Red Hat Cygwin vulnerabilities

2 CVEs affecting Red Hat Cygwin, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2008-3323, published 2008-07-28.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2007-6181, published 2007-11-30. High severity, CVSS 8.5. EPSS: 5.6% chance of exploitation in the next 30 days. Heap-based buffer overflow in cygwin1.dll in Cygwin 1.5.7 and earlier allows context-dependent attackers to execute arbitrary code via a filename with a certain length, as demonstrated by a remote…
• CVE-2008-3323, published 2008-07-28. High severity, CVSS 7.6. EPSS: 2.6% chance of exploitation in the next 30 days. setup.exe before 2.573.2.3 in Cygwin does not properly verify the authenticity of packages, which allows remote Cygwin mirror servers or man-in-the-middle attackers to execute arbitrary code via a…