CVE-2024-8946

MEDIUM Year: 2024
CVSS v3 Score
7.5
High
CVSS v2 Score
7.5
High
Weakness Type
CWE-122
View all →

Vulnerability Description

A vulnerability was found in MicroPython 1.23.0. It has been classified as critical. Affected is the function mp_vfs_umount of the file extmod/vfs.c of the component VFS Unmount Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 29943546343c92334e8518695a11fc0e2ceea68b. It is recommended to apply a patch to fix this issue. In the VFS unmount process, the comparison between the mounted path string and the unmount requested string is based solely on the length of the unmount string, which can lead to a heap buffer overflow read.

Related Vulnerabilities

CVE-2017-2591

HIGH
CVSS:7.5(High)

389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness" plugin of 389 Directory Server. An auth...

CWE-1222017

CVE-2018-1089

HIGH
CVSS:7.5(High)

389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated atta...

CWE-1222018

CVE-2018-1123

HIGH
CVSS:7.5(High)

procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the i...

CWE-1222018

CVE-2018-14821

HIGH
CVSS:7.5(High)

Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote, unauthenticated threat actor to intentionally send a malformed CIP packet to Port 44818, causing t...

CWE-1222018

CVE-2018-18981

HIGH
CVSS:7.5(High)

In Rockwell Automation FactoryTalk Services Platform 2.90 and earlier, a remote unauthenticated attacker could send numerous crafted packets to service ports resulting in memory consumption that could...

CWE-1222018

CVE-2018-19093

HIGH
CVSS:7.5(High)

An issue has been found in libIEC61850 v1.3. It is a SEGV in ControlObjectClient_setCommandTerminationHandler in client/client_control.c. NOTE: the software maintainer disputes this because it require...

CWE-1222018