Medium WID-SEC-2023-0296 8 CVEs

Meinberg LANTIME: Mehrere Schwachstellen

Published Feb 6, 2023 · Updated Feb 6, 2023 · de-DE

Vendor: Meinberg Product: LANTIME Product: LANTIME < 6.24.035 Product: LANTIME < 7.06.009

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in Meinberg LANTIME ausnutzen, um seine Privilegien zu erhöhen, um einen Denial of Service Zustand herbeizuführen und um nicht näher beschriebene Auswirkungen zu verursachen.

Product

Die Meinberg Produktfamilie LANTIME, umfasst NTP Zeitserver in unterschiedlichsten Bauformen zur einfachen Zeitsynchronisation

Vulnerabilities 8

High 8.1

CVE-2022-42915

curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it se…

curl curl curl tensorflow Debian Ubuntu Azure Linux Alpine

Oct 29, 2022
High 7.5

CVE-2022-42916

In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, cur…

curl curl curl tensorflow Debian Ubuntu Azure Linux Alpine Wolfi

Oct 29, 2022
High 7.1

CVE-2022-43995

Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bou…

sudo sudo sudo Debian Azure Linux Alpine

Nov 2, 2022
Medium 6.5

CVE-2022-42010

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenti…

dbus dbus dbus dbus Debian Ubuntu Azure Linux Alpine

Oct 9, 2022
Medium 6.5

CVE-2022-42011

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenti…

dbus dbus dbus dbus Debian Ubuntu Azure Linux Alpine

Oct 9, 2022
Medium 6.5

CVE-2022-42012

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenti…

dbus dbus dbus dbus Debian Ubuntu Azure Linux Alpine

Oct 9, 2022
Low 3.7

CVE-2022-35252

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when …

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Sep 23, 2022
Unscored —

CVE-2022-35260

curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white s…

curl curl tensorflow Debian Azure Linux Alpine

Dec 5, 2022

Revision history

2023-02-06 #1
Initiale Fassung

References

Meinberg Security Advisory vom 2023-01-24
https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2023-01-meinberg-lantime-firmware-v7-06-009-und-v6-24-035.htm