In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the corruption of the return address pointer of the do_i2c_md function. — CVE-2022-34835

Zusammenfassung

Sicherheitshinweis CVE-2022-34835. In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables… Hersteller: Microsoft. Quelle: MSRC. Risiko: critical. CVSS 9.8.…

Was tun?

Allgemeine, vorsichtige Schritte (bitte prüfe die offizielle Quelle für Details):

• Priorisiere sofort Patches oder Mitigations (hohes akutes Risiko).
• Identifiziere betroffene Produktversionen und prüfe, ob du betroffen bist.
• Spiele Hersteller-Updates/Patches ein oder setze empfohlene Mitigations um.
• Lies das offizielle Advisory für betroffene Versionen und konkrete Schritte.

Offizielles Advisory

Zur offiziellen Quelle

Mehr dazu

• The c_rehash script allows command injection CVE-2022-2068
• Windows Network File System Remote Code Execution Vulnerability CVE-2022-30136
• Authorization Bypass Through User-Controlled Key in emicklei/go-restful CVE-2022-1996
• .NET and Visual Studio Information Disclosure Vulnerability CVE-2022-30184
• <vuln:Note Title="Mariner" Type="Tag" Ordinal="20">Mariner CVE-2020-28493
• <vuln:Note Title="Mariner" Type="Tag" Ordinal="20">Mariner CVE-2021-22570
• <vuln:Note Title="Mariner" Type="Tag" Ordinal="20">Mariner CVE-2021-3733
• A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request. CVE-2022-23712
• A flaw out of bounds memory write in the Linux kernel UDF file system functionality was found in the way user triggers some file operation which triggers udf_write_fi(). A local user could use this flaw to crash the system or potentially CVE-2022-1943
• A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file. CVE-2021-40633
• A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to crash the system or potentially escalate their privileges on the system. CVE-2022-1998
• A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`. CVE-2022-27778