CVE-2024-2494

MEDIUM Year: 2024
CVSS v3 Score
6.2
Medium
Weakness Type
CWE-789
View all →

Vulnerability Description

A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.

Related Vulnerabilities

CVE-2022-20845

MEDIUM
CVSS:6.0(Medium)

A vulnerability in the TL1 function of Cisco Network Convergence System (NCS) 4000 Series could allow an authenticated, local attacker to cause a memory leak in the TL1 process. This vulnerabilit...

CWE-7892022

CVE-2018-12541

MEDIUM
CVSS:6.5(Medium)

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There s...

CWE-7892018

CVE-2020-8551

MEDIUM
CVSS:6.5(Medium)

The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP ...

CWE-7892020

CVE-2022-22226

MEDIUM
CVSS:6.5(Medium)

In VxLAN scenarios on EX4300-MP, EX4600, QFX5000 Series devices an Uncontrolled Memory Allocation vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthentic...

CWE-7892022

CVE-2022-4741

MEDIUM
CVSS:6.5(Medium)

A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText. The manipulation leads to unco...

CWE-7892022

CVE-2023-20089

MEDIUM
CVSS:6.5(Medium)

A vulnerability in the Link Layer Discovery Protocol (LLDP) feature for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mode could allow an unauthenticated, adjacen...

CWE-7892023