SB2023080805 - Multiple vulnerabilities in Dell Unity, Dell UnityVSA, and Dell Unity XT

Description

This security bulletin contains information about 110 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2019-19926)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the multiSelect() function in select.c when parsing certain error messages. A remote attacker can perform a denial of service attack.

2) Heap-based buffer overflow (CVE-ID: CVE-2017-17095)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in tools/pal2rgb.c in pal2rgb due to heap-based buffer overflow. A remote attacker can trigger memory corruption and cause the service to crash.

3) Out-of-bounds read (CVE-ID: CVE-2018-16301)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in libpcap when during pcapng reading. A remote attacker can pass specially crafted data to the application that uses the affected library, trigger out-of-bounds read error and read contents of memory on the system or crash the application.

4) NULL pointer dereference (CVE-ID: CVE-2020-9327)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations. A remote attacker can perform a denial of service (DoS) attack.

5) Out-of-bounds write (CVE-ID: CVE-2020-15358)

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

6) NULL pointer dereference (CVE-ID: CVE-2020-13632)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in ext/fts3/fts3_snippet.c in SQLite. A local user can trigger denial of service conditions via a crafted matchinfo() query.

7) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-13631)

The vulnerability allows a local user to bypass certain security restrictions.

The vulnerability exists due an error in alter.c and build.c files in SQLite that allows a local user to rename a virtual table into a shadow table. A local user with permissions to create virtual tables can renamed them and gain unauthorized access to the fronted application.

8) Use-after-free (CVE-ID: CVE-2020-13630)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the fts3EvalNextRow() function in ext/fts3/fts3.c. A remote attacker can pass specially crafted data to application, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

9) Input validation error (CVE-ID: CVE-2020-13435)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in sqlite3ExprCodeTarget() function in expr.c. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

10) Integer overflow (CVE-ID: CVE-2020-13434)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow within the sqlite3_str_vappendf() function in printf.c. A remote attacker can pass specially crafted data to the application, trigger integer overflow and crash the application.

11) Memory leak (CVE-ID: CVE-2019-20218)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due memory leak within the selectExpander() function in select.c in SQLite, caused by incorrect exception handling, related to stack unwinding. A remote attacker can trigger with ability to modify the WITH SQL query can gain access to potentially sensitive information.

12) Resource management error (CVE-ID: CVE-2019-19959)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error when parsing INSERT INTO queries in situations involving embedded '' characters in filenames in ext/misc/zipfile.c in SQLite. A remote attacker can perform a denial of service attack.

13) Arbitrary file upload (CVE-ID: CVE-2019-19925)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to zipfileUpdate in "ext/misc/zipfile.c" mishandles a NULL pathname during an update of a ZIP archive. A remote attacker can upload and execute arbitrary file on the server.

14) Buffer overflow (CVE-ID: CVE-2020-19131)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary error in the invertImage() function in the tiffcrop component. A remote attacker can pass a specially crafted file to the application and perform a denial of service attack.

15) Resource management error (CVE-ID: CVE-2019-19924)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect error handling in the sqlite3WindowRewrite(), related to parser-tree rewriting in expr.c, vdbeaux.c, and window.c. A remote attacker can use a specially crafted query to perform a denial of service attack.

16) NULL pointer dereference (CVE-ID: CVE-2019-19923)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to flattenSubquery in "select.c" mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. A remote attacker can cause a NULL pointer dereference and perform a denial of service (DoS) attack.

17) Untrusted Pointer Dereference (CVE-ID: CVE-2019-19880)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to invalid pointer dereference in exprListAppendList() function in window.c when processing constant integer values in ORDER BY clauses. A remote attacker with ability to interact with a query can execute arbitrary code on the target system.

18) Input validation error (CVE-ID: CVE-2019-19646)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of NOT NULL in an integrity_check PRAGMA command in pragma.c when generating certain columns. A remote attacker can perform a denial of service attack.

19) Infinite loop (CVE-ID: CVE-2019-19645)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in alter.c that can be triggered via certain types of self-referential views in conjunction with ALTER TABLE statements. A remote attacker can consume all available system resources and cause denial of service conditions.

20) Input validation error (CVE-ID: CVE-2019-19603)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing SELECT statements with a nonexistent VIEW. A remote attacker can perform a denial of service attack.

21) Input validation error (CVE-ID: CVE-2019-19317)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the lookupName() function in resolve.c, which leads to omitting bits from the colUsed bitmask in the case of a generated column. A remote attacker can perform a denial of service attack.

22) Input validation error (CVE-ID: CVE-2019-19244)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage in select.c . A remote attacker can crash the affected application using a specially crafted SQL query.

23) Input validation error (CVE-ID: CVE-2015-3415)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input passed via a specially crafted CHECK clause. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

24) Input validation error (CVE-ID: CVE-2015-3414)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input passed via a specially crafted COLLATE clause. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

25) Infinite loop (CVE-ID: CVE-2021-3737)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop. A remote attacker who controls a malicious server can force the client to enter an infinite loop on a 100 Continue response.

26) Integer overflow (CVE-ID: CVE-2019-17546)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow when processing RGBA images. A remote attacker can create a specially crafted RGBA image, pass it to the affected application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

27) Buffer overflow (CVE-ID: CVE-2020-35521)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing TIFF images in tif_read.c. A remote attacker can create a specially crafted TIFF, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

28) Improper input validation (CVE-ID: CVE-2021-3426)

The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Binding Support Function (Python) component in Oracle Communications Cloud Native Core Binding Support Function. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.

29) Heap-based buffer overflow (CVE-ID: CVE-2021-3872)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

30) Use-after-free (CVE-ID: CVE-2018-1311)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when scanning an external DTS file. A remote attacker can supply a specially crafted DTS file, trigger a use-after-free error and execute arbitrary code on the target system.

31) Use-after-free (CVE-ID: CVE-2022-0413)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when using freed memory when substitute with function call . A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

32) Heap-based buffer overflow (CVE-ID: CVE-2022-0361)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when copying lines in Visual mode. A remote attacker can trick the victim to open a specially crafted file, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

33) Buffer overflow (CVE-ID: CVE-2022-0351)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing files. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

34) Out-of-bounds read (CVE-ID: CVE-2022-0319)

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a boundary condition. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

35) NULL pointer dereference (CVE-ID: CVE-2021-46059)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the vim_regexec_multi() function in regexp.c in Vim. A remote attacker can trick the victim to open a specially crafted file and perform a denial of service (DoS) attack.

36) Out-of-bounds read (CVE-ID: CVE-2021-4193)

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a boundary condition. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and crash the application.

37) Out-of-bounds write (CVE-ID: CVE-2021-4019)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

38) Heap-based buffer overflow (CVE-ID: CVE-2021-3984)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

39) Use of Uninitialized Variable (CVE-ID: CVE-2021-3928)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to parsing uninitialized variable. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

40) Heap-based buffer overflow (CVE-ID: CVE-2021-3927)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

41) Use-after-free (CVE-ID: CVE-2021-3796)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a use-after-free error. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

42) Buffer overflow (CVE-ID: CVE-2020-35522)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing TIFF images in tif_pixarlog.c. A remote attacker can create a specially crafted TIFF image, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

43) Heap-based buffer overflow (CVE-ID: CVE-2021-3778)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

44) Out-of-bounds read (CVE-ID: CVE-2021-33120)

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to a boundary condition in memory subsystem. A local user can trigger out-of-bounds read error and read contents of memory on the system or perform a denial of service (DoS) attack.

45) Security features bypass (CVE-ID: CVE-2021-0146)

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to hardware allows activation of test or debug logic at runtime. An attacker with physical access to device can execute arbitrary code with elevated privileges.

46) Information disclosure (CVE-ID: CVE-2021-0145)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to improper initialization of shared resources. A local user can gain unauthorized access to sensitive information on the system.

47) Input validation error (CVE-ID: CVE-2021-0127)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient control flow management. A local user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

48) Information disclosure (CVE-ID: CVE-2020-24513)

The vulnerability allows a local user o gain access to potentially sensitive information.

The vulnerability exists due to domain-bypass transient execution issue. A local user can gain unauthorized access to sensitive information on the system.

49) Observable discrepancy (CVE-ID: CVE-2020-24512)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to observable timing discrepancy. A local user can gain unauthorized access to sensitive information on the system.

50) Information disclosure (CVE-ID: CVE-2020-24511)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to improper isolation of shared resources. A local user can gain unauthorized access to sensitive information on the system.

51) Incomplete cleanup (CVE-ID: CVE-2020-24489)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incomplete cleanup, which leads to security restrictions bypass and privilege escalation.

52) Out-of-bounds read (CVE-ID: CVE-2022-22844)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary condition in the _TIFFmemcpy() function in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field. A remote attacker can pass a specially crafted file and perform a denial of service attack.

53) Buffer overflow (CVE-ID: CVE-2020-35524)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing TIFF images in libtiff's TIFF2PDF tool. A remote attacker can create a specially crafted TIFF image, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

54) Integer overflow (CVE-ID: CVE-2020-35523)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the the tif_getimage.c file in libtiff. A remote attacker can pass specially crafted file to the application, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

55) Resource management error (CVE-ID: CVE-2021-3733)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application within the AbstractBasicAuthHandler class in urllib. A remote attacker with control over the server can perform regular expression denial of service attack during authentication.

56) Input validation error (CVE-ID: CVE-2021-4034)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper handling of the calling parameters count in the pkexec setuid binary, which causes the binary to execute environment variables as commands. A local user can craft environment variables in a way that they will be processed and executed by pkexec and execute arbitrary commands on the system as root.

57) Out-of-bounds write (CVE-ID: CVE-2022-23943)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in mod_sed. A remote attacker can trigger out-of-bounds write and execute arbitrary code on the target system.

58) Improper input validation (CVE-ID: CVE-2020-5360)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Oracle Database - Enterprise Edition Security (Dell BSAFE Micro Edition Suite) in Oracle Database Server. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

59) Unchecked Return Value (CVE-ID: CVE-2020-5359)

The vulnerability allows a remote attacker to modify and corrupt the encrypted data.

The vulnerability exists due to unchecked return value. A remote unauthenticated attacker can trigger the vulnerability to modify and corrupt the encrypted data on the target system.

60) SQL injection (CVE-ID: CVE-2022-24407)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of password in the SQL plugin shipped with Cyrus SASL. A remote non-authenticated attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

61) Infinite loop (CVE-ID: CVE-2021-3468)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work() function. A local user can consume all available system resources and cause denial of service conditions.

62) Resource exhaustion (CVE-ID: CVE-2021-42340)

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak when processing HTTP connections. A remote attacker can initiate multiple HTTP connections with the web server and consume all available memory on the system.

63) Infinite loop (CVE-ID: CVE-2021-41079)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when processing certain TLS packets. A remote attacker can send a specially crafted packet to the application, consume all available system resources and cause denial of service conditions.

Successful exploitation of vulnerability requires that Apache Tomcat is configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS.

64) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2021-33037)

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests, related to processing of transfer encoding headers.  A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

65) Improper Authentication (CVE-ID: CVE-2021-30640)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in the JNDI Realm when processing authentication requests. A remote attacker can authenticate using variations of a valid user name and bypass some of the protection provided by the LockOut Realm.

66) Improper Handling of Exceptional Conditions (CVE-ID: CVE-2021-30639)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error management within the application when handling unexpected connection termination. A remote attacker can drop connection with the Apache Tomcat server, which triggers a non-blocking I/O error and causes all requests, handled by that request object, to fail. As a result, a remote attacker can initiate and drop connections to the server and perform a denial of service attack.

67) Deserialization of Untrusted Data (CVE-ID: CVE-2021-25329)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Note, the vulnerability exists due to incomplete fix for #VU28158 and requires a certain specific configuration.

68) Resource management error (CVE-ID: CVE-2021-25122)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper management of internal resources within the application when processing new h2c connection requests. A remote attacker can send specially crafted requests to the server and obtain contents of HTTP responses, served to other users.

69) Integer overflow (CVE-ID: CVE-2022-22721)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the ap_escape_html2() function when parsing LimitXMLRequestBody. A remote attacker can send a specially crafted request to the web server, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

70) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-32760)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to archive package allows chmod of file outside of unpack target directory. A remote attacker can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky.

71) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2022-22720)

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

72) Input validation error (CVE-ID: CVE-2022-22719)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized value in r:parsebody. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

73) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2021-40438)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input within the mod_proxy module in Apache HTTP Server. A remote attacker can send a specially crafted HTTP request with a chosen uri-path and trick the web server to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

74) Buffer overflow (CVE-ID: CVE-2021-39275)

The vulnerability allows a remote attacker to execute arbitrary code on the target system or perform a denial of service attack.

The vulnerability exists due to a boundary error within the ap_escape_quotes()  function. A remote attacker can send a specially crafted request to the web server, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that the Apache module passes untrusted data to the affected function.

According to vendor, No included modules pass untrusted data to these functions

75) Out-of-bounds read (CVE-ID: CVE-2021-36160)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in the mod_proxy_uwsgi module in Apache HTTP Server. A remote attacker can send an HTTP request with specially crafted uri-path, trigger an out-of-bounds read and perform a denial of service (DoS) attack.

76) NULL pointer dereference (CVE-ID: CVE-2021-34798)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can send a specially crafted HTTP request to the affected web server and perform a denial of service (DoS) attack.

77) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2021-33193)

The vulnerability allows a remote attacker to preform HTTP/2 request smuggling attacks.

The vulnerability exists due to improper validation of HTTP/2 requests in mod_proxy in Apache HTTP Server. A remote attacker can send a specially crafted HTTP/2 request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison web server cache and perform phishing attacks.

78) Heap-based buffer overflow (CVE-ID: CVE-2021-45417)

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in src/base64.h. A local user can use specially crafted file metadata, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

79) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2022-22564)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to Dell EMC Unity using broken cryptographic algorithm. A remote attacker can exploit this vulnerability by performing MitM attacks and let attackers obtain sensitive information.

80) Insufficiently protected credentials (CVE-ID: CVE-2022-29085)

The vulnerability allows a local privileged user to execute arbitrary code on the target system.

The vulnerability exists due to Dell Unity, Dell UnityVSA, and Dell Unity XT contain a plain-text password storage vulnerability when certain off-array tools are run on the system. A local privileged user can use the exposed password to gain access with the privileges of the compromised user.

81) Improper Restriction of Excessive Authentication Attempts (CVE-ID: CVE-2022-29084)

The vulnerability allows a remote attacker to gain access to the system.

The vulnerability exists due to Dell Unity, Dell UnityVSA, and Dell Unity XT do not restrict excessive authentication attempts in Unisphere GUI. A remote attacker can exploit this vulnerability to brute-force passwords and gain access to the system.

82) Security features bypass (CVE-ID: CVE-2021-30465)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the security features bypass issue. A remote authenticated attacker on the local network can perform a symlink exchange attack and host filesystem being bind-mounted into the container.

83) Improper Preservation of Permissions (CVE-ID: CVE-2021-41089)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions, which leads to security restrictions bypass and privilege escalation.

84) Buffer overflow (CVE-ID: CVE-2020-29361)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a unspecified boundary error, related to processing of RPC requests. A remote attacker can perform a denial of service (DoS) attack.

85) Input validation error (CVE-ID: CVE-2022-25236)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper protection against insertion of namesep characters into namespace URIs in xmlparse.c. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

86) Infinite loop (CVE-ID: CVE-2022-0778)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the BN_mod_sqrt() function when processing an ASN.1 certificate that contains elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. A remote attacker can supply a specially crafted certificate to the TLS server or client, consume all available system resources and cause denial of service conditions.

87) Incorrect permission assignment for critical resource (CVE-ID: CVE-2020-15862)

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to insecure permissions set by the Net-snmp installed on Debian-based systems. A remote user can overwrite files in net-snmp directory via EXTEND MIB and execute arbitrary code on the system with root privileges.

88) Null pointer dereference (CVE-ID: CVE-2018-18065)

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The vulnerability exists  in the _set_key() function, as defined in the agent/helpers/table_container.c source code file due to a NULL pointer exception bug. A remote attacker can send a malicious UDP packet, trigger a NULL pointer dereference condition, cause the application to crash.

89) Out-of-bounds read (CVE-ID: CVE-2019-19977)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

90) Race condition (CVE-ID: CVE-2021-40490)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

91) Out-of-bounds write (CVE-ID: CVE-2020-12762)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in the "printbuf_memappend". A remote attacker can create a specially crafted JSON file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

92) Integer overflow (CVE-ID: CVE-2021-35942)

The vulnerability allows a remote attacker to gain access to sensitive information or perform a DoS attack.

The vulnerability exists due to integer overflow in parse_param in posix/wordexp.c in the GNU C Library when called with an untrusted pattern. A remote attacker can pass specially crafted data to the application, trigger integer overflow and read arbitrary memory on the system of perform a denial of service (DoS) attack.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

93) Use-after-free (CVE-ID: CVE-2021-33574)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the mq_notify() function in the GNU C Library. A remote attacker can force the library to use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service or possibly remote code execution.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

94) Integer overflow (CVE-ID: CVE-2022-25315)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in storeRawNames function. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

95) Integer overflow (CVE-ID: CVE-2022-25314)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in copyString. A remote attacker can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.

96) Stack-based buffer overflow (CVE-ID: CVE-2022-25313)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in build_model. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

97) Code Injection (CVE-ID: CVE-2022-25235)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the affected application lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

98) Improper Preservation of Permissions (CVE-ID: CVE-2021-41091)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions, which leads to security restrictions bypass and privilege escalation.

99) Integer overflow (CVE-ID: CVE-2022-23990)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the doProlog() function. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

100) Integer overflow (CVE-ID: CVE-2022-23852)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

101) Integer overflow (CVE-ID: CVE-2022-22827)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the storeAtts() function in xmlparse.c. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

102) Integer overflow (CVE-ID: CVE-2022-22826)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the nextScaffoldPart() function in xmlparse.c. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

103) Integer overflow (CVE-ID: CVE-2022-22825)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the lookup() function in xmlparse.c. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

104) Integer overflow (CVE-ID: CVE-2022-22824)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the defineAttribute() function in xmlparse.c. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

105) Integer overflow (CVE-ID: CVE-2022-22823)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the build_model() function in xmlparse.c. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

106) Integer overflow (CVE-ID: CVE-2022-22822)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the addBinding() function in xmlparse.c. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

107) Integer overflow (CVE-ID: CVE-2021-46143)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the doProlog() function in xmlparse.c. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

108) Resource exhaustion (CVE-ID: CVE-2021-45960)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in the storeAtts() function in xmlparse.c. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

109) Incorrect default permissions (CVE-ID: CVE-2021-41103)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for container root directories and some plugins. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host can discover, read, and modify those files.

110) Information disclosure (CVE-ID: CVE-2021-41092)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to sensitive information on the system.

Remediation

Install update from vendor's website.

References

• https://www.dell.com/support/kbdoc/nl-nl/000199050/dsa-2022-021-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities