SB2023050967 - Red Hat Enterprise Linux 9 update for libguestfs-winsupport
Published: May 9, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2021-46790)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in the ntfsck in NTFS-3G when processing specially crafted NTFS filesystem. A local user can mount a malicious NTFS filesystem, trigger a heap-based buffer overflow and execute arbitrary code with elevated privileges.
2) Heap-based buffer overflow (CVE-ID: CVE-2022-30784)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in ntfs_get_attribute_value. A remote administrator can use a specially crafted NTFS image file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Heap-based buffer overflow (CVE-ID: CVE-2022-30786)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in ntfs_names_full_collate. A remote administrator can use a specially crafted NTFS image file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Heap-based buffer overflow (CVE-ID: CVE-2022-30788)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in ntfs_mft_rec_alloc. A remote administrator can use a specially crafted NTFS image file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
5) Heap-based buffer overflow (CVE-ID: CVE-2022-30789)
The vulnerability allows a local attacker to execute arbitrary code with escalated privileges.
The vulnerability exists due to a boundary error in the ntfs_check_log_client_array in NTFS-3G. A local attacker can mount a specially crafted NTFS image, trigger a heap-based buffer overflow and execute arbitrary code with escalated privileges.
Remediation
Install update from vendor's website.