019-25045 is a Linux kernel use-after-free in the XFRM subsystem (xfrm_state_fini panic) reported for kernels before 5.0.19. Publicly documented references from EulerOS and Unity Linux advisories confirm the issue and link the fix to kernel 5.0.19 (and related upstream commit). The impact is...