Summary
Multiple third-party component vulnerabilities were reported for the Busybox applet, the Linux Kernel, OpenSSL, OpenVPN and various other components used by the RUGGEDCOM and SCALANCE products. The vulnerabilities range from improper neutralization of special elements to improper handling of commands under certain circumstances, that could lead to code injection and denial of service.
Siemens has released updates for the affected products and recommends to update to the latest versions.
Vulnerabilities 65
-
High 7.8
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid too…
KEV Jun 27, 2022 -
Critical 9.8
OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more tha…
-
Critical 9.8
The c_rehash script allows command injection
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitra…
-
Critical 9.8CVE-2022-32207 EPSS 12%
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the…
-
High 7.8
An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and p…
-
High 7.8
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing …
-
High 7.5
Nokogiri affected by zlib's Out-of-bounds Write vulnerability
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
-
High 7.5
A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radi…
-
High 7.5
Resource leakage when decoding certificates and keys
The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes cer…
-
High 7.5
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
-
High 7.5CVE-2022-36946 Public exploit
nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a …
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
Medium 6.7
In bdi_put and bdi_unregister of backing-dev.c, there is a possible memory corruption due to a use after free. This cou…
-
Medium 6.5CVE-2022-0001 Public exploit
Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authori…
-
Medium 6.5
Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user t…
-
Medium 6.5CVE-2022-32206 EPSS 36%
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple …
-
Medium 5.9
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw make…
-
Medium 5.6CVE-2019-1125 Public exploit
Windows Kernel Information Disclosure Vulnerability
An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An attacker who successfully exploited the vulnerability could read privileged data across trust boundaries. To exploit this vulnerability,…
-
Medium 5.5
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted…
-
Medium 5.5
The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() fu…
-
Medium 5.5
In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.
-
Medium 5.5
An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a…
-
Medium 5.3
An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA…
-
Medium 5.3
OCSP_basic_verify may incorrectly verify the response signing certificate
The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response sig…
-
Medium 5.3CVE-2022-2588 Public exploit
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the …
-
Medium 4.3CVE-2022-32205 EPSS 31%
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 st…
-
Low 3.7
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when …
-
Low 3.3
drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency…
-
Unscored —
LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.
-
Unscored —
A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock o…
-
Unscored —
A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no pa…
-
Unscored —
A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command,…
-
Unscored —
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution whe…
-
Unscored —
A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kern…
-
Unscored —CVE-2022-1011 Public exploit
A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw all…
-
Unscored —
A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. …
-
Unscored —
A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to cra…
-
Unscored —
A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a lo…
-
Unscored —
A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionalit…
-
Unscored —
Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-fr…
-
Unscored —
A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain…
-
Unscored —
A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free b…
-
Unscored —
A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition between kobject cr…
-
Unscored —
There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a …
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —CVE-2022-2639 Public exploit
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, whi…
-
Unscored —
st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTI…
-
Unscored —
ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
-
Unscored —CVE-2022-30594 Public exploit
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass in…
-
Unscored —
The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occ…
-
Unscored —CVE-2022-32981 Public exploit
An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in p…
Revision history
-
#1
Publication Date
References
-
SSA-419740: Multiple Third-Party Component Vulnerabilities in RUGGEDCOM and SCALANCE Products before V7.2 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-419740.pdf
-
SSA-419740: Multiple Third-Party Component Vulnerabilities in RUGGEDCOM and SCALANCE Products before V7.2 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-419740.txt