Dash
Monthly
An out-of-bounds write in the printf builtin of the dash shell allows a local user to corrupt one or two bytes past a four-byte reservation when a crafted Unicode \u or \U escape expanding to a five- or six-byte token is processed, including via 'dash -c' with the escape passed as a positional argument to printf or 'echo %b'. The flaw affects dash as shipped in Red Hat Enterprise Linux 6 (CPE cpe:2.3:a:red_hat:red_hat_enterprise_linux_6) and is rated CVSS 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). No public exploit code was identified at time of analysis, and the bounded write stays within the caller's own shell process, so it provides no inherent privilege escalation.
Local denial of service in the dash shell affects builds compiled without libc fnmatch, where the internal pmatch() matcher handles the '*' wildcard by unbounded recursion over candidate positions. A local attacker who can plant filenames in a directory that later gets globbed - or otherwise feed the internal matcher - can supply a short multi-star pattern such as *.*.*.*.*.tar.gz and drive excessive CPU consumption in the affected shell process. The issue requires a non-default build configuration (PR:L, AV:L, no remote reachability, no privilege escalation or data disclosure), maps to CWE-1333 (inefficient regular expression complexity) with a CVSS 3.1 score of 5.5, and there is no public exploit identified at time of analysis and no confirmed actively exploited status (CISA KEV).
Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An out-of-bounds write in the printf builtin of the dash shell allows a local user to corrupt one or two bytes past a four-byte reservation when a crafted Unicode \u or \U escape expanding to a five- or six-byte token is processed, including via 'dash -c' with the escape passed as a positional argument to printf or 'echo %b'. The flaw affects dash as shipped in Red Hat Enterprise Linux 6 (CPE cpe:2.3:a:red_hat:red_hat_enterprise_linux_6) and is rated CVSS 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). No public exploit code was identified at time of analysis, and the bounded write stays within the caller's own shell process, so it provides no inherent privilege escalation.
Local denial of service in the dash shell affects builds compiled without libc fnmatch, where the internal pmatch() matcher handles the '*' wildcard by unbounded recursion over candidate positions. A local attacker who can plant filenames in a directory that later gets globbed - or otherwise feed the internal matcher - can supply a short multi-star pattern such as *.*.*.*.*.tar.gz and drive excessive CPU consumption in the affected shell process. The issue requires a non-default build configuration (PR:L, AV:L, no remote reachability, no privilege escalation or data disclosure), maps to CWE-1333 (inefficient regular expression complexity) with a CVSS 3.1 score of 5.5, and there is no public exploit identified at time of analysis and no confirmed actively exploited status (CISA KEV).
Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.