All the vulnerabilites related to memcached - memcached
Vulnerability from fkie_nvd
Published
2014-01-13 21:55
Modified
2024-11-21 02:00
Severity ?
Summary
The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| memcached | memcached | 1.4.4 | |
| memcached | memcached | 1.4.5 | |
| memcached | memcached | 1.4.6 | |
| memcached | memcached | 1.4.7 | |
| memcached | memcached | 1.4.8 | |
| memcached | memcached | 1.4.9 | |
| memcached | memcached | 1.4.10 | |
| memcached | memcached | 1.4.11 | |
| memcached | memcached | 1.4.12 | |
| memcached | memcached | 1.4.13 | |
| memcached | memcached | 1.4.14 | |
| memcached | memcached | 1.4.15 | |
| memcached | memcached | 1.4.16 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1F4CD0E-CB74-4D72-ABDF-97820DE6A595",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "0BC45B91-2C50-4D9A-9D8D-026249FB4B4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "8FE2B6E7-1066-4D7D-9346-F03487EAE77C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DC04F90C-2813-44F8-B48D-9EAF6E8B78A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1E305092-2CFD-4A94-BCE5-7F9AAEDB74D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "924552C6-BF90-49F1-A562-620196503246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "92EFE814-FA06-487A-8E5F-CD00457334A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "2AB6AF32-7B4B-4FEB-BE5D-A260852ED0DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A93A9113-B3AE-4952-9B98-B296DB7580B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "F60CAEF4-EDD2-474D-99AE-AFBDE73BBBCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "29C9CE6E-6330-4346-8989-2A7DA7BFD19A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "01E082CD-A502-4CD2-8995-2086217205A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.16:*:*:*:*:*:*:*",
"matchCriteriaId": "48A8CBA7-31EE-4013-A0C9-42444500DF62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179."
},
{
"lang": "es",
"value": "La funci\u00f3n do_item_get en items.c de memcached 1.4.4 y otras versiones anteriores a 1.4.17, cuando se ejecutan en modo verboso, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (fallo de segmentaci\u00f3n) a trav\u00e9s de una petici\u00f3n para eliminar una clave, que no cuenta la falta de un terminador nulo en la clave y desencadena una sobre-lectura de b\u00fafer cuando se imprime hacia stderr, una vulnerabilidad diferente a CVE-2013-0179."
}
],
"id": "CVE-2013-7290",
"lastModified": "2024-11-21T02:00:40.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 1.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.2,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-01-13T21:55:05.260",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/64988"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=306"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/64988"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=306"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-08-22 19:16
Modified
2024-11-21 05:13
Severity ?
Summary
Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted meta command.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/memcached/memcached/issues/636 | Exploit, Issue Tracking | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/memcached/memcached/issues/636 | Exploit, Issue Tracking |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9CDEE25B-32D1-4097-BDAB-3C5673C6CE5B",
"versionEndExcluding": "1.6.3",
"versionStartIncluding": "1.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted meta command."
},
{
"lang": "es",
"value": "Memcached 1.6.0 anterior a 1.6.3 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda del demonio) a trav\u00e9s de un meta comando manipulado.\n"
}
],
"id": "CVE-2020-22570",
"lastModified": "2024-11-21T05:13:18.597",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-08-22T19:16:19.297",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking"
],
"url": "https://github.com/memcached/memcached/issues/636"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking"
],
"url": "https://github.com/memcached/memcached/issues/636"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-01-13 21:55
Modified
2024-11-21 02:00
Severity ?
Summary
memcached before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (crash) via a request that triggers an "unbounded key print" during logging, related to an issue that was "quickly grepped out of the source tree," a different vulnerability than CVE-2013-0179 and CVE-2013-7290.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| memcached | memcached | * | |
| memcached | memcached | 1.4.0 | |
| memcached | memcached | 1.4.1 | |
| memcached | memcached | 1.4.2 | |
| memcached | memcached | 1.4.3 | |
| memcached | memcached | 1.4.4 | |
| memcached | memcached | 1.4.5 | |
| memcached | memcached | 1.4.6 | |
| memcached | memcached | 1.4.7 | |
| memcached | memcached | 1.4.8 | |
| memcached | memcached | 1.4.9 | |
| memcached | memcached | 1.4.10 | |
| memcached | memcached | 1.4.11 | |
| memcached | memcached | 1.4.12 | |
| memcached | memcached | 1.4.13 | |
| memcached | memcached | 1.4.14 | |
| memcached | memcached | 1.4.15 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5BC2D838-BD98-438F-8B8A-C2C26E129E63",
"versionEndIncluding": "1.4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9D6D790C-560B-460F-A175-B47A5AFAA9F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "358D87E0-9392-4C00-94CE-C14BC408BCF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "CE58473C-3D01-4519-B1F9-1F1808191EDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F45F2A98-7146-4501-B2A7-A376204DCFD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1F4CD0E-CB74-4D72-ABDF-97820DE6A595",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "0BC45B91-2C50-4D9A-9D8D-026249FB4B4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "8FE2B6E7-1066-4D7D-9346-F03487EAE77C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DC04F90C-2813-44F8-B48D-9EAF6E8B78A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1E305092-2CFD-4A94-BCE5-7F9AAEDB74D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "924552C6-BF90-49F1-A562-620196503246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "92EFE814-FA06-487A-8E5F-CD00457334A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "2AB6AF32-7B4B-4FEB-BE5D-A260852ED0DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A93A9113-B3AE-4952-9B98-B296DB7580B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "F60CAEF4-EDD2-474D-99AE-AFBDE73BBBCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "29C9CE6E-6330-4346-8989-2A7DA7BFD19A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "01E082CD-A502-4CD2-8995-2086217205A6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "memcached before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (crash) via a request that triggers an \"unbounded key print\" during logging, related to an issue that was \"quickly grepped out of the source tree,\" a different vulnerability than CVE-2013-0179 and CVE-2013-7290."
},
{
"lang": "es",
"value": "memcached anterior a la versi\u00f3n 1.4.17, cuando se ejecuta en modo verboso, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda) a trav\u00e9s de una petici\u00f3n que desencadena una \"unbounded key print\" durante el proceso de inicio de sesi\u00f3n, relacionado con el problema que fue \"exclu\u00eddo r\u00e1pidamente de la ra\u00edz de la fuente\", una vulnerabilidad diferente a CVE-2013-0179 y CVE-2013-7290."
}
],
"id": "CVE-2013-7291",
"lastModified": "2024-11-21T02:00:40.330",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 1.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.2,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-01-13T21:55:05.277",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/64989"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=306"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/64989"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=306"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-08-30 15:15
Modified
2024-11-21 04:27
Severity ?
Summary
memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:1.5.16:*:*:*:*:*:*:*",
"matchCriteriaId": "38B5D12B-871A-47FF-8663-B7A6D26EA3FA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c."
},
{
"lang": "es",
"value": "memcached 1.5.16, cuando se utilizan sockets UNIX, tiene una sobre-lectura de buffer basada en la pila en conn_to_str en memcached.c."
}
],
"id": "CVE-2019-15026",
"lastModified": "2024-11-21T04:27:53.893",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-08-30T15:15:10.927",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00060.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/commit/554b56687a19300a75ec24184746b5512580c819"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1517"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00006.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOD422IS2OPXRDID5EKFZHFUHK2BLQGJ/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYGUBOEM5HX4GRMWVEKOJUFICF77ME47/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDBV5OGV3FJDAH4NO4JSXNRWHDGGKWYB/"
},
{
"source": "cve@mitre.org",
"url": "https://usn.ubuntu.com/4125-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00060.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/commit/554b56687a19300a75ec24184746b5512580c819"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1517"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOD422IS2OPXRDID5EKFZHFUHK2BLQGJ/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYGUBOEM5HX4GRMWVEKOJUFICF77ME47/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDBV5OGV3FJDAH4NO4JSXNRWHDGGKWYB/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://usn.ubuntu.com/4125-1/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-02-03 18:15
Modified
2024-11-21 06:15
Severity ?
Summary
Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted authenticattion file.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/memcached/memcached/issues/805 | Exploit, Issue Tracking, Third Party Advisory | |
| cve@mitre.org | https://github.com/memcached/memcached/pull/806/commits/264722ae4e248b453be00e97197dadc685b60fd0 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/memcached/memcached/issues/805 | Exploit, Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/memcached/memcached/pull/806/commits/264722ae4e248b453be00e97197dadc685b60fd0 | Patch, Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:1.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "EB6BFCFB-66D7-44B0-BFB2-3A17EA62EA8C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted authenticattion file."
}
],
"id": "CVE-2021-37519",
"lastModified": "2024-11-21T06:15:18.260",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-02-03T18:15:14.080",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/issues/805"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/pull/806/commits/264722ae4e248b453be00e97197dadc685b60fd0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/issues/805"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/pull/806/commits/264722ae4e248b453be00e97197dadc685b60fd0"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-01-13 21:55
Modified
2024-11-21 01:47
Severity ?
Summary
The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| memcached | memcached | 1.4.4 | |
| memcached | memcached | 1.4.5 | |
| memcached | memcached | 1.4.6 | |
| memcached | memcached | 1.4.7 | |
| memcached | memcached | 1.4.8 | |
| memcached | memcached | 1.4.9 | |
| memcached | memcached | 1.4.10 | |
| memcached | memcached | 1.4.11 | |
| memcached | memcached | 1.4.12 | |
| memcached | memcached | 1.4.13 | |
| memcached | memcached | 1.4.14 | |
| memcached | memcached | 1.4.15 | |
| memcached | memcached | 1.4.16 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1F4CD0E-CB74-4D72-ABDF-97820DE6A595",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "0BC45B91-2C50-4D9A-9D8D-026249FB4B4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "8FE2B6E7-1066-4D7D-9346-F03487EAE77C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DC04F90C-2813-44F8-B48D-9EAF6E8B78A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1E305092-2CFD-4A94-BCE5-7F9AAEDB74D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "924552C6-BF90-49F1-A562-620196503246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "92EFE814-FA06-487A-8E5F-CD00457334A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "2AB6AF32-7B4B-4FEB-BE5D-A260852ED0DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A93A9113-B3AE-4952-9B98-B296DB7580B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "F60CAEF4-EDD2-474D-99AE-AFBDE73BBBCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "29C9CE6E-6330-4346-8989-2A7DA7BFD19A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "01E082CD-A502-4CD2-8995-2086217205A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.16:*:*:*:*:*:*:*",
"matchCriteriaId": "48A8CBA7-31EE-4013-A0C9-42444500DF62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr."
},
{
"lang": "es",
"value": "La funci\u00f3n process_bin_delete en memcached.c de memcached 1.4.4 y otras versiones anteriores a 1.4.17, cuando se ejecutan en modo verboso, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (fallo de segmentaci\u00f3n) a trav\u00e9s de una petici\u00f3n que elimina una clave, que no tiene en cuenta la falta de un terminador nulo en la clave y desencadena una sobre-lectura de b\u00fafer cuando se imprime hacia stderr."
}
],
"id": "CVE-2013-0179",
"lastModified": "2024-11-21T01:47:00.477",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 1.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:H/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.2,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-01-13T21:55:05.183",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/56183"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/01/14/4"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/01/14/6"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/64978"
},
{
"source": "secalert@redhat.com",
"url": "http://www.ubuntu.com/usn/USN-2080-1"
},
{
"source": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=895054"
},
{
"source": "secalert@redhat.com",
"url": "https://code.google.com/p/memcached/issues/attachmentText?id=306\u0026aid=3060004000\u0026name=0001-Fix-buffer-overrun-when-logging-key-to-delete-in-bin.patch\u0026token=3GEzHThBL5cxmUrsYANkW03RrNY%3A1358179503096"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Patch"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=306"
},
{
"source": "secalert@redhat.com",
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/56183"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/01/14/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/01/14/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/64978"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-2080-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=895054"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://code.google.com/p/memcached/issues/attachmentText?id=306\u0026aid=3060004000\u0026name=0001-Fix-buffer-overrun-when-logging-key-to-delete-in-bin.patch\u0026token=3GEzHThBL5cxmUrsYANkW03RrNY%3A1358179503096"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=306"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-03-13 21:29
Modified
2024-11-21 03:39
Severity ?
Summary
memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| memcached | memcached | * | |
| debian | debian_linux | 7.0 | |
| debian | debian_linux | 8.0 | |
| debian | debian_linux | 9.0 | |
| canonical | ubuntu_linux | 14.04 | |
| canonical | ubuntu_linux | 16.04 | |
| canonical | ubuntu_linux | 17.10 | |
| redhat | openstack | 10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E4A5BA96-D9BA-4630-86D7-2B4B44207510",
"versionEndExcluding": "1.4.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*",
"matchCriteriaId": "9070C9D8-A14A-467F-8253-33B966C16886",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*",
"matchCriteriaId": "E722FEF7-58A6-47AD-B1D0-DB0B71B0C7AA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later."
},
{
"lang": "es",
"value": "memcached, en versiones anteriores a la 1.4.37, contiene una vulnerabilidad de desbordamiento de enteros en items.c:item_free() que puede resultar en la corrupci\u00f3n de datos y en deadlocks debido a que los \u00edtems en la tabla de hash se reusan de la lista libre. Este ataque parece ser explotable mediante conectividad de red en el servicio memcached. La vulnerabilidad parece haber sido solucionada en las versiones 1.4.37 y siguientes."
}
],
"id": "CVE-2018-1000127",
"lastModified": "2024-11-21T03:39:44.437",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-03-13T21:29:00.477",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2290"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/issues/271"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1437"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00031.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/3601-1/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2018/dsa-4218"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2290"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/issues/271"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1437"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00031.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/3601-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2018/dsa-4218"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-190"
},
{
"lang": "en",
"value": "CWE-667"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-10-27 20:15
Modified
2024-11-21 08:29
Severity ?
Summary
In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the "get" substring.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CEB5B313-3710-4308-933A-764A76E8D77A",
"versionEndExcluding": "1.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the \"get\" substring."
},
{
"lang": "es",
"value": "En Memcached anterior a 1.6.22, existe un desbordamiento del b\u00fafer al procesar solicitudes de obtenci\u00f3n m\u00faltiple en modo proxy, si hay muchos espacios despu\u00e9s de la subcadena \"get\"."
}
],
"id": "CVE-2023-46852",
"lastModified": "2024-11-21T08:29:25.717",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-10-27T20:15:09.133",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/memcached/memcached/commit/76a6c363c18cfe7b6a1524ae64202ac9db330767"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/memcached/memcached/compare/1.6.21...1.6.22"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/memcached/memcached/commit/76a6c363c18cfe7b6a1524ae64202ac9db330767"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/memcached/memcached/compare/1.6.21...1.6.22"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-08-22 19:16
Modified
2024-11-21 07:33
Severity ?
Summary
memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:1.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "009882B6-13BA-490C-8A7D-F293C3B50D4A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP."
}
],
"id": "CVE-2022-48571",
"lastModified": "2024-11-21T07:33:31.510",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-08-22T19:16:32.233",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/memcached/memcached/commit/6b319c8c7a29e9c353dec83dc92f01905f6c8966"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/memcached/memcached/commit/6b319c8c7a29e9c353dec83dc92f01905f6c8966"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00004.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-03-05 14:29
Modified
2024-11-21 03:39
Severity ?
Summary
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| memcached | memcached | 1.5.5 | |
| canonical | ubuntu_linux | 14.04 | |
| canonical | ubuntu_linux | 16.04 | |
| canonical | ubuntu_linux | 17.10 | |
| debian | debian_linux | 8.0 | |
| debian | debian_linux | 9.0 | |
| redhat | openstack | 8 | |
| redhat | openstack | 9 | |
| redhat | openstack | 10 | |
| redhat | openstack | 11 | |
| redhat | openstack | 12 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:1.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "81CD27E0-30C4-484D-A846-6121C88C49EA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*",
"matchCriteriaId": "9070C9D8-A14A-467F-8253-33B966C16886",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*",
"matchCriteriaId": "E8B8C725-34CF-4340-BE7B-37E58CF706D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*",
"matchCriteriaId": "F40C26BE-56CB-4022-A1D8-3CA0A8F87F4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*",
"matchCriteriaId": "E722FEF7-58A6-47AD-B1D0-DB0B71B0C7AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:openstack:11:*:*:*:*:*:*:*",
"matchCriteriaId": "4E9AF77C-5D49-4842-9817-AD710A919073",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D4AC996-B340-4A14-86F7-FF83B4D5EC8F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default."
},
{
"lang": "es",
"value": "Memcached 1.5.5 contiene una vulnerabilidad de control insuficiente de volumen de mensaje de red (amplificaci\u00f3n de red, CWE-406) en el soporte UDP del servidor memcached que puede resultar en una denegaci\u00f3n de servicio (DoS) mediante una inundaci\u00f3n de red (fuentes fiables reportan una amplificaci\u00f3n de tr\u00e1fico de 1:50.000). Este ataque parece ser explotable mediante conectividad de red en el puerto UDP 11211. Parece ser que esta vulnerabilidad se ha solucionado en la versi\u00f3n 1.5.6 debido a que se deshabilita por defecto el protocolo UDP."
}
],
"id": "CVE-2018-1000115",
"lastModified": "2024-11-21T03:39:40.657",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-03-05T14:29:00.203",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHBA-2018:2140"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:1593"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:1627"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2331"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2857"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/issues/348"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes156"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://twitter.com/dormando/status/968579781729009664"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/3588-1/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2018/dsa-4218"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44264/"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44265/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.synology.com/support/security/Synology_SA_18_07"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHBA-2018:2140"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:1593"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:1627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2331"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2857"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/issues/348"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes156"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://twitter.com/dormando/status/968579781729009664"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/3588-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2018/dsa-4218"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44264/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44265/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.synology.com/support/security/Synology_SA_18_07"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-04-29 15:29
Modified
2024-11-21 04:21
Severity ?
Summary
In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| memcached | memcached | * | |
| canonical | ubuntu_linux | 18.04 | |
| canonical | ubuntu_linux | 18.10 | |
| canonical | ubuntu_linux | 19.04 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*",
"matchCriteriaId": "85D5D451-DE60-4DD3-8283-D838785D20AC",
"versionEndExcluding": "1.5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*",
"matchCriteriaId": "07C312A0-CD2C-4B9C-B064-6409B25C278F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*",
"matchCriteriaId": "CD783B0C-9246-47D9-A937-6144FE8BFF0F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In memcached before 1.5.14, a NULL pointer dereference was found in the \"lru mode\" and \"lru temp_ttl\" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c."
},
{
"lang": "es",
"value": "memcached versiones anteriores a la 1.5.14, se encontr\u00f3 una desreferencia a un puntero NULL en los comandos \"lru mode\" y \"lru temp_ttl\". Esto causa una denegaci\u00f3n de servicio cuando se analizan mensajes de comandos lru en process_lru_command en memcached.c."
}
],
"id": "CVE-2019-11596",
"lastModified": "2024-11-21T04:21:24.797",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-04-29T15:29:00.983",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00060.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/commit/d35334f368817a77a6bd1f33c6a5676b2c402c02"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/memcached/memcached/compare/ee1cfe3...50bdc9f"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/issues/474"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUE3QBMP5UWTXMPKJREUICH6DIK6SOBX/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y2CCWRM4LHB253KG5SPOKRVDCXQX5VZR/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/3963-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00060.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/commit/d35334f368817a77a6bd1f33c6a5676b2c402c02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/memcached/memcached/compare/ee1cfe3...50bdc9f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/issues/474"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUE3QBMP5UWTXMPKJREUICH6DIK6SOBX/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y2CCWRM4LHB253KG5SPOKRVDCXQX5VZR/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/3963-1/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-03-24 15:15
Modified
2024-11-21 04:56
Severity ?
Summary
Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binary in memcached.c.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/memcached/memcached/commit/02c6a2b62ddcb6fa4569a591d3461a156a636305 | Patch, Third Party Advisory | |
| cve@mitre.org | https://github.com/memcached/memcached/issues/629 | Exploit, Third Party Advisory | |
| cve@mitre.org | https://github.com/memcached/memcached/wiki/ReleaseNotes162 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/memcached/memcached/commit/02c6a2b62ddcb6fa4569a591d3461a156a636305 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/memcached/memcached/issues/629 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/memcached/memcached/wiki/ReleaseNotes162 | Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4B224531-B654-4A70-A6B9-476B6A03D1DF",
"versionEndExcluding": "1.6.2",
"versionStartIncluding": "1.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binary in memcached.c."
},
{
"lang": "es",
"value": "Memcached versiones 1.6.x anteriores a la versi\u00f3n 1.6.2, permite a atacantes remotos causar una denegaci\u00f3n de servicio (bloqueo del demonio) por medio de un encabezado de protocolo binario dise\u00f1ado para la funci\u00f3n try_read_command_binary en el archivo memcached.c."
}
],
"id": "CVE-2020-10931",
"lastModified": "2024-11-21T04:56:23.683",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-03-24T15:15:12.107",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/commit/02c6a2b62ddcb6fa4569a591d3461a156a636305"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/issues/629"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes162"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/commit/02c6a2b62ddcb6fa4569a591d3461a156a636305"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/issues/629"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes162"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-12-12 18:55
Modified
2024-11-21 01:33
Severity ?
Summary
Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3EA40CDD-0FF7-4F09-AF63-36F1C8E42C08",
"versionEndIncluding": "1.4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "28CA19DB-F5FF-4DE5-8937-16147297E9A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "CADCD3C4-A96E-49E2-BFEE-20FB98A91F69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9D6D790C-560B-460F-A175-B47A5AFAA9F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "358D87E0-9392-4C00-94CE-C14BC408BCF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "CE58473C-3D01-4519-B1F9-1F1808191EDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F45F2A98-7146-4501-B2A7-A376204DCFD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1F4CD0E-CB74-4D72-ABDF-97820DE6A595",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet."
},
{
"lang": "es",
"value": "M\u00faltiples errores de signo de enteros en funciones (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend de Memcached 1.4.5 y anteriores permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda) a trav\u00e9s de un gran valor de longitud de cuerpo en un paquete."
}
],
"id": "CVE-2011-4971",
"lastModified": "2024-11-21T01:33:23.370",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-12-12T18:55:03.897",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "http://insecurety.net/?p=872"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/56183"
},
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2014/dsa-2832"
},
{
"source": "secalert@redhat.com",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:280"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/59567"
},
{
"source": "secalert@redhat.com",
"url": "http://www.ubuntu.com/usn/USN-2080-1"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Patch"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=192"
},
{
"source": "secalert@redhat.com",
"url": "https://puppet.com/security/cve/cve-2011-4971"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://insecurety.net/?p=872"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/56183"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2014/dsa-2832"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:280"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/59567"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-2080-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=192"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://puppet.com/security/cve/cve-2011-4971"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-189"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-01-13 21:55
Modified
2024-11-21 02:00
Severity ?
Summary
memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| memcached | memcached | * | |
| memcached | memcached | 1.4.0 | |
| memcached | memcached | 1.4.1 | |
| memcached | memcached | 1.4.2 | |
| memcached | memcached | 1.4.3 | |
| memcached | memcached | 1.4.4 | |
| memcached | memcached | 1.4.5 | |
| memcached | memcached | 1.4.6 | |
| memcached | memcached | 1.4.7 | |
| memcached | memcached | 1.4.8 | |
| memcached | memcached | 1.4.9 | |
| memcached | memcached | 1.4.10 | |
| memcached | memcached | 1.4.11 | |
| memcached | memcached | 1.4.12 | |
| memcached | memcached | 1.4.13 | |
| memcached | memcached | 1.4.14 | |
| memcached | memcached | 1.4.15 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5BC2D838-BD98-438F-8B8A-C2C26E129E63",
"versionEndIncluding": "1.4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9D6D790C-560B-460F-A175-B47A5AFAA9F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "358D87E0-9392-4C00-94CE-C14BC408BCF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "CE58473C-3D01-4519-B1F9-1F1808191EDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F45F2A98-7146-4501-B2A7-A376204DCFD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1F4CD0E-CB74-4D72-ABDF-97820DE6A595",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "0BC45B91-2C50-4D9A-9D8D-026249FB4B4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "8FE2B6E7-1066-4D7D-9346-F03487EAE77C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DC04F90C-2813-44F8-B48D-9EAF6E8B78A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1E305092-2CFD-4A94-BCE5-7F9AAEDB74D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "924552C6-BF90-49F1-A562-620196503246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "92EFE814-FA06-487A-8E5F-CD00457334A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "2AB6AF32-7B4B-4FEB-BE5D-A260852ED0DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A93A9113-B3AE-4952-9B98-B296DB7580B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "F60CAEF4-EDD2-474D-99AE-AFBDE73BBBCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "29C9CE6E-6330-4346-8989-2A7DA7BFD19A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:memcached:memcached:1.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "01E082CD-A502-4CD2-8995-2086217205A6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials."
},
{
"lang": "es",
"value": "memcached anterior 1.4.17 permite a atacantes remotos evadir la autenticaci\u00f3n mediante el env\u00edo de una petici\u00f3n inv\u00e1lida con credenciales SASL, luego enviar otra petici\u00f3n con credenciales SASL incorrectas."
}
],
"id": "CVE-2013-7239",
"lastModified": "2024-11-21T02:00:32.707",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.5,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-01-13T21:55:05.230",
"references": [
{
"source": "security@debian.org",
"url": "http://seclists.org/oss-sec/2013/q4/572"
},
{
"source": "security@debian.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/56183"
},
{
"source": "security@debian.org",
"url": "http://www.debian.org/security/2014/dsa-2832"
},
{
"source": "security@debian.org",
"url": "http://www.securityfocus.com/bid/64559"
},
{
"source": "security@debian.org",
"url": "http://www.ubuntu.com/usn/USN-2080-1"
},
{
"source": "security@debian.org",
"tags": [
"Patch"
],
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/oss-sec/2013/q4/572"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/56183"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2014/dsa-2832"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/64559"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-2080-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-07-17 13:18
Modified
2024-11-21 03:37
Severity ?
Summary
The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9BBF21B9-EC29-439E-B875-913CC487A8C5",
"versionEndIncluding": "1.4.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705."
},
{
"lang": "es",
"value": "La funci\u00f3n try_read_command en el archivo memcached.c en memcached anterior a versi\u00f3n 1.4.39, permite a los atacantes remotos causar una denegaci\u00f3n de servicio (fallo de segmentaci\u00f3n) por medio de una petici\u00f3n para agregar y configurar una clave, lo que hace una comparaci\u00f3n entre un int firmado y sin firmar y activa una lectura excesiva del b\u00fafer en la regi\u00f3n heap de la memoria. NOTA: esta vulnerabilidad existe debido a una soluci\u00f3n incompleta para el CVE-2016-8705."
}
],
"id": "CVE-2017-9951",
"lastModified": "2024-11-21T03:37:14.323",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-07-17T13:18:30.970",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/99874"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1439"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://groups.google.com/forum/message/raw?msg=memcached/ubGWrkmrr4E/nrm1SeVJAQAJ"
},
{
"source": "cve@mitre.org",
"url": "https://usn.ubuntu.com/3588-1/"
},
{
"source": "cve@mitre.org",
"url": "https://www.debian.org/security/2018/dsa-4218"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://www.twistlock.com/2017/07/13/cve-2017-9951-heap-overflow-memcached-server-1-4-38-twistlock-vulnerability-report/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/99874"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1439"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://groups.google.com/forum/message/raw?msg=memcached/ubGWrkmrr4E/nrm1SeVJAQAJ"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://usn.ubuntu.com/3588-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.debian.org/security/2018/dsa-4218"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://www.twistlock.com/2017/07/13/cve-2017-9951-heap-overflow-memcached-server-1-4-38-twistlock-vulnerability-report/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-10-27 20:15
Modified
2024-11-21 08:29
Severity ?
Summary
In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CEB5B313-3710-4308-933A-764A76E8D77A",
"versionEndExcluding": "1.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \\n is used instead of \\r\\n."
},
{
"lang": "es",
"value": "En Memcached anterior a 1.6.22, existe un error uno por uno al procesar solicitudes de proxy en modo proxy, si se usa \\n en lugar de \\r\\n."
}
],
"id": "CVE-2023-46853",
"lastModified": "2024-11-21T08:29:25.860",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-10-27T20:15:09.177",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/memcached/memcached/commit/6987918e9a3094ec4fc8976f01f769f624d790fa"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/memcached/memcached/compare/1.6.21...1.6.22"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/memcached/memcached/commit/6987918e9a3094ec4fc8976f01f769f624d790fa"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/memcached/memcached/compare/1.6.21...1.6.22"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-193"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-01-06 21:59
Modified
2024-11-21 02:59
Severity ?
8.1 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A3865AAC-C676-4002-98CC-49C199D55C0E",
"versionEndIncluding": "1.4.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution."
},
{
"lang": "es",
"value": "Desbordamiento de entero en la funci\u00f3n process_bin_sasl_auth en Memcached, que es es responsable de autenticar los comandos del c\u00f3digo binario Memcached, puede ser abusado para provocar desbordamiento en la memoria din\u00e1mica y conducir a la ejecuci\u00f3n remota de c\u00f3digo."
}
],
"id": "CVE-2016-8706",
"lastModified": "2024-11-21T02:59:53.813",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "talos-cna@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-01-06T21:59:01.853",
"references": [
{
"source": "talos-cna@cisco.com",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2819.html"
},
{
"source": "talos-cna@cisco.com",
"url": "http://www.debian.org/security/2016/dsa-3704"
},
{
"source": "talos-cna@cisco.com",
"url": "http://www.securityfocus.com/bid/94083"
},
{
"source": "talos-cna@cisco.com",
"url": "http://www.securitytracker.com/id/1037333"
},
{
"source": "talos-cna@cisco.com",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.talosintelligence.com/reports/TALOS-2016-0221/"
},
{
"source": "talos-cna@cisco.com",
"url": "https://security.gentoo.org/glsa/201701-12"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2819.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3704"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/94083"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1037333"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.talosintelligence.com/reports/TALOS-2016-0221/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-12"
}
],
"sourceIdentifier": "talos-cna@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-190"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-01-06 21:59
Modified
2024-11-21 02:59
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A3865AAC-C676-4002-98CC-49C199D55C0E",
"versionEndIncluding": "1.4.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution."
},
{
"lang": "es",
"value": "M\u00faltiples desbordamientos de entero en la funci\u00f3n process_bin_update en Memcached, que es responsable de procesar m\u00faltiples comandos de protocolo binario Memcached, puede ser abusado para provocar desbordamiento en la memoria din\u00e1mica y conducir a la ejecuci\u00f3n remota de c\u00f3digo."
}
],
"id": "CVE-2016-8705",
"lastModified": "2024-11-21T02:59:53.680",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "talos-cna@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-01-06T21:59:01.820",
"references": [
{
"source": "talos-cna@cisco.com",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2819.html"
},
{
"source": "talos-cna@cisco.com",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2820.html"
},
{
"source": "talos-cna@cisco.com",
"url": "http://www.debian.org/security/2016/dsa-3704"
},
{
"source": "talos-cna@cisco.com",
"url": "http://www.securityfocus.com/bid/94083"
},
{
"source": "talos-cna@cisco.com",
"url": "http://www.securitytracker.com/id/1037333"
},
{
"source": "talos-cna@cisco.com",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.talosintelligence.com/reports/TALOS-2016-0220/"
},
{
"source": "talos-cna@cisco.com",
"url": "https://access.redhat.com/errata/RHSA-2017:0059"
},
{
"source": "talos-cna@cisco.com",
"url": "https://security.gentoo.org/glsa/201701-12"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2819.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2820.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3704"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/94083"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1037333"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.talosintelligence.com/reports/TALOS-2016-0220/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://access.redhat.com/errata/RHSA-2017:0059"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-12"
}
],
"sourceIdentifier": "talos-cna@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-190"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-01-06 21:59
Modified
2024-11-21 02:59
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A3865AAC-C676-4002-98CC-49C199D55C0E",
"versionEndIncluding": "1.4.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution."
},
{
"lang": "es",
"value": "Un desbordamiento de entero en la funci\u00f3n process_bin_update en Memcached, que es responsable de procesar m\u00faltiples comandos de protocolo binario Memcached, puede ser abusado para provocar desbordamiento en la memoria din\u00e1mica y conducir a la ejecuci\u00f3n remota de c\u00f3digo."
}
],
"id": "CVE-2016-8704",
"lastModified": "2024-11-21T02:59:53.553",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "talos-cna@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-01-06T21:59:01.790",
"references": [
{
"source": "talos-cna@cisco.com",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2819.html"
},
{
"source": "talos-cna@cisco.com",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2820.html"
},
{
"source": "talos-cna@cisco.com",
"url": "http://www.debian.org/security/2016/dsa-3704"
},
{
"source": "talos-cna@cisco.com",
"url": "http://www.securityfocus.com/bid/94083"
},
{
"source": "talos-cna@cisco.com",
"url": "http://www.securitytracker.com/id/1037333"
},
{
"source": "talos-cna@cisco.com",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.talosintelligence.com/reports/TALOS-2016-0219/"
},
{
"source": "talos-cna@cisco.com",
"url": "https://access.redhat.com/errata/RHSA-2017:0059"
},
{
"source": "talos-cna@cisco.com",
"url": "https://security.gentoo.org/glsa/201701-12"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2819.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2820.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3704"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/94083"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1037333"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.talosintelligence.com/reports/TALOS-2016-0219/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://access.redhat.com/errata/RHSA-2017:0059"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-12"
}
],
"sourceIdentifier": "talos-cna@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-190"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
cve-2013-7290
Vulnerability from cvelistv5
Published
2014-01-13 21:00
Modified
2024-08-06 18:01
Severity ?
EPSS score ?
Summary
The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.
References
| ▼ | URL | Tags |
|---|---|---|
| https://code.google.com/p/memcached/wiki/ReleaseNotes1417 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/64988 | vdb-entry, x_refsource_BID | |
| https://code.google.com/p/memcached/issues/detail?id=306 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:01:20.308Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
},
{
"name": "64988",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/64988"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=306"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-01-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-03-24T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
},
{
"name": "64988",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/64988"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=306"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7290",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417",
"refsource": "CONFIRM",
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
},
{
"name": "64988",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/64988"
},
{
"name": "https://code.google.com/p/memcached/issues/detail?id=306",
"refsource": "CONFIRM",
"url": "https://code.google.com/p/memcached/issues/detail?id=306"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7290",
"datePublished": "2014-01-13T21:00:00",
"dateReserved": "2014-01-10T00:00:00",
"dateUpdated": "2024-08-06T18:01:20.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-8704
Vulnerability from cvelistv5
Published
2017-01-06 21:00
Modified
2024-08-06 02:27
Severity ?
EPSS score ?
Summary
An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
References
| ▼ | URL | Tags |
|---|---|---|
| https://security.gentoo.org/glsa/201701-12 | vendor-advisory, x_refsource_GENTOO | |
| http://www.debian.org/security/2016/dsa-3704 | vendor-advisory, x_refsource_DEBIAN | |
| http://rhn.redhat.com/errata/RHSA-2016-2819.html | vendor-advisory, x_refsource_REDHAT | |
| http://www.securityfocus.com/bid/94083 | vdb-entry, x_refsource_BID | |
| http://rhn.redhat.com/errata/RHSA-2016-2820.html | vendor-advisory, x_refsource_REDHAT | |
| https://access.redhat.com/errata/RHSA-2017:0059 | vendor-advisory, x_refsource_REDHAT | |
| http://www.securitytracker.com/id/1037333 | vdb-entry, x_refsource_SECTRACK | |
| http://www.talosintelligence.com/reports/TALOS-2016-0219/ | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:27:41.247Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201701-12",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-12"
},
{
"name": "DSA-3704",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3704"
},
{
"name": "RHSA-2016:2819",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2819.html"
},
{
"name": "94083",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94083"
},
{
"name": "RHSA-2016:2820",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2820.html"
},
{
"name": "RHSA-2017:0059",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0059"
},
{
"name": "1037333",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1037333"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.talosintelligence.com/reports/TALOS-2016-0219/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Memcached",
"vendor": "Memcached",
"versions": [
{
"status": "affected",
"version": "1.4.31"
}
]
}
],
"datePublic": "2016-10-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "integer overflow",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-19T19:16:37",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "GLSA-201701-12",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-12"
},
{
"name": "DSA-3704",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3704"
},
{
"name": "RHSA-2016:2819",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2819.html"
},
{
"name": "94083",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94083"
},
{
"name": "RHSA-2016:2820",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2820.html"
},
{
"name": "RHSA-2017:0059",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0059"
},
{
"name": "1037333",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1037333"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.talosintelligence.com/reports/TALOS-2016-0219/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "talos-cna@cisco.com",
"ID": "CVE-2016-8704",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Memcached",
"version": {
"version_data": [
{
"version_value": "1.4.31"
}
]
}
}
]
},
"vendor_name": "Memcached"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution."
}
]
},
"impact": {
"cvss": {
"baseScore": 9.8,
"baseSeverity": "Critical",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "integer overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201701-12",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-12"
},
{
"name": "DSA-3704",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3704"
},
{
"name": "RHSA-2016:2819",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2819.html"
},
{
"name": "94083",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94083"
},
{
"name": "RHSA-2016:2820",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2820.html"
},
{
"name": "RHSA-2017:0059",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0059"
},
{
"name": "1037333",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1037333"
},
{
"name": "http://www.talosintelligence.com/reports/TALOS-2016-0219/",
"refsource": "MISC",
"url": "http://www.talosintelligence.com/reports/TALOS-2016-0219/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2016-8704",
"datePublished": "2017-01-06T21:00:00",
"dateReserved": "2016-10-17T00:00:00",
"dateUpdated": "2024-08-06T02:27:41.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-8706
Vulnerability from cvelistv5
Published
2017-01-06 21:00
Modified
2024-08-06 02:27
Severity ?
EPSS score ?
Summary
An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
References
| ▼ | URL | Tags |
|---|---|---|
| https://security.gentoo.org/glsa/201701-12 | vendor-advisory, x_refsource_GENTOO | |
| http://www.debian.org/security/2016/dsa-3704 | vendor-advisory, x_refsource_DEBIAN | |
| http://rhn.redhat.com/errata/RHSA-2016-2819.html | vendor-advisory, x_refsource_REDHAT | |
| http://www.securityfocus.com/bid/94083 | vdb-entry, x_refsource_BID | |
| http://www.securitytracker.com/id/1037333 | vdb-entry, x_refsource_SECTRACK | |
| http://www.talosintelligence.com/reports/TALOS-2016-0221/ | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:27:41.304Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201701-12",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-12"
},
{
"name": "DSA-3704",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3704"
},
{
"name": "RHSA-2016:2819",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2819.html"
},
{
"name": "94083",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94083"
},
{
"name": "1037333",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1037333"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.talosintelligence.com/reports/TALOS-2016-0221/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Memcached",
"vendor": "Memcached",
"versions": [
{
"status": "affected",
"version": "1.4.31"
}
]
}
],
"datePublic": "2016-10-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "integer overflow",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-19T19:16:40",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "GLSA-201701-12",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-12"
},
{
"name": "DSA-3704",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3704"
},
{
"name": "RHSA-2016:2819",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2819.html"
},
{
"name": "94083",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94083"
},
{
"name": "1037333",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1037333"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.talosintelligence.com/reports/TALOS-2016-0221/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "talos-cna@cisco.com",
"ID": "CVE-2016-8706",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Memcached",
"version": {
"version_data": [
{
"version_value": "1.4.31"
}
]
}
}
]
},
"vendor_name": "Memcached"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution."
}
]
},
"impact": {
"cvss": {
"baseScore": 8.1,
"baseSeverity": "High",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "integer overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201701-12",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-12"
},
{
"name": "DSA-3704",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3704"
},
{
"name": "RHSA-2016:2819",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2819.html"
},
{
"name": "94083",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94083"
},
{
"name": "1037333",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1037333"
},
{
"name": "http://www.talosintelligence.com/reports/TALOS-2016-0221/",
"refsource": "MISC",
"url": "http://www.talosintelligence.com/reports/TALOS-2016-0221/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2016-8706",
"datePublished": "2017-01-06T21:00:00",
"dateReserved": "2016-10-17T00:00:00",
"dateUpdated": "2024-08-06T02:27:41.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-11596
Vulnerability from cvelistv5
Published
2019-04-29 14:46
Modified
2024-08-04 22:55
Severity ?
EPSS score ?
Summary
In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/memcached/memcached/issues/474 | x_refsource_MISC | |
| https://github.com/memcached/memcached/commit/d35334f368817a77a6bd1f33c6a5676b2c402c02 | x_refsource_MISC | |
| https://github.com/memcached/memcached/compare/ee1cfe3...50bdc9f | x_refsource_MISC | |
| https://usn.ubuntu.com/3963-1/ | vendor-advisory, x_refsource_UBUNTU | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUE3QBMP5UWTXMPKJREUICH6DIK6SOBX/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y2CCWRM4LHB253KG5SPOKRVDCXQX5VZR/ | vendor-advisory, x_refsource_FEDORA | |
| http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00060.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:55:41.048Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/memcached/memcached/issues/474"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/memcached/memcached/commit/d35334f368817a77a6bd1f33c6a5676b2c402c02"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/memcached/memcached/compare/ee1cfe3...50bdc9f"
},
{
"name": "USN-3963-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3963-1/"
},
{
"name": "FEDORA-2019-2bd8e73268",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUE3QBMP5UWTXMPKJREUICH6DIK6SOBX/"
},
{
"name": "FEDORA-2019-df4c0ba2db",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y2CCWRM4LHB253KG5SPOKRVDCXQX5VZR/"
},
{
"name": "openSUSE-SU-2020:0721",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00060.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In memcached before 1.5.14, a NULL pointer dereference was found in the \"lru mode\" and \"lru temp_ttl\" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-05-26T15:06:14",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/memcached/memcached/issues/474"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/memcached/memcached/commit/d35334f368817a77a6bd1f33c6a5676b2c402c02"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/memcached/memcached/compare/ee1cfe3...50bdc9f"
},
{
"name": "USN-3963-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3963-1/"
},
{
"name": "FEDORA-2019-2bd8e73268",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUE3QBMP5UWTXMPKJREUICH6DIK6SOBX/"
},
{
"name": "FEDORA-2019-df4c0ba2db",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y2CCWRM4LHB253KG5SPOKRVDCXQX5VZR/"
},
{
"name": "openSUSE-SU-2020:0721",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00060.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-11596",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In memcached before 1.5.14, a NULL pointer dereference was found in the \"lru mode\" and \"lru temp_ttl\" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/memcached/memcached/issues/474",
"refsource": "MISC",
"url": "https://github.com/memcached/memcached/issues/474"
},
{
"name": "https://github.com/memcached/memcached/commit/d35334f368817a77a6bd1f33c6a5676b2c402c02",
"refsource": "MISC",
"url": "https://github.com/memcached/memcached/commit/d35334f368817a77a6bd1f33c6a5676b2c402c02"
},
{
"name": "https://github.com/memcached/memcached/compare/ee1cfe3...50bdc9f",
"refsource": "MISC",
"url": "https://github.com/memcached/memcached/compare/ee1cfe3...50bdc9f"
},
{
"name": "USN-3963-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3963-1/"
},
{
"name": "FEDORA-2019-2bd8e73268",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UUE3QBMP5UWTXMPKJREUICH6DIK6SOBX/"
},
{
"name": "FEDORA-2019-df4c0ba2db",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y2CCWRM4LHB253KG5SPOKRVDCXQX5VZR/"
},
{
"name": "openSUSE-SU-2020:0721",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00060.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-11596",
"datePublished": "2019-04-29T14:46:55",
"dateReserved": "2019-04-29T00:00:00",
"dateUpdated": "2024-08-04T22:55:41.048Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-15026
Vulnerability from cvelistv5
Published
2019-08-30 14:32
Modified
2024-08-05 00:34
Severity ?
EPSS score ?
Summary
memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/memcached/memcached/wiki/ReleaseNotes1517 | x_refsource_CONFIRM | |
| https://github.com/memcached/memcached/commit/554b56687a19300a75ec24184746b5512580c819 | x_refsource_CONFIRM | |
| https://lists.debian.org/debian-lts-announce/2019/09/msg00006.html | mailing-list, x_refsource_MLIST | |
| https://usn.ubuntu.com/4125-1/ | vendor-advisory, x_refsource_UBUNTU | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOD422IS2OPXRDID5EKFZHFUHK2BLQGJ/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDBV5OGV3FJDAH4NO4JSXNRWHDGGKWYB/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYGUBOEM5HX4GRMWVEKOJUFICF77ME47/ | vendor-advisory, x_refsource_FEDORA | |
| http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00060.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T00:34:53.130Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1517"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/memcached/memcached/commit/554b56687a19300a75ec24184746b5512580c819"
},
{
"name": "[debian-lts-announce] 20190907 [SECURITY] [DLA 1913-1] memcached security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00006.html"
},
{
"name": "USN-4125-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/4125-1/"
},
{
"name": "FEDORA-2019-68333329e0",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOD422IS2OPXRDID5EKFZHFUHK2BLQGJ/"
},
{
"name": "FEDORA-2019-694a4b39a9",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDBV5OGV3FJDAH4NO4JSXNRWHDGGKWYB/"
},
{
"name": "FEDORA-2019-15d61c1f7f",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYGUBOEM5HX4GRMWVEKOJUFICF77ME47/"
},
{
"name": "openSUSE-SU-2020:0721",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00060.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-08-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-05-26T15:06:14",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1517"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/memcached/memcached/commit/554b56687a19300a75ec24184746b5512580c819"
},
{
"name": "[debian-lts-announce] 20190907 [SECURITY] [DLA 1913-1] memcached security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00006.html"
},
{
"name": "USN-4125-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/4125-1/"
},
{
"name": "FEDORA-2019-68333329e0",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOD422IS2OPXRDID5EKFZHFUHK2BLQGJ/"
},
{
"name": "FEDORA-2019-694a4b39a9",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDBV5OGV3FJDAH4NO4JSXNRWHDGGKWYB/"
},
{
"name": "FEDORA-2019-15d61c1f7f",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYGUBOEM5HX4GRMWVEKOJUFICF77ME47/"
},
{
"name": "openSUSE-SU-2020:0721",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00060.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-15026",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/memcached/memcached/wiki/ReleaseNotes1517",
"refsource": "CONFIRM",
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1517"
},
{
"name": "https://github.com/memcached/memcached/commit/554b56687a19300a75ec24184746b5512580c819",
"refsource": "CONFIRM",
"url": "https://github.com/memcached/memcached/commit/554b56687a19300a75ec24184746b5512580c819"
},
{
"name": "[debian-lts-announce] 20190907 [SECURITY] [DLA 1913-1] memcached security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00006.html"
},
{
"name": "USN-4125-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4125-1/"
},
{
"name": "FEDORA-2019-68333329e0",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOD422IS2OPXRDID5EKFZHFUHK2BLQGJ/"
},
{
"name": "FEDORA-2019-694a4b39a9",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDBV5OGV3FJDAH4NO4JSXNRWHDGGKWYB/"
},
{
"name": "FEDORA-2019-15d61c1f7f",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYGUBOEM5HX4GRMWVEKOJUFICF77ME47/"
},
{
"name": "openSUSE-SU-2020:0721",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00060.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-15026",
"datePublished": "2019-08-30T14:32:01",
"dateReserved": "2019-08-13T00:00:00",
"dateUpdated": "2024-08-05T00:34:53.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-37519
Vulnerability from cvelistv5
Published
2023-02-03 00:00
Modified
2024-08-04 01:22
Severity ?
EPSS score ?
Summary
Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted authenticattion file.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:22:59.364Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/memcached/memcached/issues/805"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/memcached/memcached/pull/806/commits/264722ae4e248b453be00e97197dadc685b60fd0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted authenticattion file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-03T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/memcached/memcached/issues/805"
},
{
"url": "https://github.com/memcached/memcached/pull/806/commits/264722ae4e248b453be00e97197dadc685b60fd0"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-37519",
"datePublished": "2023-02-03T00:00:00",
"dateReserved": "2021-07-26T00:00:00",
"dateUpdated": "2024-08-04T01:22:59.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-22570
Vulnerability from cvelistv5
Published
2023-08-22 00:00
Modified
2024-10-03 18:05
Severity ?
EPSS score ?
Summary
Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted meta command.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T14:51:11.014Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/memcached/memcached/issues/636"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-22570",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-03T18:05:22.896494Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-03T18:05:32.754Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted meta command."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-22T15:44:57.003879",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/memcached/memcached/issues/636"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-22570",
"datePublished": "2023-08-22T00:00:00",
"dateReserved": "2020-08-13T00:00:00",
"dateUpdated": "2024-10-03T18:05:32.754Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-46852
Vulnerability from cvelistv5
Published
2023-10-27 00:00
Modified
2024-09-09 15:36
Severity ?
EPSS score ?
Summary
In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the "get" substring.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T20:53:21.955Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/memcached/memcached/commit/76a6c363c18cfe7b6a1524ae64202ac9db330767"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/memcached/memcached/compare/1.6.21...1.6.22"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:memcached:memcached:1.6.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "memcached",
"vendor": "memcached",
"versions": [
{
"lessThan": "1.6.22",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-46852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-09T15:34:10.637588Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-09T15:36:33.049Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the \"get\" substring."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-27T19:06:29.939826",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/memcached/memcached/commit/76a6c363c18cfe7b6a1524ae64202ac9db330767"
},
{
"url": "https://github.com/memcached/memcached/compare/1.6.21...1.6.22"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-46852",
"datePublished": "2023-10-27T00:00:00",
"dateReserved": "2023-10-27T00:00:00",
"dateUpdated": "2024-09-09T15:36:33.049Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-48571
Vulnerability from cvelistv5
Published
2023-08-22 00:00
Modified
2024-10-03 14:07
Severity ?
EPSS score ?
Summary
memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T15:17:55.164Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/memcached/memcached/commit/6b319c8c7a29e9c353dec83dc92f01905f6c8966"
},
{
"name": "[debian-lts-announce] 20230907 [SECURITY] [DLA 3557-1] memcached security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00004.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-48571",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-03T14:06:52.862435Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-03T14:07:05.902Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-08T00:06:17.590301",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/memcached/memcached/commit/6b319c8c7a29e9c353dec83dc92f01905f6c8966"
},
{
"name": "[debian-lts-announce] 20230907 [SECURITY] [DLA 3557-1] memcached security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00004.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-48571",
"datePublished": "2023-08-22T00:00:00",
"dateReserved": "2023-07-24T00:00:00",
"dateUpdated": "2024-10-03T14:07:05.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-1000127
Vulnerability from cvelistv5
Published
2018-03-13 21:00
Modified
2024-08-05 12:33
Severity ?
EPSS score ?
Summary
memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.
References
| ▼ | URL | Tags |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2018:2290 | vendor-advisory, x_refsource_REDHAT | |
| https://lists.debian.org/debian-lts-announce/2018/03/msg00031.html | mailing-list, x_refsource_MLIST | |
| https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00 | x_refsource_CONFIRM | |
| https://usn.ubuntu.com/3601-1/ | vendor-advisory, x_refsource_UBUNTU | |
| https://www.debian.org/security/2018/dsa-4218 | vendor-advisory, x_refsource_DEBIAN | |
| https://github.com/memcached/memcached/wiki/ReleaseNotes1437 | x_refsource_CONFIRM | |
| https://github.com/memcached/memcached/issues/271 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:33:49.281Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2018:2290",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2290"
},
{
"name": "[debian-lts-announce] 20180329 [SECURITY] [DLA 1329-1] memcached security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00031.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00"
},
{
"name": "USN-3601-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3601-1/"
},
{
"name": "DSA-4218",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2018/dsa-4218"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1437"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/memcached/memcached/issues/271"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2018-03-08T00:00:00",
"datePublic": "2018-03-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-31T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "RHSA-2018:2290",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2290"
},
{
"name": "[debian-lts-announce] 20180329 [SECURITY] [DLA 1329-1] memcached security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00031.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00"
},
{
"name": "USN-3601-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3601-1/"
},
{
"name": "DSA-4218",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2018/dsa-4218"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1437"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/memcached/memcached/issues/271"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "3/8/2018 0:33:22",
"ID": "CVE-2018-1000127",
"REQUESTER": "dormando@gmail.com",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2018:2290",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2290"
},
{
"name": "[debian-lts-announce] 20180329 [SECURITY] [DLA 1329-1] memcached security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00031.html"
},
{
"name": "https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00",
"refsource": "CONFIRM",
"url": "https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00"
},
{
"name": "USN-3601-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3601-1/"
},
{
"name": "DSA-4218",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2018/dsa-4218"
},
{
"name": "https://github.com/memcached/memcached/wiki/ReleaseNotes1437",
"refsource": "CONFIRM",
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1437"
},
{
"name": "https://github.com/memcached/memcached/issues/271",
"refsource": "CONFIRM",
"url": "https://github.com/memcached/memcached/issues/271"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-1000127",
"datePublished": "2018-03-13T21:00:00",
"dateReserved": "2018-03-13T00:00:00",
"dateUpdated": "2024-08-05T12:33:49.281Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-46853
Vulnerability from cvelistv5
Published
2023-10-27 00:00
Modified
2024-09-09 15:31
Severity ?
EPSS score ?
Summary
In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T20:53:21.941Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/memcached/memcached/compare/1.6.21...1.6.22"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/memcached/memcached/commit/6987918e9a3094ec4fc8976f01f769f624d790fa"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:memcached:memcached:1.6.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "memcached",
"vendor": "memcached",
"versions": [
{
"lessThan": "1.6.22",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-46853",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-09T15:29:52.384746Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-09T15:31:32.160Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \\n is used instead of \\r\\n."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-27T19:06:45.719960",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/memcached/memcached/compare/1.6.21...1.6.22"
},
{
"url": "https://github.com/memcached/memcached/commit/6987918e9a3094ec4fc8976f01f769f624d790fa"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-46853",
"datePublished": "2023-10-27T00:00:00",
"dateReserved": "2023-10-27T00:00:00",
"dateUpdated": "2024-09-09T15:31:32.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-7239
Vulnerability from cvelistv5
Published
2014-01-13 21:00
Modified
2024-08-06 18:01
Severity ?
EPSS score ?
Summary
memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/64559 | vdb-entry, x_refsource_BID | |
| https://code.google.com/p/memcached/wiki/ReleaseNotes1417 | x_refsource_CONFIRM | |
| http://seclists.org/oss-sec/2013/q4/572 | mailing-list, x_refsource_MLIST | |
| http://www.ubuntu.com/usn/USN-2080-1 | vendor-advisory, x_refsource_UBUNTU | |
| http://www.debian.org/security/2014/dsa-2832 | vendor-advisory, x_refsource_DEBIAN | |
| http://secunia.com/advisories/56183 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:01:20.106Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "64559",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/64559"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
},
{
"name": "[oss-security] 20131230 Re: CVE Request: SASL authentication allows wrong credentials to access memcache",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2013/q4/572"
},
{
"name": "USN-2080-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2080-1"
},
{
"name": "DSA-2832",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2014/dsa-2832"
},
{
"name": "56183",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/56183"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-12-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-03-24T09:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"name": "64559",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/64559"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
},
{
"name": "[oss-security] 20131230 Re: CVE Request: SASL authentication allows wrong credentials to access memcache",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2013/q4/572"
},
{
"name": "USN-2080-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2080-1"
},
{
"name": "DSA-2832",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2014/dsa-2832"
},
{
"name": "56183",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/56183"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2013-7239",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "64559",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/64559"
},
{
"name": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417",
"refsource": "CONFIRM",
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
},
{
"name": "[oss-security] 20131230 Re: CVE Request: SASL authentication allows wrong credentials to access memcache",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2013/q4/572"
},
{
"name": "USN-2080-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-2080-1"
},
{
"name": "DSA-2832",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2014/dsa-2832"
},
{
"name": "56183",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/56183"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2013-7239",
"datePublished": "2014-01-13T21:00:00",
"dateReserved": "2013-12-30T00:00:00",
"dateUpdated": "2024-08-06T18:01:20.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-8705
Vulnerability from cvelistv5
Published
2017-01-06 21:00
Modified
2024-08-06 02:27
Severity ?
EPSS score ?
Summary
Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
References
| ▼ | URL | Tags |
|---|---|---|
| https://security.gentoo.org/glsa/201701-12 | vendor-advisory, x_refsource_GENTOO | |
| http://www.debian.org/security/2016/dsa-3704 | vendor-advisory, x_refsource_DEBIAN | |
| http://rhn.redhat.com/errata/RHSA-2016-2819.html | vendor-advisory, x_refsource_REDHAT | |
| http://www.securityfocus.com/bid/94083 | vdb-entry, x_refsource_BID | |
| http://rhn.redhat.com/errata/RHSA-2016-2820.html | vendor-advisory, x_refsource_REDHAT | |
| https://access.redhat.com/errata/RHSA-2017:0059 | vendor-advisory, x_refsource_REDHAT | |
| http://www.securitytracker.com/id/1037333 | vdb-entry, x_refsource_SECTRACK | |
| http://www.talosintelligence.com/reports/TALOS-2016-0220/ | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:27:41.285Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201701-12",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-12"
},
{
"name": "DSA-3704",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3704"
},
{
"name": "RHSA-2016:2819",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2819.html"
},
{
"name": "94083",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94083"
},
{
"name": "RHSA-2016:2820",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2820.html"
},
{
"name": "RHSA-2017:0059",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0059"
},
{
"name": "1037333",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1037333"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.talosintelligence.com/reports/TALOS-2016-0220/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Memcached",
"vendor": "Memcached",
"versions": [
{
"status": "affected",
"version": "1.4.31"
}
]
}
],
"datePublic": "2016-10-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "multiple integer overflows",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-19T19:16:38",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "GLSA-201701-12",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-12"
},
{
"name": "DSA-3704",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3704"
},
{
"name": "RHSA-2016:2819",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2819.html"
},
{
"name": "94083",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94083"
},
{
"name": "RHSA-2016:2820",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2820.html"
},
{
"name": "RHSA-2017:0059",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:0059"
},
{
"name": "1037333",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1037333"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.talosintelligence.com/reports/TALOS-2016-0220/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "talos-cna@cisco.com",
"ID": "CVE-2016-8705",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Memcached",
"version": {
"version_data": [
{
"version_value": "1.4.31"
}
]
}
}
]
},
"vendor_name": "Memcached"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution."
}
]
},
"impact": {
"cvss": {
"baseScore": 9.8,
"baseSeverity": "Critical",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "multiple integer overflows"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201701-12",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-12"
},
{
"name": "DSA-3704",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3704"
},
{
"name": "RHSA-2016:2819",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2819.html"
},
{
"name": "94083",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94083"
},
{
"name": "RHSA-2016:2820",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2820.html"
},
{
"name": "RHSA-2017:0059",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:0059"
},
{
"name": "1037333",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1037333"
},
{
"name": "http://www.talosintelligence.com/reports/TALOS-2016-0220/",
"refsource": "MISC",
"url": "http://www.talosintelligence.com/reports/TALOS-2016-0220/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2016-8705",
"datePublished": "2017-01-06T21:00:00",
"dateReserved": "2016-10-17T00:00:00",
"dateUpdated": "2024-08-06T02:27:41.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-9951
Vulnerability from cvelistv5
Published
2017-07-17 06:00
Modified
2024-08-05 17:24
Severity ?
EPSS score ?
Summary
The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.
References
| ▼ | URL | Tags |
|---|---|---|
| https://usn.ubuntu.com/3588-1/ | vendor-advisory, x_refsource_UBUNTU | |
| https://github.com/memcached/memcached/wiki/ReleaseNotes1439 | x_refsource_MISC | |
| http://www.securityfocus.com/bid/99874 | vdb-entry, x_refsource_BID | |
| https://www.debian.org/security/2018/dsa-4218 | vendor-advisory, x_refsource_DEBIAN | |
| https://www.twistlock.com/2017/07/13/cve-2017-9951-heap-overflow-memcached-server-1-4-38-twistlock-vulnerability-report/ | x_refsource_MISC | |
| https://groups.google.com/forum/message/raw?msg=memcached/ubGWrkmrr4E/nrm1SeVJAQAJ | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T17:24:59.972Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "USN-3588-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3588-1/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1439"
},
{
"name": "99874",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/99874"
},
{
"name": "DSA-4218",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2018/dsa-4218"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twistlock.com/2017/07/13/cve-2017-9951-heap-overflow-memcached-server-1-4-38-twistlock-vulnerability-report/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://groups.google.com/forum/message/raw?msg=memcached/ubGWrkmrr4E/nrm1SeVJAQAJ"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-07-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-07T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "USN-3588-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3588-1/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1439"
},
{
"name": "99874",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/99874"
},
{
"name": "DSA-4218",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2018/dsa-4218"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twistlock.com/2017/07/13/cve-2017-9951-heap-overflow-memcached-server-1-4-38-twistlock-vulnerability-report/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://groups.google.com/forum/message/raw?msg=memcached/ubGWrkmrr4E/nrm1SeVJAQAJ"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-9951",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "USN-3588-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3588-1/"
},
{
"name": "https://github.com/memcached/memcached/wiki/ReleaseNotes1439",
"refsource": "MISC",
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1439"
},
{
"name": "99874",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/99874"
},
{
"name": "DSA-4218",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2018/dsa-4218"
},
{
"name": "https://www.twistlock.com/2017/07/13/cve-2017-9951-heap-overflow-memcached-server-1-4-38-twistlock-vulnerability-report/",
"refsource": "MISC",
"url": "https://www.twistlock.com/2017/07/13/cve-2017-9951-heap-overflow-memcached-server-1-4-38-twistlock-vulnerability-report/"
},
{
"name": "https://groups.google.com/forum/message/raw?msg=memcached/ubGWrkmrr4E/nrm1SeVJAQAJ",
"refsource": "MISC",
"url": "https://groups.google.com/forum/message/raw?msg=memcached/ubGWrkmrr4E/nrm1SeVJAQAJ"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-9951",
"datePublished": "2017-07-17T06:00:00",
"dateReserved": "2017-06-26T00:00:00",
"dateUpdated": "2024-08-05T17:24:59.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-10931
Vulnerability from cvelistv5
Published
2020-03-24 14:25
Modified
2024-08-04 11:21
Severity ?
EPSS score ?
Summary
Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binary in memcached.c.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/memcached/memcached/issues/629 | x_refsource_MISC | |
| https://github.com/memcached/memcached/commit/02c6a2b62ddcb6fa4569a591d3461a156a636305 | x_refsource_MISC | |
| https://github.com/memcached/memcached/wiki/ReleaseNotes162 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:21:12.992Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/memcached/memcached/issues/629"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/memcached/memcached/commit/02c6a2b62ddcb6fa4569a591d3461a156a636305"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes162"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binary in memcached.c."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-24T14:25:56",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/memcached/memcached/issues/629"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/memcached/memcached/commit/02c6a2b62ddcb6fa4569a591d3461a156a636305"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes162"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-10931",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binary in memcached.c."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/memcached/memcached/issues/629",
"refsource": "MISC",
"url": "https://github.com/memcached/memcached/issues/629"
},
{
"name": "https://github.com/memcached/memcached/commit/02c6a2b62ddcb6fa4569a591d3461a156a636305",
"refsource": "MISC",
"url": "https://github.com/memcached/memcached/commit/02c6a2b62ddcb6fa4569a591d3461a156a636305"
},
{
"name": "https://github.com/memcached/memcached/wiki/ReleaseNotes162",
"refsource": "MISC",
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes162"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-10931",
"datePublished": "2020-03-24T14:25:56",
"dateReserved": "2020-03-24T00:00:00",
"dateUpdated": "2024-08-04T11:21:12.992Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-7291
Vulnerability from cvelistv5
Published
2014-01-13 21:00
Modified
2024-08-06 18:01
Severity ?
EPSS score ?
Summary
memcached before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (crash) via a request that triggers an "unbounded key print" during logging, related to an issue that was "quickly grepped out of the source tree," a different vulnerability than CVE-2013-0179 and CVE-2013-7290.
References
| ▼ | URL | Tags |
|---|---|---|
| https://code.google.com/p/memcached/wiki/ReleaseNotes1417 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/64989 | vdb-entry, x_refsource_BID | |
| https://code.google.com/p/memcached/issues/detail?id=306 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:01:20.388Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
},
{
"name": "64989",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/64989"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=306"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-12-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "memcached before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (crash) via a request that triggers an \"unbounded key print\" during logging, related to an issue that was \"quickly grepped out of the source tree,\" a different vulnerability than CVE-2013-0179 and CVE-2013-7290."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-03-24T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
},
{
"name": "64989",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/64989"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=306"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7291",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "memcached before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (crash) via a request that triggers an \"unbounded key print\" during logging, related to an issue that was \"quickly grepped out of the source tree,\" a different vulnerability than CVE-2013-0179 and CVE-2013-7290."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417",
"refsource": "CONFIRM",
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
},
{
"name": "64989",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/64989"
},
{
"name": "https://code.google.com/p/memcached/issues/detail?id=306",
"refsource": "CONFIRM",
"url": "https://code.google.com/p/memcached/issues/detail?id=306"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7291",
"datePublished": "2014-01-13T21:00:00",
"dateReserved": "2014-01-10T00:00:00",
"dateUpdated": "2024-08-06T18:01:20.388Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-1000115
Vulnerability from cvelistv5
Published
2018-03-05 14:00
Modified
2024-08-05 12:33
Severity ?
EPSS score ?
Summary
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:33:49.333Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHBA-2018:2140",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHBA-2018:2140"
},
{
"name": "RHSA-2018:1593",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:1593"
},
{
"name": "USN-3588-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3588-1/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes156"
},
{
"name": "44264",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/44264/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://twitter.com/dormando/status/968579781729009664"
},
{
"name": "44265",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/44265/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974"
},
{
"name": "RHSA-2018:2857",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2857"
},
{
"name": "RHSA-2018:1627",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:1627"
},
{
"name": "RHSA-2018:2331",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2331"
},
{
"name": "DSA-4218",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2018/dsa-4218"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/memcached/memcached/issues/348"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.synology.com/support/security/Synology_SA_18_07"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2018-03-02T00:00:00",
"datePublic": "2018-03-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-03T09:57:02",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "RHBA-2018:2140",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHBA-2018:2140"
},
{
"name": "RHSA-2018:1593",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:1593"
},
{
"name": "USN-3588-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3588-1/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes156"
},
{
"name": "44264",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/44264/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://twitter.com/dormando/status/968579781729009664"
},
{
"name": "44265",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/44265/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974"
},
{
"name": "RHSA-2018:2857",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2857"
},
{
"name": "RHSA-2018:1627",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:1627"
},
{
"name": "RHSA-2018:2331",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2331"
},
{
"name": "DSA-4218",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2018/dsa-4218"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/memcached/memcached/issues/348"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.synology.com/support/security/Synology_SA_18_07"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "3/2/2018 21:30:48",
"ID": "CVE-2018-1000115",
"REQUESTER": "kurt@seifried.org",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHBA-2018:2140",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHBA-2018:2140"
},
{
"name": "RHSA-2018:1593",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:1593"
},
{
"name": "USN-3588-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3588-1/"
},
{
"name": "https://github.com/memcached/memcached/wiki/ReleaseNotes156",
"refsource": "MISC",
"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes156"
},
{
"name": "44264",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/44264/"
},
{
"name": "https://twitter.com/dormando/status/968579781729009664",
"refsource": "MISC",
"url": "https://twitter.com/dormando/status/968579781729009664"
},
{
"name": "44265",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/44265/"
},
{
"name": "https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974",
"refsource": "MISC",
"url": "https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974"
},
{
"name": "RHSA-2018:2857",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2857"
},
{
"name": "RHSA-2018:1627",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:1627"
},
{
"name": "RHSA-2018:2331",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2331"
},
{
"name": "DSA-4218",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2018/dsa-4218"
},
{
"name": "https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html",
"refsource": "MISC",
"url": "https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html"
},
{
"name": "https://github.com/memcached/memcached/issues/348",
"refsource": "MISC",
"url": "https://github.com/memcached/memcached/issues/348"
},
{
"name": "https://www.synology.com/support/security/Synology_SA_18_07",
"refsource": "CONFIRM",
"url": "https://www.synology.com/support/security/Synology_SA_18_07"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-1000115",
"datePublished": "2018-03-05T14:00:00",
"dateReserved": "2018-03-05T00:00:00",
"dateUpdated": "2024-08-05T12:33:49.333Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-4971
Vulnerability from cvelistv5
Published
2013-12-12 18:00
Modified
2024-08-07 00:23
Severity ?
EPSS score ?
Summary
Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet.
References
| ▼ | URL | Tags |
|---|---|---|
| http://insecurety.net/?p=872 | x_refsource_MISC | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2013:280 | vendor-advisory, x_refsource_MANDRIVA | |
| https://code.google.com/p/memcached/issues/detail?id=192 | x_refsource_MISC | |
| http://www.ubuntu.com/usn/USN-2080-1 | vendor-advisory, x_refsource_UBUNTU | |
| http://www.securityfocus.com/bid/59567 | vdb-entry, x_refsource_BID | |
| https://puppet.com/security/cve/cve-2011-4971 | x_refsource_CONFIRM | |
| http://www.debian.org/security/2014/dsa-2832 | vendor-advisory, x_refsource_DEBIAN | |
| http://secunia.com/advisories/56183 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:23:39.289Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://insecurety.net/?p=872"
},
{
"name": "MDVSA-2013:280",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:280"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=192"
},
{
"name": "USN-2080-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2080-1"
},
{
"name": "59567",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/59567"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppet.com/security/cve/cve-2011-4971"
},
{
"name": "DSA-2832",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2014/dsa-2832"
},
{
"name": "56183",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/56183"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-03-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-03-24T09:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://insecurety.net/?p=872"
},
{
"name": "MDVSA-2013:280",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:280"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=192"
},
{
"name": "USN-2080-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2080-1"
},
{
"name": "59567",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/59567"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppet.com/security/cve/cve-2011-4971"
},
{
"name": "DSA-2832",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2014/dsa-2832"
},
{
"name": "56183",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/56183"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-4971",
"datePublished": "2013-12-12T18:00:00",
"dateReserved": "2011-12-23T00:00:00",
"dateUpdated": "2024-08-07T00:23:39.289Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-0179
Vulnerability from cvelistv5
Published
2014-01-13 21:00
Modified
2024-08-06 14:18
Severity ?
EPSS score ?
Summary
The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr.
References
| ▼ | URL | Tags |
|---|---|---|
| https://code.google.com/p/memcached/issues/attachmentText?id=306&aid=3060004000&name=0001-Fix-buffer-overrun-when-logging-key-to-delete-in-bin.patch&token=3GEzHThBL5cxmUrsYANkW03RrNY%3A1358179503096 | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2013/01/14/4 | mailing-list, x_refsource_MLIST | |
| https://code.google.com/p/memcached/wiki/ReleaseNotes1417 | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2013/01/14/6 | mailing-list, x_refsource_MLIST | |
| http://www.ubuntu.com/usn/USN-2080-1 | vendor-advisory, x_refsource_UBUNTU | |
| https://code.google.com/p/memcached/issues/detail?id=306 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/56183 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/64978 | vdb-entry, x_refsource_BID | |
| https://bugzilla.redhat.com/show_bug.cgi?id=895054 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T14:18:09.522Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://code.google.com/p/memcached/issues/attachmentText?id=306\u0026aid=3060004000\u0026name=0001-Fix-buffer-overrun-when-logging-key-to-delete-in-bin.patch\u0026token=3GEzHThBL5cxmUrsYANkW03RrNY%3A1358179503096"
},
{
"name": "[oss-security] 20130114 CVE request: memcached DoS when printing out keys to be deleted in verbose mode",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/14/4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
},
{
"name": "[oss-security] 20130114 Re: CVE request: memcached DoS when printing out keys to be deleted in verbose mode",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/14/6"
},
{
"name": "USN-2080-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2080-1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=306"
},
{
"name": "56183",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/56183"
},
{
"name": "64978",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/64978"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=895054"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-01-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-03-24T09:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://code.google.com/p/memcached/issues/attachmentText?id=306\u0026aid=3060004000\u0026name=0001-Fix-buffer-overrun-when-logging-key-to-delete-in-bin.patch\u0026token=3GEzHThBL5cxmUrsYANkW03RrNY%3A1358179503096"
},
{
"name": "[oss-security] 20130114 CVE request: memcached DoS when printing out keys to be deleted in verbose mode",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/14/4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
},
{
"name": "[oss-security] 20130114 Re: CVE request: memcached DoS when printing out keys to be deleted in verbose mode",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/14/6"
},
{
"name": "USN-2080-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2080-1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://code.google.com/p/memcached/issues/detail?id=306"
},
{
"name": "56183",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/56183"
},
{
"name": "64978",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/64978"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=895054"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-0179",
"datePublished": "2014-01-13T21:00:00",
"dateReserved": "2012-12-06T00:00:00",
"dateUpdated": "2024-08-06T14:18:09.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}