Multiple vulnerabilities in Dell Storage Monitoring and Reporting (SMR)



Published: 2022-10-18 | Updated: 2023-01-19
Risk High
Patch available YES
Number of vulnerabilities 75
CVE-ID CVE-2022-28356
CVE-2022-29824
CVE-2022-29187
CVE-2022-29155
CVE-2022-28748
CVE-2022-28736
CVE-2022-28734
CVE-2022-28733
CVE-2022-27782
CVE-2022-36946
CVE-2022-27781
CVE-2022-27776
CVE-2022-24903
CVE-2022-22576
CVE-2022-21499
CVE-2022-21180
CVE-2022-21166
CVE-2022-30594
CVE-2022-21496
CVE-2022-21125
CVE-2022-21451
CVE-2022-34305
CVE-2022-29885
CVE-2022-27778
CVE-2018-25032
CVE-2022-21515
CVE-2022-21460
CVE-2022-21444
CVE-2022-21454
CVE-2022-21434
CVE-2022-21417
CVE-2022-21427
CVE-2022-34169
CVE-2022-21541
CVE-2022-21540
CVE-2022-21476
CVE-2022-21426
CVE-2022-21127
CVE-2022-21123
CVE-2021-3695
CVE-2021-33656
CVE-2021-33655
CVE-2021-33061
CVE-2021-20321
CVE-2021-20292
CVE-2021-3697
CVE-2021-3696
CVE-2020-36558
CVE-2021-39711
CVE-2020-36557
CVE-2019-20811
CVE-2019-19377
CVE-2018-7755
CVE-2017-16932
CVE-2015-20107
CVE-2021-38208
CVE-2021-43389
CVE-2022-2068
CVE-2022-1586
CVE-2022-1975
CVE-2022-1974
CVE-2022-1966
CVE-2022-1734
CVE-2022-1729
CVE-2022-1652
CVE-2022-1587
CVE-2022-1516
CVE-2021-43527
CVE-2022-1419
CVE-2022-1353
CVE-2022-1304
CVE-2022-1292
CVE-2022-1280
CVE-2022-1184
CVE-2022-1011
CWE-ID CWE-401
CWE-190
CWE-264
CWE-89
CWE-416
CWE-787
CWE-191
CWE-303
CWE-20
CWE-835
CWE-200
CWE-122
CWE-287
CWE-284
CWE-276
CWE-79
CWE-19
CWE-664
CWE-119
CWE-459
CWE-362
CWE-476
CWE-125
CWE-400
CWE-78
CWE-129
CWE-248
Exploitation vector Network
Public exploit Public exploit code for vulnerability #10 is available.
Public exploit code for vulnerability #22 is available.
Public exploit code for vulnerability #23 is available.
Public exploit code for vulnerability #33 is available.
Public exploit code for vulnerability #62 is available.
Public exploit code for vulnerability #72 is available.
Vulnerable software
Subscribe
Dell EMC Storage Monitoring and Reporting (SMR)
Server applications / SCADA systems

Vendor Dell

Security Bulletin

This security bulletin contains information about 75 vulnerabilities.

1) Memory leak

EUVDB-ID: #VU63390

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-28356

CWE-ID: CWE-401 - Improper Release of Memory Before Removing Last Reference ('Memory Leak')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in net/llc/af_llc.c component. A remote attacker can force the system to leak memory and perform denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

2) Integer overflow

EUVDB-ID: #VU62741

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-29824

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*). A remote attacker can pass specially crafted multi-gigabyte XML file to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

3) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65287

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-29187

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions. A remote user can bypass implemented security restrictions and privilege escalation on the system when navigating as root into a shared tmp directory owned by the victim, but where an attacker can create a git repository.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

4) SQL injection

EUVDB-ID: #VU63343

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-29155

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the experimental back-sql backend to slapd during an LDAP search operation when the search filter is processed. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

5) Memory leak

EUVDB-ID: #VU63419

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-28748

CWE-ID: CWE-401 - Improper Release of Memory Before Removing Last Reference ('Memory Leak')

Exploit availability: No

Description

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due memory leak when working with ax88179_178a devices. An attacker with physical access to the system can inject a malicious USB-drive and remotely obtain data from kernel memory.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

6) Use-after-free

EUVDB-ID: #VU64065

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-28736

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to a use-after-free error in the grub_cmd_chainloader() function in chainloader command. A local privileged user can trigger a use-after-free error and bypass secure boot protection mechanism.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

7) Out-of-bounds write

EUVDB-ID: #VU64063

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-28734

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing split HTTP headerst. A remote attacker can send specially crafted traffic to the affected system, trigger an out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

8) Integer underflow

EUVDB-ID: #VU64062

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-28733

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer underflow when processing IP packets within the grub_net_recv_ip4_packets() function. A remote attacker can send specially crafted network traffic to the affected system, trigger an integer underflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

9) Incorrect Implementation of Authentication Algorithm

EUVDB-ID: #VU63009

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-27782

CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the way libcurl handles previously used connections in a connection pool for subsequent transfers. Several TLS and SSH settings were left out from the configuration match checks, resulting in erroneous matches for different resources. As a result, libcurl can send authentication string from one resource to another, exposing credentials to a third-party.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

10) Input validation error

EUVDB-ID: #VU66476

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-36946

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the nfqnl_mangle() function in net/netfilter/nfnetlink_queue.c in the Linux kernel when processing IPv6 packets. A remote attacker can send specially crafted packets to the system and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

11) Infinite loop

EUVDB-ID: #VU63008

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-27781

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when handling requests with the CURLOPT_CERTINFO option. A remote attacker can consume all available system resources and cause denial of service conditions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

12) Information disclosure

EUVDB-ID: #VU62644

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-27776

CWE-ID: CWE-200 - Information Exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to curl can leak authentication or cookie header data during HTTP redirects to the same host but another port number. When asked to send custom headers or cookies in its HTTP requests, curl sends that set of headers only to the host which name is used in the initial URL, so that redirects to other hosts will make curl send the data to those. However, due to a flawed check, curl wrongly also sends that same set of headers to the hosts that are identical to the first one but use a different port number or URL scheme.

The vulnerability exists due to an incomplete fix for #VU10224 (CVE-2018-1000007).

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

13) Heap-based buffer overflow

EUVDB-ID: #VU62830

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-24903

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service or potentially execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when parsing data in imtcp, imptcp, imgssapi, and imhttp modules used for TCP syslog reception. A remote attacker can pass specially crafted data to the application, trigger heap-based buffer overflow and cause a denial of service or potentially execute arbitrary code on the target system.

Successful exploitation of this vulnerability is possible if the attacker is able to directly send specially crafted messages to the rsyslog daemon or by injecting specially crafted data into log files. Vulnerability exploitation in the second scenario requires that the rsyslog client supports octet-counted framing, which is not a default configuration.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

14) Improper Authentication

EUVDB-ID: #VU62640

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-22576

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when re-using OAUTH2 connections for SASL-enabled protocols, such as SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only). libcurl may reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. As a result, a connection that is successfully created and authenticated with a user name + OAUTH2 bearer can subsequently be erroneously reused even for user + [other OAUTH2 bearer], even though that might not even be a valid bearer.

A remote attacker can exploit this vulnerability against applications intended for use in multi-user environments to bypass authentication and gain unauthorized access to victim's accounts.


Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

15) Improper access control

EUVDB-ID: #VU63961

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-21499

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to improper access restrictions to the kernel debugger when booted in secure boot environments. A local privileged user can bypass UEFI Secure Boot restrictions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

16) Input validation error

EUVDB-ID: #VU64377

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-21180

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation in Memory Mapped I/O (MMIO) for some 14nm Client/Xeon E3 Intel® Processors. A local user can pass specially crafted input and perform a denial of service (DoS) attack in certain virtualized environments.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

17) Information disclosure

EUVDB-ID: #VU64366

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-21166

CWE-ID: CWE-200 - Information Exposure

Exploit availability: No

Description

The vulnerability allows an attacker to gain access to potentially sensitive information.

The vulnerability exists in Intel processors due to excessive data output when DirectPath I/O (PCI-Passthrough) is utilized. An attacker (both local and remote) with administrative access to a virtual machine that has an attached DirectPath I/O (PCI-Passthrough) device can obtain information stored in physical memory about the hypervisor or other virtual machines that reside on the same host.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

18) Incorrect default permissions

EUVDB-ID: #VU63631

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-30594

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to mishandling seccomp permissions. A local user can bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag and escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

19) Improper input validation

EUVDB-ID: #VU62400

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21496

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the JNDI component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

20) Information disclosure

EUVDB-ID: #VU64365

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-21125

CWE-ID: CWE-200 - Information Exposure

Exploit availability: No

Description

The vulnerability allows an attacker to gain access to potentially sensitive information.

The vulnerability exists in Intel processors due to excessive data output when DirectPath I/O (PCI-Passthrough) is utilized. An attacker (both local and remote) with administrative access to a virtual machine that has an attached DirectPath I/O (PCI-Passthrough) device can obtain information stored in physical memory about the hypervisor or other virtual machines that reside on the same host.



Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

21) Improper input validation

EUVDB-ID: #VU62428

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-21451

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

22) Cross-site scripting

EUVDB-ID: #VU64627

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-34305

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: Yes

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed to the form authentication example in the examples web application. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

23) Data Handling

EUVDB-ID: #VU63225

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-29885

CWE-ID: CWE-19 - Data Handling

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform DoS attack.

The vulnerability exists due to an error in documentation for the EncryptInterceptor, which incorrectly stated that it enabled Tomcat clustering to run over an untrusted network. A remote attacker can perform a denial of service attack against the exposed EncryptInterceptor.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

24) Improper control of a resource through its lifetime

EUVDB-ID: #VU63004

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-27778

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to delete files on the system.

The vulnerability exists in the curl command line tool when --no-clobber is used together with --remove-on-error. A remote attacker can trick the victim to connect to a malicious server and force the command line tool to remove unexpected files.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

25) Buffer overflow

EUVDB-ID: #VU61671

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2018-25032

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when compressing data. A remote attacker can pass specially crafted input to the application, trigger memory corruption and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

26) Improper input validation

EUVDB-ID: #VU65521

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21515

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Options component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

27) Improper input validation

EUVDB-ID: #VU62430

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-21460

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Server: Logging component in MySQL Server. A remote privileged user can exploit this vulnerability to gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

28) Improper input validation

EUVDB-ID: #VU62429

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-21444

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: DDL component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

29) Improper input validation

EUVDB-ID: #VU62404

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21454

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Group Replication Plugin component in MySQL Server. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

30) Improper input validation

EUVDB-ID: #VU62401

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21434

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

31) Improper input validation

EUVDB-ID: #VU62416

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21417

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

32) Improper input validation

EUVDB-ID: #VU62418

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21427

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: FTS component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

33) Improper input validation

EUVDB-ID: #VU65495

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-34169

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to compromise the affected system.

The vulnerability exists due to an integer truncation issue when processing malicious XSLT stylesheets. A remote non-authenticated attacker can pass specially crafted data to the application to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

34) Improper input validation

EUVDB-ID: #VU65496

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21541

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

35) Improper input validation

EUVDB-ID: #VU65497

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21540

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

36) Improper input validation

EUVDB-ID: #VU62398

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21476

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

37) Improper input validation

EUVDB-ID: #VU62399

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21426

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the JAXP component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

38) Incomplete cleanup

EUVDB-ID: #VU64376

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-21127

CWE-ID: CWE-459 - Incomplete cleanup

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information on the system.

The vulnerability exists due to incomplete cleanup in specific special register read operations. A local user can enable information disclosure.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

39) Information disclosure

EUVDB-ID: #VU64364

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-21123

CWE-ID: CWE-200 - Information Exposure

Exploit availability: No

Description

The vulnerability allows an attacker to gain access to potentially sensitive information.

The vulnerability exists in Intel processors due to excessive data output when DirectPath I/O (PCI-Passthrough) is utilized. An attacker (both local and remote) with administrative access to a virtual machine that has an attached DirectPath I/O (PCI-Passthrough) device can obtain information stored in physical memory about the hypervisor or other virtual machines that reside on the same host.


Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

40) Out-of-bounds write

EUVDB-ID: #VU64057

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-3695

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local privileged user to bypass implemented security restrictions.

The vulnerability exists due to a boundary error when processing PNG grayscale images. A local privileged user can pass specially crafted PNG image to the application, trigger an out-of-bounds write error and potentially bypass secure boot protection mechanism.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

41) Out-of-bounds write

EUVDB-ID: #VU66590

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-33656

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when setting font with malicous data by ioctl cmd PIO_FONT. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

42) Out-of-bounds write

EUVDB-ID: #VU65833

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-33655

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in FBIOPUT_VSCREENINFO IOCTL. A local user can trigger an out-of-bounds write error and execute arbitrary code with elevated privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

43) Input validation error

EUVDB-ID: #VU60490

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-33061

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient control flow management. A local user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

44) Race condition

EUVDB-ID: #VU59084

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-20321

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attacks.

The vulnerability exists due to a race condition when accessing file object in the Linux kernel OverlayFS subsystem. A local user can rename files in specific way with OverlayFS and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

45) Use-after-free

EUVDB-ID: #VU63382

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-20292

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a use-after-free error in drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouveau_sgdma_create_ttm in Nouveau DRM subsystem. A local user can escalate privileges and execute code in the context of the kernel.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

46) Integer underflow

EUVDB-ID: #VU64061

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-3697

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer underflow within the JPEG reader. A local privileged user can trigger an integer underflow and bypass secure boot protection mechanism.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

47) Out-of-bounds write

EUVDB-ID: #VU64059

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-3696

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local privileged user to bypass implemented security restrictions.

The vulnerability exists due to a boundary error when handling Huffman tables in the PNG reader. A local privileged user can pass specially crafted PNG image to the application, trigger an out-of-bounds write error and potentially bypass secure boot protection mechanism.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

48) NULL pointer dereference

EUVDB-ID: #VU66589

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2020-36558

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the Linux kernel before 5.5.7 involving a VT_RESIZEX. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

49) Out-of-bounds read

EUVDB-ID: #VU64433

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-39711

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to Incorrect Size Value when processing files in bpf_prog_test_run_skb of test_run.c. A local user with System execution privileges can trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

50) Race condition

EUVDB-ID: #VU66588

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2020-36557

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition between the VT_DISALLOCATE IOCTL and closing/opening of ttys. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

51) Input validation error

EUVDB-ID: #VU34374

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-20811

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a local authenticated user to manipulate data.

An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

52) Use-after-free

EUVDB-ID: #VU28418

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-19377

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

53) Security restrictions bypass

EUVDB-ID: #VU10918

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-7755

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local unauthenticated attacker to bypass security restrictions on the target system.

The weakness exists in the drivers/block/floppy.c source code in the fd_locked_ioctl function due to insufficient security restrictions. A local attacker can bypass security restrictions through the system floppy drive and obtain kernel code and data from the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

54) Resource exhaustion

EUVDB-ID: #VU9542

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2017-16932

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in parser.c function due to improper handling of certain parameter entities. A remote attacker can supply specially constructed XML data, trigger resource exhaustion and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

55) OS Command Injection

EUVDB-ID: #VU64573

Risk: High

CVSSv3.1:

CVE-ID: CVE-2015-20107

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the mailcap module, which does not escape characters into commands discovered in the system mailcap file. A remote unauthenticated attacker can pass specially crafted data to the applications that call mailcap.findmatch with untrusted input and execute arbitrary OS commands on the target system.


Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

56) NULL pointer dereference

EUVDB-ID: #VU63383

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-38208

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the net/nfc/llcp_sock.c component. A remote attacker can make getsockname call and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

57) Improper Validation of Array Index

EUVDB-ID: #VU63385

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-43389

CWE-ID: CWE-129 - Improper Validation of Array Index

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code with elevated privileges.

The vulnerability exists due to improper validation of array index in the ISDN CAPI implementation within detach_capi_ctr() function in drivers/isdn/capi/kcapi.c. local user can send specially crafted data to the system and execute arbitrary code with elevated privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

58) OS Command Injection

EUVDB-ID: #VU64559

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-2068

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the c_rehash script distributed by some operating systems. A remote attacker with ability to pass data to c_rehash script can and execute arbitrary OS commands with the privileges of the script.

The vulnerability exists due to incomplete fix for #VU62765 (CVE-2022-1292).

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

59) Out-of-bounds read

EUVDB-ID: #VU63945

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-1586

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary condition in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. A remote attacker can pass specially crafted data to the application, trigger out-of-bounds read error, gain access to sensitive information or perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

60) Uncaught Exception

EUVDB-ID: #VU64264

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-1975

CWE-ID: CWE-248 - Uncaught Exception

Exploit availability: No

Description

The vulnerability allows a remote attacker on the local network to perform a denial of service (DoS) attack.

The vulnerability exists due to an uncaught exception error in the Linux kernel. A remote attacker on the local network can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

61) Use-after-free

EUVDB-ID: #VU64263

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-1974

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local privileged user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the Linux kernel's NFC core functionality due to a race condition between kobject creation and delete. A local attacker with CAP_NET_ADMIN privilege can leak kernel information and escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

62) Use-after-free

EUVDB-ID: #VU64070

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-1966

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the Linux kernel's Netfilter subsystem in net/netfilter/nf_tables_api.c. A local user can trigger use-after-free error to escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

63) Use-after-free

EUVDB-ID: #VU64082

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-1734

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to Marvell NFC device driver implementation in the Linux kernel did not properly perform memory cleanup operations in some situations. A local user can trigger use-after-free to escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

64) Race condition

EUVDB-ID: #VU64156

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-1729

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within sys_perf_event_open() in Linux kernel. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

65) Use-after-free

EUVDB-ID: #VU64434

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-1652

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to use-after-free error in the bad_flp_intr() function. A local user can execute a specially-crafted program to cause a denial of service condition on the system or escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

66) Out-of-bounds read

EUVDB-ID: #VU65553

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-1587

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the get_recurse_data_length() function in pcre2_jit_compile.c when handling recursions in JIT-compiled regular expressions. A remote attacker can pass specially crafted input to the affected application, trigger an out-of-bounds read error and read contents of memory on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

67) NULL pointer dereference

EUVDB-ID: #VU63158

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-1516

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference error in the Linux kernel’s X.25 set of standardized network protocols functionality. A local user can terminate session using a simulated Ethernet card and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

68) Heap-based buffer overflow

EUVDB-ID: #VU58477

Risk: High

CVSSv3.1:

CVE-ID: CVE-2021-43527

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when handling DER-encoded DSA or RSA-PSS signatures. A remote attacker can send specially crafted signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

69) Use-after-free

EUVDB-ID: #VU63418

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-1419

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in vgem_gem_dumb_create() function in Linux kernel. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

70) Information disclosure

EUVDB-ID: #VU63388

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-1353

CWE-ID: CWE-200 - Information Exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the pfkey_register function in net/key/af_key.c in the Linux kernel. A local user can gain unauthorized access to kernel memory, leading to a system crash or a leak of internal kernel information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

71) Out-of-bounds write

EUVDB-ID: #VU64075

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-1304

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A local attacker can use a specially crafted filesystem, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

72) OS Command Injection

EUVDB-ID: #VU62765

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-1292

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the c_rehash script distributed by some operating systems. A remote attacker with ability to pass data to c_rehash script can and execute arbitrary OS commands with the privileges of the script.


Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

73) Use-after-free

EUVDB-ID: #VU62358

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-1280

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a use-after-free error within the drm_lease_held() function in drivers/gpu/drm/drm_lease.c in the Linux kernel. A local user can run a specially crafted program to trigger a use-after-free error and crash the kernel or gain access to sensitive information.


Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

74) Use-after-free

EUVDB-ID: #VU64438

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-1184

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in fs/ext4/namei.c:dx_insert_block() function in the Linux kernel’s filesystem sub-component.. A local user can trigger use-after-free and perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

75) Use-after-free

EUVDB-ID: #VU63386

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-1011

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the write() function of FUSE filesystem. A local user can retireve (partial) /etc/shadow hashes and execute arbitrary code with elevated privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell EMC Storage Monitoring and Reporting (SMR): before 4.8.0.0


CPE2.3
External links

http://www.dell.com/support/kbdoc/nl-nl/000203996/dsa-2022-261-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###