Exposure of Fedora

Operating systems
22
exposure score
695
sites use
0
exploited
2
critical
Vexday analysis

O histórico de vulnerabilidades catalogadas para o Fedora soma 80 CVEs, com taxa de exploração ativa abaixo da média geral do catálogo KEV, sem nenhum registro confirmado de exploração ativa no momento. Ainda assim, o EPSS mais elevado observado — atribuído à CVE-2023-1183, com pontuação de aproximadamente 0,66 — indica probabilidade não trivial de exploração para essa falha específica, o que justifica atenção prioritária mesmo na ausência de confirmação formal no KEV. O tipo de fraqueza mais frequente é CWE-416 (use-after-free), categoria historicamente associada a impactos de integridade e execução de código que demandam correção ágil. A ausência de novas CVEs nos últimos 90 dias e o total reduzido de falhas críticas (2) sugerem superfície de ataque relativamente contida, mas o perfil de risco não deve ser desconsiderado dado o potencial de exploração indicado pelo EPSS.

CVEs

80 results
CVE-2023-1183MEDIUMArbitrary file writeEPSS 64.6%CVE-2023-3338MEDIUMCrash due to a null pointer dereference in the dn_nsp_send functionEPSS 8.0%CVE-2023-6246HIGHGlibc: heap-based buffer overflow in __vsyslog_internal()EPSS 4.8%CVE-2023-32252HIGHSession null pointer dereference denial-of-service vulnerabilityEPSS 4.1%CVE-2023-32248HIGHTree connection null pointer dereference denial-of-service vulnerabilityEPSS 4.1%CVE-2023-32247HIGHSession setup memory exhaustion denial-of-service vulnerabilityEPSS 3.9%CVE-2023-6779HIGHGlibc: off-by-one heap-based buffer overflow in __vsyslog_internal()EPSS 3.2%CVE-2023-32254CRITICALTree connection race condition remote code execution vulnerabilityEPSS 2.9%CVE-2010-3872HIGHHttpd: mod_fcgid: stack-based buffer overflow in fcgid_header_bucket_read() in modules/fcgid/fcgid_bucket.cEPSS 2.8%CVE-2023-6780MEDIUMGlibc: integer overflow in __vsyslog_internal()EPSS 2.7%CVE-2023-32250CRITICALSession race condition remote code execution vulnerabilityEPSS 2.6%CVE-2023-32258HIGHSession race condition remote code execution vulnerabilityEPSS 2.5%CVE-2023-32257HIGHSession race condition remote code execution vulnerabilityEPSS 2.4%CVE-2023-6200HIGHKernel: icmpv6 router advertisement packets, aka linux tcp/ip remote code execution vulnerabilityEPSS 2.2%CVE-2023-3354HIGHImproper i/o watch removal in tls handshake can lead to remote unauthenticated denial of serviceEPSS 1.6%CVE-2023-6395MEDIUMMock: privilege escalation for users that can access mock configurationEPSS 1.6%CVE-2023-3269HIGHDistros-[dirtyvma] privilege escalation via non-rcu-protected vma traversalEPSS 1.3%CVE-2023-3430HIGHOpenimageio: heap-buffer-overflow in file src/gif.imageio/gifinput.cppEPSS 1.2%CVE-2023-3618MEDIUMSegmentation fault in fax3encode in libtiff/tif_fax3.cEPSS 1.2%CVE-2023-4154HIGHSamba: ad dc password exposure to privileged users and rodcsEPSS 1.2%