CVE-2022-41318

HIGH Year: 2022
CVSS v3 Score
8.6
High
Weakness Type
CWE-190
View all →

Vulnerability Description

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a client. This is fixed in 5.7.

Related Vulnerabilities

CVE-2016-1951

HIGH
CVSS:8.6(High)

Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified othe...

CWE-1902016

CVE-2016-5094

HIGH
CVSS:8.6(High)

Integer overflow in the php_html_entities function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified...

CWE-1902016

CVE-2016-5095

HIGH
CVSS:8.6(High)

Integer overflow in the php_escape_html_entities_ex function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have u...

CWE-1902016

CVE-2016-5096

HIGH
CVSS:8.6(High)

Integer overflow in the fread function in ext/standard/file.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impac...

CWE-1902016

CVE-2016-6250

HIGH
CVSS:8.6(High)

Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying fi...

CWE-1902016

CVE-2020-10878

HIGH
CVSS:8.6(High)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of ins...

CWE-1902020