# definitions

definition_id: oval:org.debian:def:121931804297231819915630696948628732918
title: CVE-2018-19502 faad2
description:
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a heap-based buffer overflow in the function excluded_channels() in libfaad/syntax.c.


definition_id: oval:org.debian:def:140487397909218969674115514620090909729
title: CVE-2018-19503 faad2
description:
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a stack-based buffer overflow in the function calculate_gain() in libfaad/sbr_hfadj.c.


definition_id: oval:org.debian:def:75544629178732502648318990204008985370
title: CVE-2018-19504 faad2
description:
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There is a NULL pointer dereference in ifilter_bank() in libfaad/filtbank.c.


definition_id: oval:org.debian:def:306461540784155646707908423299328668387
title: CVE-2018-19516 kf5-messagelib
description:
messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value.


definition_id: oval:org.debian:def:250938451767977373135845209067632965740
title: CVE-2018-19517 sysstat
description:
An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call, as demonstrated by sadf.


definition_id: oval:org.debian:def:162091074787068106574164516791466732444
title: CVE-2018-19518 php7.3
description:
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.


definition_id: oval:org.debian:def:31547700318168803806599691571582427487
title: CVE-2018-19532 libpodofo
description:
A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in pdftranslator.cpp of PoDoFo 0.9.6, while creating the PdfXObject, as demonstrated by podofoimpose. It allows an attacker to cause Denial of Service.


definition_id: oval:org.debian:def:269484382671039672264460116261339755746
title: CVE-2018-19535 exiv2
description:
In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (application crash due to a heap-based buffer over-read) via a crafted PNG file.


definition_id: oval:org.debian:def:120394276232708194848838967023214929091
title: CVE-2018-19591 glibc
description:
In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.


definition_id: oval:org.debian:def:91336025039824713161226804156994582227
title: CVE-2018-19608 mbedtls
description:
Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to recover the plaintext of RSA decryption, which is used in RSA-without-(EC)DH(E) cipher suites.


definition_id: oval:org.debian:def:311210469374247624714439412915921900786
title: CVE-2018-19622 wireshark
description:
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the MMSE dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-mmse.c by preventing length overflows.


definition_id: oval:org.debian:def:139789446126548507114788206355371241126
title: CVE-2018-19623 wireshark
description:
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the LBMPDM dissector could crash. In addition, a remote attacker could write arbitrary data to any memory locations before the packet-scoped memory. This was addressed in epan/dissectors/packet-lbmpdm.c by disallowing certain negative values.


definition_id: oval:org.debian:def:303172765335626490183981282600156935548
title: CVE-2018-19624 wireshark
description:
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the PVFS dissector could crash. This was addressed in epan/dissectors/packet-pvfs2.c by preventing a NULL pointer dereference.


definition_id: oval:org.debian:def:82978809808866447200446323326140062229
title: CVE-2018-19625 wireshark
description:
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the dissection engine could crash. This was addressed in epan/tvbuff_composite.c by preventing a heap-based buffer over-read.


definition_id: oval:org.debian:def:28189577830360495075203581940714599971
title: CVE-2018-19626 wireshark
description:
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the DCOM dissector could crash. This was addressed in epan/dissectors/packet-dcom.c by adding '\0' termination.


definition_id: oval:org.debian:def:6254682683311963139193632967575117720
title: CVE-2018-19627 wireshark
description:
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by adjusting a buffer boundary.


definition_id: oval:org.debian:def:38677351390388599144649847497644652615
title: CVE-2018-19628 wireshark
description:
In Wireshark 2.6.0 to 2.6.4, the ZigBee ZCL dissector could crash. This was addressed in epan/dissectors/packet-zbee-zcl-lighting.c by preventing a divide-by-zero error.


definition_id: oval:org.debian:def:216203776114294969366385586768432528943
title: CVE-2018-19655 dcraw
description:
A stack-based buffer overflow in the find_green() function of dcraw through 9.28, as used in ufraw-batch and many other products, may allow a remote attacker to cause a control-flow hijack, denial-of-service, or unspecified other impact via a maliciously crafted raw photo file.


definition_id: oval:org.debian:def:314491015443195327956224180605560069681
title: CVE-2018-19661 libsndfile
description:
An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2ulaw_array in ulaw.c that will lead to a denial of service.


definition_id: oval:org.debian:def:276613446790934759567973780856254194926
title: CVE-2018-19662 libsndfile
description:
An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in alaw.c that will lead to a denial of service.


definition_id: oval:org.debian:def:5338548354679724261674670286383671322
title: CVE-2018-19665 qemu
description:
The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory corruption.


definition_id: oval:org.debian:def:204981799320196373893984309418772269999
title: CVE-2018-19756 libsixel
description:
There is a heap-based buffer over-read at stb_image.h (function: stbi__tga_load) in libsixel 1.8.2 that will cause a denial of service.


definition_id: oval:org.debian:def:235610138203076605314149199713216039171
title: CVE-2018-19757 libsixel
description:
There is a NULL pointer dereference at function sixel_helper_set_additional_message (status.c) in libsixel 1.8.2 that will cause a denial of service.


definition_id: oval:org.debian:def:203330658665182699786782315069158898192
title: CVE-2018-19758 libsndfile
description:
There is a heap-based buffer over-read at wav.c in wav_write_header in libsndfile 1.0.28 that will cause a denial of service.


definition_id: oval:org.debian:def:230636115708361282106261871909364095114
title: CVE-2018-19759 libsixel
description:
There is a heap-based buffer over-read at stb_image_write.h (function: stbi_write_png_to_mem) in libsixel 1.8.2 that will cause a denial of service.


definition_id: oval:org.debian:def:193845129564386011723729710874955804926
title: CVE-2018-19761 libsixel
description:
There is an illegal address access at fromsixel.c (function: sixel_decode_raw_impl) in libsixel 1.8.2 that will cause a denial of service.


definition_id: oval:org.debian:def:187745948085982352983685604201808209721
title: CVE-2018-19762 libsixel
description:
There is a heap-based buffer overflow at fromsixel.c (function: image_buffer_resize) in libsixel 1.8.2 that will cause a denial of service or possibly unspecified other impact.


definition_id: oval:org.debian:def:106692895051850425502785507921317293667
title: CVE-2018-19763 libsixel
description:
There is a heap-based buffer over-read at writer.c (function: write_png_to_file) in libsixel 1.8.2 that will cause a denial of service.


definition_id: oval:org.debian:def:239597055836180753441568336040744777492
title: CVE-2018-19787 lxml
description:
An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.


definition_id: oval:org.debian:def:67937284930853779021405907117843823748
title: CVE-2018-19788 policykit-1
description:
A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command.


definition_id: oval:org.debian:def:322145644539645983183092136463391378133
title: CVE-2018-19789 symfony
description:
An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint `string` in a setter method (e.g. `setName(string $name)`) of a class that's the `data_class` of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then `UploadedFile::__toString()` is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution.


definition_id: oval:org.debian:def:274212558491956305735758421310040770918
title: CVE-2018-19790 symfony
description:
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restrictions and effectively redirect the user to any domain after login.


definition_id: oval:org.debian:def:148010145502267024910534077712471529621
title: CVE-2018-19824 linux
description:
In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c.


definition_id: oval:org.debian:def:291491219695543486573610998254865875983
title: CVE-2018-19827 libsass
description:
In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:142404872232453678213207151487174321892
title: CVE-2018-19837 libsass
description:
In LibSass prior to 3.5.5, Sass::Eval::operator()(Sass::Binary_Expression*) inside eval.cpp allows attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, because of certain incorrect parsing of '%' as a modulo operator in parser.cpp.


definition_id: oval:org.debian:def:1462355333702358717484512619919212003
title: CVE-2018-19839 libsass
description:
In LibSass prior to 3.5.5, the function handle_error in sass_context.cpp allows attackers to cause a denial-of-service resulting from a heap-based buffer over-read via a crafted sass file.


definition_id: oval:org.debian:def:42705570576943679998860220261416353667
title: CVE-2018-19840 wavpack
description:
The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero.


definition_id: oval:org.debian:def:212647096279463109666253066284212715995
title: CVE-2018-19841 wavpack
description:
The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack.


definition_id: oval:org.debian:def:44508514743211767661203662801672067022
title: CVE-2018-19854 linux
description:
An issue was discovered in the Linux kernel before 4.19.3. crypto_report_one() and related functions in crypto/crypto_user.c (the crypto user configuration API) do not fully initialize structures that are copied to userspace, potentially leaking sensitive memory to user programs. NOTE: this is a CVE-2013-2547 regression but with easier exploitability because the attacker does not need a capability (however, the system must have the CONFIG_CRYPTO_USER kconfig option).


definition_id: oval:org.debian:def:170951514717162601215955358341577073517
title: CVE-2018-19857 vlc
description:
The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF files, because a ReadKukiChunk() cast converts a return value to an unsigned int even if that value is negative. This could result in a denial of service and/or a potential infoleak.


definition_id: oval:org.debian:def:232105086384216765995071259036042143512
title: CVE-2018-19865 qtvirtualkeyboard-opensource-src
description:
A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3.


definition_id: oval:org.debian:def:204786773851658834601503412173582457758
title: CVE-2018-19869 qt4-x11
description:
An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp.


definition_id: oval:org.debian:def:280087924576570649206802984880972248149
title: CVE-2018-19870 qt4-x11
description:
An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler resulting in a segmentation fault.


definition_id: oval:org.debian:def:303504025127226684013435611317965146917
title: CVE-2018-19872 qt4-x11
description:
An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in qppmhandler.cpp.


definition_id: oval:org.debian:def:37953790614464327565425286781664357636
title: CVE-2018-19876 cairo
description:
cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a "free(): invalid pointer" error.


definition_id: oval:org.debian:def:121744777272793987105745640496370717198
title: CVE-2018-19935 php7.3
description:
ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function.


definition_id: oval:org.debian:def:82982069871629849614115803158147986238
title: CVE-2018-19960 onionshare
description:
The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.


definition_id: oval:org.debian:def:319356235540057448273568854957855371286
title: CVE-2018-19961 xen
description:
An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.


definition_id: oval:org.debian:def:231811286356455919226722869772132050737
title: CVE-2018-19962 xen
description:
An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones.


definition_id: oval:org.debian:def:224160996820316786209979352906041212899
title: CVE-2018-19963 xen
description:
An issue was discovered in Xen 4.11 allowing HVM guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because x86 IOREQ server resource accounting (for external emulators) was mishandled.


definition_id: oval:org.debian:def:111082081704673418027667508023453278278
title: CVE-2018-19964 xen
description:
An issue was discovered in Xen 4.11.x allowing x86 guest OS users to cause a denial of service (host OS hang) because the p2m lock remains unavailable indefinitely in certain error conditions.


definition_id: oval:org.debian:def:32207640366989317885250038872827393496
title: CVE-2018-19965 xen
description:
An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation.


definition_id: oval:org.debian:def:221972497333738493802652471132671870051
title: CVE-2018-19966 xen
description:
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because of an interpretation conflict for a union data structure associated with shadow paging. NOTE: this issue exists because of an incorrect fix for CVE-2017-15595.


definition_id: oval:org.debian:def:259360611816573199849800265293276676531
title: CVE-2018-19967 xen
description:
An issue was discovered in Xen through 4.11.x on Intel x86 platforms allowing guest OS users to cause a denial of service (host OS hang) because Xen does not work around Intel's mishandling of certain HLE transactions associated with the KACQUIRE instruction prefix.


definition_id: oval:org.debian:def:206455608180014602242167832622368100832
title: CVE-2018-19974 yara
description:
In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c. This can allow attackers to discover addresses in the real stack (not the YARA virtual stack).


definition_id: oval:org.debian:def:160608642166555472269783757794063923685
title: CVE-2018-19975 yara
description:
In YARA 3.8.1, bytecode in a specially crafted compiled rule can read data from any arbitrary address in memory, in libyara/exec.c. Specifically, OP_COUNT can read a DWORD.


definition_id: oval:org.debian:def:299293346712712525526993428510817295834
title: CVE-2018-19976 yara
description:
In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyara/exec.c. This is a consequence of the design of the YARA virtual machine.


definition_id: oval:org.debian:def:66777852241291973132387370119187037348
title: CVE-2018-19985 linux
description:
The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space.


definition_id: oval:org.debian:def:270956153296324823768198617068974011847
title: CVE-2018-1999010 ffmpeg
description:
FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in attackers accessing out of bound data. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in cced03dd667a5df6df8fd40d8de0bff477ee02e8 and later.


definition_id: oval:org.debian:def:169218974895066769072150946934785673436
title: CVE-2018-1999011 ffmpeg
description:
FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-overflow that may result in remote code execution. This attack appears to be exploitable via specially crafted ASF file that has to be provided as input to FFmpeg. This vulnerability appears to have been fixed in 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 and later.


definition_id: oval:org.debian:def:249853855697257440228281981139691699909
title: CVE-2018-1999012 ffmpeg
description:
FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.


definition_id: oval:org.debian:def:26060089556354950075512400950887256997
title: CVE-2018-1999013 ffmpeg
description:
FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.


definition_id: oval:org.debian:def:56609925087975037166529600802743459156
title: CVE-2018-1999014 ffmpeg
description:
FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. This attack appear to be exploitable via specially crafted MXF file which has to be provided as input. This vulnerability appears to have been fixed in bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 and later.


definition_id: oval:org.debian:def:130909594806259503511467132233063160956
title: CVE-2018-1999015 ffmpeg
description:
FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F format demuxer that can result in heap memory reading. This attack appear to be exploitable via specially crafted ASF file that has to provided as input. This vulnerability appears to have been fixed in 5aba5b89d0b1d73164d3b81764828bb8b20ff32a and later.


definition_id: oval:org.debian:def:198451976446378230588766871129820795588
title: CVE-2018-1999023 wesnoth-1.14
description:
The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can result in code execution outside the sandbox. This attack appear to be exploitable via Loading specially-crafted saved games, networked games, replays, and player content.


definition_id: oval:org.debian:def:209800429651647710718906330789962766688
title: CVE-2018-1999024 mathjax
description:
MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax. This vulnerability appears to have been fixed in 2.7.4 and later.


definition_id: oval:org.debian:def:49909685756581288539970959540751016853
title: CVE-2018-20004 mxml
description:
An issue has been found in Mini-XML (aka mxml) 2.12. It is a stack-based buffer overflow in mxml_write_node in mxml-file.c via vectors involving a double-precision floating point number and the '<order type="real">' substring, as demonstrated by testmxml.


definition_id: oval:org.debian:def:36561869995314190312127991226573364084
title: CVE-2018-20019 libvncserver
description:
LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities in VNC client code that can result remote code execution


definition_id: oval:org.debian:def:7506032736650235087980892317683923122
title: CVE-2018-20020 libvncserver
description:
LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in VNC client code that can result remote code execution


definition_id: oval:org.debian:def:12125849510594807845421654982345110512
title: CVE-2018-20021 libvncserver
description:
LibVNC before commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19c contains a CWE-835: Infinite loop vulnerability in VNC client code. Vulnerability allows attacker to consume excessive amount of resources like CPU and RAM


definition_id: oval:org.debian:def:2468053906592076901292440885092359706
title: CVE-2018-20022 libvncserver
description:
LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vulnerability in VNC client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR


definition_id: oval:org.debian:def:249223084852190363869099034923034268782
title: CVE-2018-20023 libvncserver
description:
LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC Repeater client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR


definition_id: oval:org.debian:def:206958287691267089353528479806650029621
title: CVE-2018-20024 libvncserver
description:
LibVNC before commit 4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7 contains null pointer dereference in VNC client code that can result DoS.


definition_id: oval:org.debian:def:183841352710578470679028949736849492269
title: CVE-2018-20030 libexif
description:
An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources.


definition_id: oval:org.debian:def:252655865763310202710201754955487513629
title: CVE-2018-20060 python-urllib3
description:
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.


definition_id: oval:org.debian:def:70397318303160979757299557741618950916
title: CVE-2018-20065 chromium
description:
Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigations without a user gesture via a crafted PDF file.


definition_id: oval:org.debian:def:183159697311295936932552842730734861562
title: CVE-2018-20066 chromium
description:
Incorrect object lifecycle in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:122541778771416100618012123322884417426
title: CVE-2018-20067 chromium
description:
A renderer initiated back navigation was incorrectly allowed to cancel a browser initiated one in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.


definition_id: oval:org.debian:def:316922937252516070716082229238051285912
title: CVE-2018-20068 chromium
description:
Incorrect handling of 304 status codes in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.


definition_id: oval:org.debian:def:37110121792945133319278495690484837877
title: CVE-2018-20073 chromium
description:
Use of extended attributes in downloads in Google Chrome prior to 72.0.3626.81 allowed a local attacker to read download URLs via the filesystem.


definition_id: oval:org.debian:def:173950872103604584116512225607508897077
title: CVE-2018-20097 exiv2
description:
There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:95849176549313391919022745141726661802
title: CVE-2018-20102 haproxy
description:
An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due to a missing check when validating DNS responses, remote attackers might be able read the 16 bytes corresponding to an AAAA record from the non-initialized part of the buffer, possibly accessing anything that was left on the stack, or even past the end of the 8193-byte buffer, depending on the value of accepted_payload_size.


definition_id: oval:org.debian:def:255589584618645567649377064659339071928
title: CVE-2018-20103 haproxy
description:
An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion.


definition_id: oval:org.debian:def:238245385238253727185275986445402755546
title: CVE-2018-20145 mosquitto
description:
Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and the default listener specified an acl_file, then the acl file was being ignored.


definition_id: oval:org.debian:def:185619611484921331045255739055114440594
title: CVE-2018-20147 wordpress
description:
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.


definition_id: oval:org.debian:def:281993089003325801202311722972879552408
title: CVE-2018-20148 wordpress
description:
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.


definition_id: oval:org.debian:def:241780677527568426502418574368709910313
title: CVE-2018-20149 wordpress
description:
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.


definition_id: oval:org.debian:def:339548732965171363345860745755450637533
title: CVE-2018-20150 wordpress
description:
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.


definition_id: oval:org.debian:def:115892191590380604724733622756225885484
title: CVE-2018-20151 wordpress
description:
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.


definition_id: oval:org.debian:def:212986277432249650425389577419616450516
title: CVE-2018-20152 wordpress
description:
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.


definition_id: oval:org.debian:def:313029596159521946059069379491031523894
title: CVE-2018-20153 wordpress
description:
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.


definition_id: oval:org.debian:def:107540367448972011692544131629791020674
title: CVE-2018-20164 uap-core
description:
An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)


definition_id: oval:org.debian:def:7549921355661083576367931111854053030
title: CVE-2018-20167 terminology
description:
Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat README.md" command when \e}pn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME types (/usr/share/applications). The control sequence defers unknown file types to the handle_unknown_media() function, which executes xdg-open against the filename specified in the sequence. The use of xdg-open for all unknown file types allows executable file formats with a registered shared MIME type to be executed. An attacker can achieve remote code execution by introducing an executable file and a plain text file containing the control sequence through a fake software project (e.g., in Git or a tarball). When the control sequence is rendered (such as with cat), the executable file will be run.


definition_id: oval:org.debian:def:101564951463499825174718217266880763474
title: CVE-2018-20169 linux
description:
An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.


definition_id: oval:org.debian:def:93347301771096039955227552355506503553
title: CVE-2018-20174 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function ui_clip_handle_data() that results in an information leak.


definition_id: oval:org.debian:def:292191292657185548904037482675989564994
title: CVE-2018-20175 rdesktop
description:
rdesktop versions up to and including v1.8.3 contains several Integer Signedness errors that lead to Out-Of-Bounds Reads in the file mcs.c and result in a Denial of Service (segfault).


definition_id: oval:org.debian:def:105732457213269202372039897292653161307
title: CVE-2018-20176 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain several Out-Of- Bounds Reads in the file secure.c that result in a Denial of Service (segfault).


definition_id: oval:org.debian:def:311944212845688694603467714072282484049
title: CVE-2018-20177 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in the function rdp_in_unistr() and results in memory corruption and possibly even a remote code execution.


definition_id: oval:org.debian:def:330964016185618508474883447799183540148
title: CVE-2018-20178 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function process_demand_active() that results in a Denial of Service (segfault).


definition_id: oval:org.debian:def:283499436384071199431204395158116559600
title: CVE-2018-20179 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspci_process() and results in memory corruption and probably even a remote code execution.


definition_id: oval:org.debian:def:104285481166690247369309722705003396698
title: CVE-2018-20180 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function rdpsnddbg_process() and results in memory corruption and probably even a remote code execution.


definition_id: oval:org.debian:def:240664749986533965691646341437946566984
title: CVE-2018-20181 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function seamless_process() and results in memory corruption and probably even a remote code execution.


definition_id: oval:org.debian:def:141500925973897690968776553659530571097
title: CVE-2018-20182 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global variables in the function seamless_process_line() that results in memory corruption and probably even a remote code execution.


definition_id: oval:org.debian:def:145258952986043426953446227003111651649
title: CVE-2018-20187 botan
description:
A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the time taken for ECC key generation may be able to derive information about the high bits of the secret key, as the function to derive the public point from the secret scalar uses an unblinded Montgomery ladder whose loop iteration count depends on the bitlength of the secret. This issue affects only key generation, not ECDSA signatures or ECDH key agreement.


definition_id: oval:org.debian:def:110171394565941326635013807867609916643
title: CVE-2018-20190 libsass
description:
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.


definition_id: oval:org.debian:def:123926691828778664311863669011875497139
title: CVE-2018-20194 faad2
description:
There is a stack-based buffer underflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because limiting the additional noise energy level is mishandled for the G_max <= G case.


definition_id: oval:org.debian:def:114286282501116275460502739337026962257
title: CVE-2018-20195 faad2
description:
A NULL pointer dereference was discovered in ic_predict of libfaad/ic_predict.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.


definition_id: oval:org.debian:def:65997844101456126857818986630346024666
title: CVE-2018-20197 faad2
description:
There is a stack-based buffer underflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because limiting the additional noise energy level is mishandled for the G_max > G case.


definition_id: oval:org.debian:def:67561630950678449627108087951526694490
title: CVE-2018-20198 faad2
description:
A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the LONG_START_SEQUENCE case.


definition_id: oval:org.debian:def:191283845728410725208394180419157208044
title: CVE-2018-20217 krb5
description:
A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.


definition_id: oval:org.debian:def:319741829661103601819694385128776260057
title: CVE-2018-20230 pspp
description:
An issue was discovered in PSPP 1.2.0. There is a heap-based buffer overflow at the function read_bytes_internal in utilities/pspp-dump-sav.c, which allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:221935988867345643896274026149082885225
title: CVE-2018-20337 libraw
description:
There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.


definition_id: oval:org.debian:def:192110813324322633995328223287229210712
title: CVE-2018-20340 libu2f-host
description:
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey.


definition_id: oval:org.debian:def:233172993839475080460066168472563590387
title: CVE-2018-20346 chromium
description:
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.


definition_id: oval:org.debian:def:195906824242313761588673577459631918437
title: CVE-2018-20348 libpff
description:
libpff_item_tree_create_node in libpff_item_tree.c in libpff before experimental-20180714 allows attackers to cause a denial of service (infinite recursion) via a crafted file, related to libfdata_tree_get_node_value in libfdata_tree.c.


definition_id: oval:org.debian:def:7874968566137404742091803997489544482
title: CVE-2018-20349 igraph
description:
The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object.


definition_id: oval:org.debian:def:101524816154980374745285102064082112408
title: CVE-2018-20357 faad2
description:
A NULL pointer dereference was discovered in sbr_process_channel of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash.


definition_id: oval:org.debian:def:339852178405626723665090270441700805722
title: CVE-2018-20358 faad2
description:
An invalid memory address dereference was discovered in the lt_prediction function of libfaad/lt_predict.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.


definition_id: oval:org.debian:def:7819616277545098495704936494251843208
title: CVE-2018-20359 faad2
description:
An invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.


definition_id: oval:org.debian:def:262477107686325014479626613896056805239
title: CVE-2018-20361 faad2
description:
An invalid memory address dereference was discovered in the hf_assembly function of libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.


definition_id: oval:org.debian:def:186310536169954743001774345934216313762
title: CVE-2018-20362 faad2
description:
A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash because adding to windowed output is mishandled in the EIGHT_SHORT_SEQUENCE case.


definition_id: oval:org.debian:def:232376799584355636015151573198451519919
title: CVE-2018-20406 python3.7
description:
Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.7, v3.6.7rc1, v3.6.7rc2, v3.6.8, v3.6.8rc1, v3.6.9, v3.6.9rc1; v3.7.1, v3.7.1rc1, v3.7.1rc2, v3.7.2, v3.7.2rc1, v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.


definition_id: oval:org.debian:def:36324773757446077068709575400486555934
title: CVE-2018-20430 libextractor
description:
GNU Libextractor through 1.8 has an out-of-bounds read vulnerability in the function history_extract() in plugins/ole2_extractor.c, related to EXTRACTOR_common_convert_to_utf8 in common/convert.c.


definition_id: oval:org.debian:def:35030745341815263022730119492209480348
title: CVE-2018-20431 libextractor
description:
GNU Libextractor through 1.8 has a NULL Pointer Dereference vulnerability in the function process_metadata() in plugins/ole2_extractor.c.


definition_id: oval:org.debian:def:243036292026558180504567721988125369563
title: CVE-2018-20433 c3p0
description:
c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.


definition_id: oval:org.debian:def:212168034022198977330348422040734215465
title: CVE-2018-20449 linux
description:
The hidma_chan_stats function in drivers/dma/qcom/hidma_dbg.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address information by reading "callback=" lines in a debugfs file.


definition_id: oval:org.debian:def:9363947869196154370186448687751613019
title: CVE-2018-20450 r-cran-readxl
description:
The read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2017-2897.


definition_id: oval:org.debian:def:110164900288035483813248541105876227311
title: CVE-2018-20452 r-cran-readxl
description:
The read_MSAT_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, because of inconsistent memory management (new versus free) in ole2_read_header in ole.c.


definition_id: oval:org.debian:def:128055436089577877115166354245508581411
title: CVE-2018-20467 imagemagick
description:
In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:42826494922533142302543083204684435656
title: CVE-2018-20481 poppler
description:
XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.


definition_id: oval:org.debian:def:269255885369873126550351919021164451021
title: CVE-2018-20482 tar
description:
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).


definition_id: oval:org.debian:def:265749119995911789244210374202639128162
title: CVE-2018-20483 wget
description:
set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.


definition_id: oval:org.debian:def:22042675416582270840447308255819641876
title: CVE-2018-20505 sqlite3
description:
SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).


definition_id: oval:org.debian:def:313314561824618153850203779230306546132
title: CVE-2018-20506 sqlite3
description:
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.


definition_id: oval:org.debian:def:323079585852053132473437219896334719647
title: CVE-2018-20509 linux
description:
The print_binder_ref_olocked function in drivers/android/binder.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address information by reading " ref *desc *node" lines in a debugfs file.


definition_id: oval:org.debian:def:73359494407007365460255847115611193090
title: CVE-2018-20510 linux
description:
The print_binder_transaction_ilocked function in drivers/android/binder.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address information by reading "*from *code *flags" lines in a debugfs file.


definition_id: oval:org.debian:def:209305665411890438297605113686894227812
title: CVE-2018-20511 linux
description:
An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in drivers/net/appletalk/ipddp.c allows local users to obtain sensitive kernel address information by leveraging CAP_NET_ADMIN to read the ipddp_route dev and next fields via an SIOCFINDIPDDPRT ioctl call.


definition_id: oval:org.debian:def:57237530314532053280934042746353098137
title: CVE-2018-20544 libcaca
description:
There is floating point exception at caca/dither.c (function caca_dither_bitmap) in libcaca 0.99.beta19.


definition_id: oval:org.debian:def:247468795540991207618491360266250528555
title: CVE-2018-20545 libcaca
description:
There is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99.beta19 for 4bpp data.


definition_id: oval:org.debian:def:328941605224574452111775153031012247461
title: CVE-2018-20546 libcaca
description:
There is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0.99.beta19 for the default bpp case.


definition_id: oval:org.debian:def:144178032821351721868308870572847945951
title: CVE-2018-20547 libcaca
description:
There is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0.99.beta19 for 24bpp data.


definition_id: oval:org.debian:def:327694780882354992427419173673894286591
title: CVE-2018-20548 libcaca
description:
There is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99.beta19 for 1bpp data.


definition_id: oval:org.debian:def:218241838478725318556529548561392343964
title: CVE-2018-20549 libcaca
description:
There is an illegal WRITE memory access at caca/file.c (function caca_file_read) in libcaca 0.99.beta19.


definition_id: oval:org.debian:def:58108513321284331889966292270172028607
title: CVE-2018-20551 poppler
description:
A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to construction of invalid rich media annotation assets in the AnnotRichMedia class in Annot.c.


definition_id: oval:org.debian:def:281225774996729652198205327013151216467
title: CVE-2018-20615 haproxy
description:
An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing of the PRIORITY flag in a HEADERS frame requires 5 extra bytes, and while these bytes are skipped, the total frame length was not re-checked to make sure they were present in the frame.


definition_id: oval:org.debian:def:131042629092933152250897012796035656033
title: CVE-2018-20650 poppler
description:
A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.


definition_id: oval:org.debian:def:59875645420350560194048501401477324675
title: CVE-2018-20662 poppler
description:
In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing.


definition_id: oval:org.debian:def:215004574041672216925463118180697099052
title: CVE-2018-20669 linux
description:
An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Linux kernel through 4.19.13. A local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation.


definition_id: oval:org.debian:def:108113875326956113656828003896488094751
title: CVE-2018-20679 busybox
description:
An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.


definition_id: oval:org.debian:def:163906088054412478766135332525009714651
title: CVE-2018-20681 mate-screensaver
description:
mate-screensaver before 1.20.2 in MATE Desktop Environment allows physically proximate attackers to view screen content and possibly control applications. By unplugging and re-plugging or power-cycling external output devices (such as additionally attached graphical outputs via HDMI, VGA, DVI, etc.) the content of a screensaver-locked session can be revealed. In some scenarios, the attacker can execute applications, such as by clicking with a mouse.


definition_id: oval:org.debian:def:98045804799355404133790507716288228021
title: CVE-2018-20683 gitolite3
description:
commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by triggering use of an option other than -v, -n, -q, or -P.


definition_id: oval:org.debian:def:338564660928287798151040335297584747309
title: CVE-2018-20685 openssh
description:
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.


definition_id: oval:org.debian:def:160073658466420369562430323549026019094
title: CVE-2018-20699 docker.io
description:
Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.


definition_id: oval:org.debian:def:246408182274279733109422884602753174806
title: CVE-2018-20721 uriparser
description:
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.


definition_id: oval:org.debian:def:290287530948520474691421532178925558811
title: CVE-2018-20723 cacti
description:
A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color.


definition_id: oval:org.debian:def:93156194821935596505477721665767907442
title: CVE-2018-20724 cacti
description:
A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.


definition_id: oval:org.debian:def:309844934352915454165344487582878985653
title: CVE-2018-20725 cacti
description:
A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label.


definition_id: oval:org.debian:def:201169891674331057075301519053330266412
title: CVE-2018-20726 cacti
description:
A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.


definition_id: oval:org.debian:def:90291579029672038699035109670680437687
title: CVE-2018-20743 mumble
description:
murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the database, which allows remote attackers to cause a denial of service (daemon hang or crash) via a message flood.


definition_id: oval:org.debian:def:194021482451781203478028664233966211099
title: CVE-2018-20748 libvncserver
description:
LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for CVE-2018-20019 was incomplete.


definition_id: oval:org.debian:def:161404333274969393355190148139603676735
title: CVE-2018-20749 libvncserver
description:
LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.


definition_id: oval:org.debian:def:135107083279204955252860904127804546461
title: CVE-2018-20750 libvncserver
description:
LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.


definition_id: oval:org.debian:def:101442066051715603324351177459136359059
title: CVE-2018-20751 libpodofo
description:
An issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document, pPage->GetObject()->GetDictionary().AddKey(PdfName("MediaBox"),var) can be problematic due to the function GetObject() being called for the pPage NULL pointer object. The value of pPage at this point is 0x0, which causes a NULL pointer dereference.


definition_id: oval:org.debian:def:292796535171012229041694704849766671721
title: CVE-2018-20752 recon-ng
description:
An issue was discovered in Recon-ng before 4.9.5. Lack of validation in the modules/reporting/csv.py file allows CSV injection. More specifically, when a Twitter user possesses an Excel macro for a username, it will not be properly sanitized when exported to a CSV file. This can result in remote code execution for the attacker.


definition_id: oval:org.debian:def:59893773984303575193238305901751951145
title: CVE-2018-20760 gpac
description:
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.


definition_id: oval:org.debian:def:110263626500320954470400489001336547710
title: CVE-2018-20761 gpac
description:
GPAC version 0.7.1 and earlier has a Buffer Overflow vulnerability in the gf_sm_load_init function in scene_manager.c in libgpac_static.a.


definition_id: oval:org.debian:def:326850511294537881835114244479044315128
title: CVE-2018-20762 gpac
description:
GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_multiple_files function in applications/mp4box/fileimport.c when MP4Box is used for a local directory containing crafted filenames.


definition_id: oval:org.debian:def:301093713579745983555837805000265018167
title: CVE-2018-20763 gpac
description:
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of missing szLineConv bounds checking.


definition_id: oval:org.debian:def:139598678945522466129318976597252480977
title: CVE-2018-20781 gnome-keyring
description:
In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.


definition_id: oval:org.debian:def:112682119914812402268851090921174979500
title: CVE-2018-20783 php7.3
description:
In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.


definition_id: oval:org.debian:def:93801382080458511094496078627127834300
title: CVE-2018-20784 linux
description:
In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other impact by inducing a high load.


definition_id: oval:org.debian:def:278504500547233939214564688268894169931
title: CVE-2018-20786 vim
description:
libvterm through 0+bzr726, as used in Vim and other products, mishandles certain out-of-memory conditions, leading to a denial of service (application crash), related to screen.c, state.c, and vterm.c.


definition_id: oval:org.debian:def:15688403670569895412122617359766058786
title: CVE-2018-20800 otrs2
description:
An issue was discovered in Open Ticket Request System (OTRS) 5.0.31 and 6.0.13. Users updating to 6.0.13 (also patchlevel updates) or 5.0.31 (only major updates) will experience data loss in their agent preferences table.


definition_id: oval:org.debian:def:106857688781253420471358495763593298506
title: CVE-2018-20815 qemu
description:
In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.


definition_id: oval:org.debian:def:107182353994449510864769156286899027294
title: CVE-2018-20834 node-tar
description:
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).


definition_id: oval:org.debian:def:224855537343358362605673910526262856386
title: CVE-2018-20839 plymouth
description:
systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.


definition_id: oval:org.debian:def:245840253878867292800125292794930634492
title: CVE-2018-20843 expat
description:
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).


definition_id: oval:org.debian:def:45833667928716521132743091877351020413
title: CVE-2018-20847 openjpeg2
description:
An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow.


definition_id: oval:org.debian:def:163381412042259646096357557259827652
title: CVE-2018-20852 python2.7
description:
http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.


definition_id: oval:org.debian:def:1297844344525096325258329491073424209
title: CVE-2018-20855 linux
description:
An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace.


definition_id: oval:org.debian:def:302443987791426589145045699921917877239
title: CVE-2018-20961 linux
description:
In the Linux kernel before 4.16.4, a double free vulnerability in the f_midi_set_alt function of drivers/usb/gadget/function/f_midi.c in the f_midi driver may allow attackers to cause a denial of service or possibly have unspecified other impact.


definition_id: oval:org.debian:def:304140750685257426224408616735321690198
title: CVE-2018-20969 patch
description:
do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but the ! syntax is specific to ed, and is unrelated to a shell metacharacter.


definition_id: oval:org.debian:def:219232294883779818893357791983046717606
title: CVE-2018-20976 linux
description:
An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists, related to xfs_fs_fill_super failure.


definition_id: oval:org.debian:def:10498319941971554109662662639912508180
title: CVE-2018-21008 linux
description:
An issue was discovered in the Linux kernel before 4.16.7. A use-after-free can be caused by the function rsi_mac80211_detach in the file drivers/net/wireless/rsi/rsi_91x_mac80211.c.


definition_id: oval:org.debian:def:332924791846178353581117489728274999654
title: CVE-2018-21030 jupyter-notebook
description:
Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.


definition_id: oval:org.debian:def:202617051081999799852245733223992151784
title: CVE-2018-21247 libvncserver
description:
An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.


definition_id: oval:org.debian:def:219754965492335209352864890671519880102
title: CVE-2018-21270 node-stringstream
description:
Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).


definition_id: oval:org.debian:def:86925022120741937409607105815440395722
title: CVE-2018-25008 rustc
description:
In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get_mut method. This synchronization issue can be lead to memory safety issues through race conditions.


definition_id: oval:org.debian:def:313186339507963188946628837829304443029
title: CVE-2018-25015 linux
description:
An issue was discovered in the Linux kernel before 4.14.16. There is a use-after-free in net/sctp/socket.c for a held lock after a peel off, aka CID-a0ff660058b8.


definition_id: oval:org.debian:def:41986315077891368868242444047640347260
title: CVE-2018-25018 unrar-nonfree
description:
UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen::ReadNext.


definition_id: oval:org.debian:def:315971975966776075294609927367598909799
title: CVE-2018-25020 linux
description:
The BPF subsystem in the Linux kernel before 4.17 mishandles situations with a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions, leading to an overflow. This affects kernel/bpf/core.c and net/core/filter.c.


definition_id: oval:org.debian:def:272119831843983361250149397558496963163
title: CVE-2018-25021 libtoxcore
description:
The TCP Server module in toxcore before 0.2.8 doesn't free the TCP priority queue under certain conditions, which allows a remote attacker to exhaust the system's memory, causing a denial of service (DoS).


definition_id: oval:org.debian:def:130350665132460304757450847069268585429
title: CVE-2018-25022 libtoxcore
description:
The Onion module in toxcore before 0.2.2 doesn't restrict which packets can be onion-routed, which allows a remote attacker to discover a target user's IP address (when knowing only their Tox Id) by positioning themselves close to target's Tox Id in the DHT for the target to establish an onion connection with the attacker, guessing the target's DHT public key and creating a DHT node with public key close to it, and finally onion-routing a NAT Ping Request to the target, requesting it to ping the just created DHT node.


definition_id: oval:org.debian:def:153085995161275483294142852067995098262
title: CVE-2018-25045 djangorestframework
description:
Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.


definition_id: oval:org.debian:def:184450569717996286244453009680397627093
title: CVE-2018-25047 smarty3
description:
In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.


definition_id: oval:org.debian:def:45492796961962879724139034957725739420
title: CVE-2018-25052 libcatalyst-plugin-session-perl
description:
A vulnerability has been found in Catalyst-Plugin-Session up to 0.40 and classified as problematic. This vulnerability affects the function _load_sessionid of the file lib/Catalyst/Plugin/Session.pm of the component Session ID Handler. The manipulation of the argument sid leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.41 is able to address this issue. The name of the patch is 88d1b599e1163761c9bd53bec53ba078f13e09d4. It is recommended to upgrade the affected component. VDB-216958 is the identifier assigned to this vulnerability.


definition_id: oval:org.debian:def:312933770017513088106952926493703592435
title: CVE-2018-2581 openjfx
description:
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u161, 8u152 and 9.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N).


definition_id: oval:org.debian:def:92951523580652691353671914573443930506
title: CVE-2018-2693 virtualbox-guest-additions-iso
description:
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Guest Additions). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).


definition_id: oval:org.debian:def:301332662786863223440039884395961419621
title: CVE-2018-2941 openjfx
description:
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u181, 8u172 and 10.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).


definition_id: oval:org.debian:def:1710453055274925169551158626967140833
title: CVE-2018-3136 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g. code installed by an administrator). CVSS 3.0 Base Score 3.4 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N).


definition_id: oval:org.debian:def:31528029941599828159553090049318329236
title: CVE-2018-3139 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g. code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).


definition_id: oval:org.debian:def:125676412344714881590275875704961389205
title: CVE-2018-3149 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).


definition_id: oval:org.debian:def:33381889726066307749826189071840227035
title: CVE-2018-3150 openjdk-11
description:
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Utility). The supported version that is affected is Java SE: 11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).


definition_id: oval:org.debian:def:68192384748857769086715466949174608333
title: CVE-2018-3157 openjdk-11
description:
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Sound). The supported version that is affected is Java SE: 11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).


definition_id: oval:org.debian:def:228620771492910082727228331271622281184
title: CVE-2018-3169 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 7u191, 8u182 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g. code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).


definition_id: oval:org.debian:def:37932150689119250037050742490748042598
title: CVE-2018-3180 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JSSE). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSL/TLS to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded, JRockit accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).


definition_id: oval:org.debian:def:292039481277072133874911898947871578687
title: CVE-2018-3209 openjfx
description:
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). The supported version that is affected is Java SE: 8u182. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g. code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).


definition_id: oval:org.debian:def:278385137891390316423061145210648908095
title: CVE-2018-3615 intel-microcode
description:
Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via a side-channel analysis.


definition_id: oval:org.debian:def:313964899923348496248331955201404651258
title: CVE-2018-3620 intel-microcode
description:
Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and a side-channel analysis.


definition_id: oval:org.debian:def:104399619035641189208323876333693617793
title: CVE-2018-3639 intel-microcode
description:
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.


definition_id: oval:org.debian:def:142057437363675344942781353687452380700
title: CVE-2018-3640 intel-microcode
description:
Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis, aka Rogue System Register Read (RSRE), Variant 3a.


definition_id: oval:org.debian:def:112377580713190343792607578504546523986
title: CVE-2018-3646 intel-microcode
description:
Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis.


definition_id: oval:org.debian:def:86327106120230509683314056218401326872
title: CVE-2018-3665 linux
description:
System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel.


definition_id: oval:org.debian:def:327814241151473800173320772730260979909
title: CVE-2018-3693 linux
description:
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a speculative buffer overflow and side-channel analysis.


definition_id: oval:org.debian:def:86113913895050768926201932885198310188
title: CVE-2018-3717 node-connect
description:
connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.


definition_id: oval:org.debian:def:202997520125850284613591232615368510100
title: CVE-2018-3719 node-mixin-deep
description:
mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.


definition_id: oval:org.debian:def:216280328569319941408693504826797759217
title: CVE-2018-3721 node-lodash
description:
lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.


definition_id: oval:org.debian:def:44277713845820373432699986245897606452
title: CVE-2018-3728 node-hoek
description:
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.


definition_id: oval:org.debian:def:12810151314783773230250053717455562465
title: CVE-2018-3740 ruby-sanitize
description:
A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element.


definition_id: oval:org.debian:def:31251110559077968352023340730515814722
title: CVE-2018-3741 ruby-rails-html-sanitizer
description:
There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately.


definition_id: oval:org.debian:def:126174802125770733307878282447535957905
title: CVE-2018-3750 node-deep-extend
description:
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.


definition_id: oval:org.debian:def:229394387642020752594116982953735209236
title: CVE-2018-3760 ruby-sprockets
description:
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.


definition_id: oval:org.debian:def:196046972285419758480351262443378682188
title: CVE-2018-3774 node-url-parse
description:
Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.


definition_id: oval:org.debian:def:293785352822054576951019219072239431062
title: CVE-2018-3836 leptonlib
description:
An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4. A specially crafted gplot rootname argument can cause a command injection resulting in arbitrary code execution. An attacker can provide a malicious path as input to an application that passes attacker data to this function to trigger this vulnerability.


definition_id: oval:org.debian:def:266747162477785605661909321580287104303
title: CVE-2018-3837 libsdl2-image
description:
An exploitable information disclosure vulnerability exists in the PCX image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted PCX image can cause an out-of-bounds read on the heap, resulting in information disclosure . An attacker can display a specially crafted image to trigger this vulnerability.


definition_id: oval:org.debian:def:257552768549293685756967019821778800388
title: CVE-2018-3838 libsdl2-image
description:
An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds read on the heap, resulting in information disclosure. An attacker can display a specially crafted image to trigger this vulnerability.


definition_id: oval:org.debian:def:210880523004747273908335967528399600806
title: CVE-2018-3839 libsdl2-image
description:
An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.


definition_id: oval:org.debian:def:295537661906234327743434058114856864457
title: CVE-2018-3846 cfitsio
description:
In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.


definition_id: oval:org.debian:def:70411724909848523180148506426085222093
title: CVE-2018-3847 cfitsio
description:
Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Specially crafted images parsed via the library, can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.


definition_id: oval:org.debian:def:60704085462465699167856270254531293473
title: CVE-2018-3848 cfitsio
description:
In the ffghbn function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.


definition_id: oval:org.debian:def:257462501688614609922455033152114336758
title: CVE-2018-3849 cfitsio
description:
In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.


definition_id: oval:org.debian:def:84353852458398957228673358218397137511
title: CVE-2018-3968 u-boot
description:
An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack proper FIT signature enforcement, which allows an attacker to bypass U-Boot's verified boot and execute an unsigned kernel, embedded in a legacy image format. To trigger this vulnerability, a local attacker needs to be able to supply the image to boot.


definition_id: oval:org.debian:def:266638359584875159520094371611913982157
title: CVE-2018-3977 libsdl2-image
description:
An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.3. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.


definition_id: oval:org.debian:def:138355779974047714320348610421703025640
title: CVE-2018-4013 liblivemedia
description:
An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library version 0.92. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.


definition_id: oval:org.debian:def:68840327832285915151959787180245908539
title: CVE-2018-4022 mkvtoolnix
description:
A use-after-free vulnerability exists in the way MKVToolNix MKVINFO v25.0.0 handles the MKV (matroska) file format. A specially crafted MKV file can cause arbitrary code execution in the context of the current user.


definition_id: oval:org.debian:def:97223584279419462858703082878377316670
title: CVE-2018-4056 coturn
description:
An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.


definition_id: oval:org.debian:def:157758581088457255486524039469497384603
title: CVE-2018-4058 coturn
description:
An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. This can provide access to other private services running on that host, which can lead to further attacks. An attacker can set up a relay with a loopback address as the peer on an affected TURN server to trigger this vulnerability.


definition_id: oval:org.debian:def:156558167875631250883364894498715001846
title: CVE-2018-4059 coturn
description:
An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server configuration, which can lead to additional attacks. An attacker who can get access to the telnet port can gain administrator access to the TURN server.


definition_id: oval:org.debian:def:113905336893021915443514150281521511074
title: CVE-2018-4088 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. Safari before 11.0.3 is affected. iCloud before 7.3 on Windows is affected. iTunes before 12.7.3 on Windows is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:219065983430743836424345025623748752060
title: CVE-2018-4089 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. Safari before 11.0.3 is affected. tvOS before 11.2.5 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:291618612769240043104554423958214701487
title: CVE-2018-4101 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:76771745546005423771184364466417315761
title: CVE-2018-4113 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves a JavaScriptCore function in the "WebKit" component. It allows attackers to trigger an assertion failure by leveraging improper array indexing.


definition_id: oval:org.debian:def:64892115013902561699757567297070160884
title: CVE-2018-4114 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:136905552727467280489526831266250074498
title: CVE-2018-4117 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. watchOS before 4.3 is affected. The issue involves the fetch API in the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.


definition_id: oval:org.debian:def:298028446917889230406533693001955256424
title: CVE-2018-4133 webkit2gtk
description:
An issue was discovered in certain Apple products. Safari before 11.1 is affected. The issue involves the "WebKit" component. A Safari cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


definition_id: oval:org.debian:def:268899668758225948717079523798847374332
title: CVE-2018-4146 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows attackers to cause a denial of service (memory corruption) via a crafted web site.


definition_id: oval:org.debian:def:296917768589581113489610196404253452826
title: CVE-2018-4180 cups
description:
In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions.


definition_id: oval:org.debian:def:305214496361084612966157133762508763495
title: CVE-2018-4190 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive credential information that is transmitted during a CSS mask-image fetch.


definition_id: oval:org.debian:def:256967049422385667597350137496827641504
title: CVE-2018-4191 webkit2gtk
description:
A memory corruption issue was addressed with improved validation. This issue affected versions prior to iOS 12, tvOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.


definition_id: oval:org.debian:def:278654886936317208921499168145363845223
title: CVE-2018-4192 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages a race condition.


definition_id: oval:org.debian:def:242681729982140373797911969114606190957
title: CVE-2018-4197 webkit2gtk
description:
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.


definition_id: oval:org.debian:def:112285220881662090220950712866131466937
title: CVE-2018-4199 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted web site.


definition_id: oval:org.debian:def:306392998296367752831581433611106344870
title: CVE-2018-4200 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. Safari before 11.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site that triggers a WebCore::jsElementScrollHeightGetter use-after-free.


definition_id: oval:org.debian:def:281980515524293754491857193437495968744
title: CVE-2018-4201 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:222240937207128982893124148320219868100
title: CVE-2018-4204 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.4 is affected. iOS before 11.3.1 is affected. Safari before 11.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:261125303346149828686272018880798168098
title: CVE-2018-4207 webkit2gtk
description:
In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.


definition_id: oval:org.debian:def:79922843415554398868961098902473932350
title: CVE-2018-4210 webkit2gtk
description:
In iOS before 11.3, Safari before 11.1, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, an array indexing issue existed in the handling of a function in javascript core. This issue was addressed with improved checks.


definition_id: oval:org.debian:def:316684770645973874631735413366016553866
title: CVE-2018-4214 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to cause a denial of service (memory corruption and Safari crash) or possibly have unspecified other impact via a crafted web site.


definition_id: oval:org.debian:def:291069605144839929255824883947848127707
title: CVE-2018-4218 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site that triggers an @generatorState use-after-free.


definition_id: oval:org.debian:def:89151417284021738257958559977473798267
title: CVE-2018-4222 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages a getWasmBufferFromValue out-of-bounds read during WebAssembly compilation.


definition_id: oval:org.debian:def:298710508310571191423001695430844363278
title: CVE-2018-4232 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to overwrite cookies via a crafted web site.


definition_id: oval:org.debian:def:77125569967599729070412926190120007514
title: CVE-2018-4246 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages type confusion.


definition_id: oval:org.debian:def:137227958816630028322331975149977826701
title: CVE-2018-4261 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, Safari 11.1.2, iTunes 12.8 for Windows, iCloud for Windows 7.6.


definition_id: oval:org.debian:def:57124397848293420022657508642928948379
title: CVE-2018-4262 webkit2gtk
description:
In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, multiple memory corruption issues were addressed with improved memory handling.


definition_id: oval:org.debian:def:162389654904481235787859548075477067236
title: CVE-2018-4264 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, watchOS 4.3.2, Safari 11.1.2, iTunes 12.8 for Windows, iCloud for Windows 7.6.


definition_id: oval:org.debian:def:323069809058338104524681926060837536224
title: CVE-2018-4266 webkit2gtk
description:
A race condition was addressed with additional validation. This issue affected versions prior toiVersions prior to: OS 11.4.1, tvOS 11.4.1, watchOS 4.3.2, Safari 11.1.2, iTunes 12.8 for Windows, iCloud for Windows 7.6.


definition_id: oval:org.debian:def:14512770951165264507723053727283726038
title: CVE-2018-4270 webkit2gtk
description:
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, watchOS 4.3.2, Safari 11.1.2, iTunes 12.8 for Windows, iCloud for Windows 7.6.


definition_id: oval:org.debian:def:47453757368935866224653966208543718076
title: CVE-2018-4271 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, watchOS 4.3.2, Safari 11.1.2, iTunes 12.8 for Windows, iCloud for Windows 7.6.


definition_id: oval:org.debian:def:122375770526106052382377499073102470269
title: CVE-2018-4278 webkit2gtk
description:
In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, sound fetched through audio elements may be exfiltrated cross-origin. This issue was addressed with improved audio taint tracking.


definition_id: oval:org.debian:def:205218412614187260349985401748725264294
title: CVE-2018-4284 webkit2gtk
description:
A type confusion issue was addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, watchOS 4.3.2, Safari 11.1.2, iTunes 12.8 for Windows, iCloud for Windows 7.6.


definition_id: oval:org.debian:def:5254002431968026273672666305025730833
title: CVE-2018-4299 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.


definition_id: oval:org.debian:def:179117669886931072951772088807267653281
title: CVE-2018-4300 cups
description:
The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.


definition_id: oval:org.debian:def:44831668619805178454383849327971552234
title: CVE-2018-4309 webkit2gtk
description:
A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.


definition_id: oval:org.debian:def:187457242917196772242123685059451441342
title: CVE-2018-4311 webkit2gtk
description:
The issue was addressed by removing origin information. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.


definition_id: oval:org.debian:def:67492778732538070558476209607193947686
title: CVE-2018-4316 webkit2gtk
description:
A memory corruption issue was addressed with improved state management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.


definition_id: oval:org.debian:def:233632703314180348327200823193102655433
title: CVE-2018-4319 webkit2gtk
description:
A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.


definition_id: oval:org.debian:def:74356665182069207557931306224241687509
title: CVE-2018-4323 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.


definition_id: oval:org.debian:def:6215134060778693127199969752906013337
title: CVE-2018-4361 webkit2gtk
description:
A memory consumption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.


definition_id: oval:org.debian:def:215635333612315778610462632015636752679
title: CVE-2018-4372 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.


definition_id: oval:org.debian:def:195054080213289114214942699154830467345
title: CVE-2018-4373 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.


definition_id: oval:org.debian:def:12522910897395685301706640182863758127
title: CVE-2018-4378 webkit2gtk
description:
A memory corruption issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.


definition_id: oval:org.debian:def:283670327444076910842709840107684807149
title: CVE-2018-4437 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.


definition_id: oval:org.debian:def:217853046795759674010487609431494014238
title: CVE-2018-4438 webkit2gtk
description:
A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.


definition_id: oval:org.debian:def:3986188495315206172854188583924930126
title: CVE-2018-4441 webkit2gtk
description:
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.


definition_id: oval:org.debian:def:12727438167907620041259610947756590812
title: CVE-2018-5089 firefox-esr
description:
Memory safety bugs were reported in Firefox 57 and Firefox ESR 52.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.


definition_id: oval:org.debian:def:92638967341438975931445067637670846830
title: CVE-2018-5091 firefox-esr
description:
A use-after-free vulnerability can occur during WebRTC connections when interacting with the DTMF timers. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.6 and Firefox < 58.


definition_id: oval:org.debian:def:337394389058783831036669900425204790512
title: CVE-2018-5095 firefox-esr
description:
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.


definition_id: oval:org.debian:def:38704705324471725454784856361870397496
title: CVE-2018-5096 firefox-esr
description:
A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.6 and Thunderbird < 52.6.


definition_id: oval:org.debian:def:220427840339019040743106604836501876151
title: CVE-2018-5097 firefox-esr
description:
A use-after-free vulnerability can occur during XSL transformations when the source document for the transformation is manipulated by script content during the transformation. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.


definition_id: oval:org.debian:def:131871566134112683226834922876311499745
title: CVE-2018-5098 firefox-esr
description:
A use-after-free vulnerability can occur when form input elements, focus, and selections are manipulated by script content. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.


definition_id: oval:org.debian:def:242410586860675959311802450088425844861
title: CVE-2018-5099 firefox-esr
description:
A use-after-free vulnerability can occur when the widget listener is holding strong references to browser objects that have previously been freed, resulting in a potentially exploitable crash when these references are used. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.


definition_id: oval:org.debian:def:205591838838395072120930436918140905819
title: CVE-2018-5102 firefox-esr
description:
A use-after-free vulnerability can occur when manipulating HTML media elements with media streams, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.


definition_id: oval:org.debian:def:269794796508012994342858947202155642816
title: CVE-2018-5103 firefox-esr
description:
A use-after-free vulnerability can occur during mouse event handling due to issues with multiprocess support. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.


definition_id: oval:org.debian:def:194115570753117531420518423924626530407
title: CVE-2018-5104 firefox-esr
description:
A use-after-free vulnerability can occur during font face manipulation when a font face is freed while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.


definition_id: oval:org.debian:def:319527458311785739288582600438036593849
title: CVE-2018-5117 firefox-esr
description:
If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some circumstances to scroll this text to spoof the displayed URL. This issue could result in the wrong URL being displayed as a location, which can mislead users to believe they are on a different site than the one loaded. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.


definition_id: oval:org.debian:def:64401162989517453903172654667411574223
title: CVE-2018-5125 firefox-esr
description:
Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59.


definition_id: oval:org.debian:def:256719117743719678149910558801399634235
title: CVE-2018-5127 firefox-esr
description:
A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59.


definition_id: oval:org.debian:def:129840973275682493200642823016568662145
title: CVE-2018-5129 firefox-esr
description:
A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in the parent process. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59.


definition_id: oval:org.debian:def:165742302575966536566425335939605689836
title: CVE-2018-5130 firefox-esr
description:
When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially exploitable crash is triggered. This vulnerability affects Firefox ESR < 52.7 and Firefox < 59.


definition_id: oval:org.debian:def:99188343697139854705937947551503394286
title: CVE-2018-5131 firefox-esr
description:
Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header instead of downloading a copy from the network as it should. This can result in previously stored, locally cached data of a website being accessible to users if they share a common profile while browsing. This vulnerability affects Firefox ESR < 52.7 and Firefox < 59.


definition_id: oval:org.debian:def:144648588106422417450100782081402501668
title: CVE-2018-5144 firefox-esr
description:
An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parameter. This vulnerability affects Firefox ESR < 52.7 and Thunderbird < 52.7.


definition_id: oval:org.debian:def:16752855616851260682089744248255084118
title: CVE-2018-5145 firefox-esr
description:
Memory safety bugs were reported in Firefox ESR 52.6. These bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 52.7 and Thunderbird < 52.7.


definition_id: oval:org.debian:def:194210810306448346419584918808952436584
title: CVE-2018-5146 firefox-esr
description:
An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7.


definition_id: oval:org.debian:def:179863143942909125640510179198917924391
title: CVE-2018-5147 firefox-esr
description:
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefox < 59.0.1.


definition_id: oval:org.debian:def:122546727125824877999692916742627750278
title: CVE-2018-5148 firefox-esr
description:
A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.7.3 and Firefox < 59.0.2.


definition_id: oval:org.debian:def:44129336761184241899700207264806412047
title: CVE-2018-5150 firefox-esr
description:
Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.


definition_id: oval:org.debian:def:120774727227605269118892999364953122607
title: CVE-2018-5154 firefox-esr
description:
A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.


definition_id: oval:org.debian:def:221796076837108994281511130783201780638
title: CVE-2018-5155 firefox-esr
description:
A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.


definition_id: oval:org.debian:def:129406576498173625340986067407125520469
title: CVE-2018-5156 firefox-esr
description:
A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result in stream data being cast to the wrong type causing a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.


definition_id: oval:org.debian:def:45174218506245492834173201410380730660
title: CVE-2018-5157 firefox-esr
description:
Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing by an authenticated user on a third-party website. This vulnerability affects Firefox ESR < 52.8 and Firefox < 60.


definition_id: oval:org.debian:def:311536698834245555240946462253605494665
title: CVE-2018-5158 firefox-esr
description:
The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability affects Firefox ESR < 52.8 and Firefox < 60.


definition_id: oval:org.debian:def:291087574476834447668195183703036065634
title: CVE-2018-5159 firefox-esr
description:
An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially exploitable crash triggerable by web content. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.


definition_id: oval:org.debian:def:32769729574160480588527591955225621106
title: CVE-2018-5161 thunderbird
description:
Crafted message headers can cause a Thunderbird process to hang on receiving the message. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.


definition_id: oval:org.debian:def:109045715935772476437305767040372608733
title: CVE-2018-5162 thunderbird
description:
Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.


definition_id: oval:org.debian:def:181663507246920510909747615499116000441
title: CVE-2018-5168 firefox-esr
description:
Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. This could allow a malicious site to install a theme without user interaction which could contain offensive or embarrassing images. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.


definition_id: oval:org.debian:def:228991590626527810890344989622704507937
title: CVE-2018-5170 thunderbird
description:
It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a user opening a remote attachment which is a different file type than expected. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.


definition_id: oval:org.debian:def:219768157679587432753288808256347224329
title: CVE-2018-5178 firefox-esr
description:
A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR < 52.8, Thunderbird < 52.8, and Firefox ESR < 52.8.


definition_id: oval:org.debian:def:269677822934672743698573601954421882237
title: CVE-2018-5183 firefox-esr
description:
Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues including invalid buffer reads and writes during graphic operations. This vulnerability affects Thunderbird ESR < 52.8, Thunderbird < 52.8, and Firefox ESR < 52.8.


definition_id: oval:org.debian:def:139579039817690781825370736005385472394
title: CVE-2018-5184 thunderbird
description:
Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.


definition_id: oval:org.debian:def:287838959729797038884270961922491921749
title: CVE-2018-5185 thunderbird
description:
Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.


definition_id: oval:org.debian:def:219572379438219560105101502388527644355
title: CVE-2018-5187 thunderbird
description:
Memory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.


definition_id: oval:org.debian:def:159930518507873911262802014083403543382
title: CVE-2018-5188 firefox-esr
description:
Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.


definition_id: oval:org.debian:def:86153318755947397113918505034968246252
title: CVE-2018-5205 irssi
description:
When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string.


definition_id: oval:org.debian:def:6708326259471889076007666108218929554
title: CVE-2018-5206 irssi
description:
When the channel topic is set without specifying a sender, Irssi before 1.0.6 may dereference a NULL pointer.


definition_id: oval:org.debian:def:170651205942791382863394925697588882316
title: CVE-2018-5207 irssi
description:
When using an incomplete variable argument, Irssi before 1.0.6 may access data beyond the end of the string.


definition_id: oval:org.debian:def:253615471571871946883242056826864834043
title: CVE-2018-5208 irssi
description:
In Irssi before 1.0.6, a calculation error in the completion code could cause a heap buffer overflow when completing certain strings.


definition_id: oval:org.debian:def:144116443007290921229175632439358865471
title: CVE-2018-5248 imagemagick
description:
In ImageMagick 7.0.7-17 Q16, there is a heap-based buffer over-read in coders/sixel.c in the ReadSIXELImage function, related to the sixel_decode function.


definition_id: oval:org.debian:def:75483724488914415691268709368760440159
title: CVE-2018-5268 opencv
description:
In OpenCV 3.3.1, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cpp when parsing a crafted image file.


definition_id: oval:org.debian:def:232713188755679878459508399347195016141
title: CVE-2018-5269 opencv
description:
In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast.


definition_id: oval:org.debian:def:48351616500576491448622575819362313539
title: CVE-2018-5295 libpodofo
description:
In PoDoFo 0.9.5, there is an integer overflow in the PdfXRefStreamParserObject::ParseStream function (base/PdfXRefStreamParserObject.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.


definition_id: oval:org.debian:def:23981408555488877394336855701831780210
title: CVE-2018-5296 libpodofo
description:
In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PdfParser::ReadXRefSubsection function (base/PdfParser.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.


definition_id: oval:org.debian:def:36345865500632623725812157498489981644
title: CVE-2018-5308 libpodofo
description:
PoDoFo 0.9.5 does not properly validate memcpy arguments in the PdfMemoryOutputStream::Write function (base/PdfOutputStream.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service or possibly unspecified other impact via a crafted pdf file.


definition_id: oval:org.debian:def:84359970904737679658336880355151329561
title: CVE-2018-5309 libpodofo
description:
In PoDoFo 0.9.5, there is an integer overflow in the PdfObjectStreamParserObject::ReadObjectsFromStream function (base/PdfObjectStreamParserObject.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.


definition_id: oval:org.debian:def:275186237666501877187140112816786116164
title: CVE-2018-5332 linux
description:
In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c).


definition_id: oval:org.debian:def:229702278642577671639025016247613215890
title: CVE-2018-5333 linux
description:
In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference.


definition_id: oval:org.debian:def:253572502015361623657886368251273701001
title: CVE-2018-5334 wireshark
description:
In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by correcting the signature timestamp bounds checks.


definition_id: oval:org.debian:def:75004978470759522250793946038483605974
title: CVE-2018-5335 wireshark
description:
In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the WCP dissector could crash. This was addressed in epan/dissectors/packet-wcp.c by validating the available buffer length.


definition_id: oval:org.debian:def:217794326229667765523920648201382591021
title: CVE-2018-5336 wireshark
description:
In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the JSON, XML, NTP, XMPP, and GDB dissectors could crash. This was addressed in epan/tvbparse.c by limiting the recursion depth.


definition_id: oval:org.debian:def:74628671457414458471341926854609196794
title: CVE-2018-5344 linux
description:
In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:267192972107524460114002021587636477892
title: CVE-2018-5345 gcab
description:
A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code via a crafted .cab file.


definition_id: oval:org.debian:def:34909811535403621016341633817993799976
title: CVE-2018-5358 imagemagick
description:
ImageMagick 7.0.7-22 Q16 has memory leaks in the EncodeImageAttributes function in coders/json.c, as demonstrated by the ReadPSDLayersInternal function in coders/psd.c.


definition_id: oval:org.debian:def:166322280629823919797663553378146297823
title: CVE-2018-5360 tiff
description:
LibTIFF before 4.0.6 mishandles the reading of TIFF files, as demonstrated by a heap-based buffer over-read in the ReadTIFFImage function in coders/tiff.c in GraphicsMagick 1.3.27.


definition_id: oval:org.debian:def:35659908497401853548844576246175666168
title: CVE-2018-5378 quagga
description:
The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.


definition_id: oval:org.debian:def:69066906941139183742634448079396791733
title: CVE-2018-5379 quagga
description:
The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code.


definition_id: oval:org.debian:def:271977384090154147678601093156219960865
title: CVE-2018-5380 quagga
description:
The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.


definition_id: oval:org.debian:def:136124347602871598077001328253974928695
title: CVE-2018-5381 quagga
description:
The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial of service.


definition_id: oval:org.debian:def:318560760034130975904422548561870362781
title: CVE-2018-5382 bouncycastle
description:
The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type "BKS-V1" was introduced in 1.49. It should be noted that the use of "BKS-V1" is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.


definition_id: oval:org.debian:def:285245891457825199649189105906142766173
title: CVE-2018-5383 firmware-nonfree
description:
Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.


definition_id: oval:org.debian:def:193980320513077754989644864533284047174
title: CVE-2018-5388 strongswan
description:
In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer underflow, which may lead to resource exhaustion and denial of service while reading from the socket.


definition_id: oval:org.debian:def:195509642305996197209343426152911433595
title: CVE-2018-5390 linux
description:
Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.


definition_id: oval:org.debian:def:4002614127526551609422313661398326175
title: CVE-2018-5391 linux
description:
The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size.


definition_id: oval:org.debian:def:314117221345665428882637780751320792606
title: CVE-2018-5407 openssl
description:
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.


definition_id: oval:org.debian:def:160121542173503283408965885955418818353
title: CVE-2018-5650 lrzip
description:
In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the unzip_match function in runzip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file.


definition_id: oval:org.debian:def:167061551288530181735217945733695482805
title: CVE-2018-5683 qemu
description:
The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation.


definition_id: oval:org.debian:def:78005271647672821321592277317774344432
title: CVE-2018-5685 graphicsmagick
description:
In GraphicsMagick 1.3.27, there is an infinite loop and application hang in the ReadBMPImage function (coders/bmp.c). Remote attackers could leverage this vulnerability to cause a denial of service via an image file with a crafted bit-field mask value.


definition_id: oval:org.debian:def:169825094011793143319396861496720925373
title: CVE-2018-5686 mupdf
description:
In MuPDF 1.12.0, there is an infinite loop vulnerability and application hang in the pdf_parse_array function (pdf/pdf-parse.c) because EOF is not considered. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file.


definition_id: oval:org.debian:def:71531203943479018484141596959334354039
title: CVE-2018-5698 r-cran-haven
description:
libreadstat.a in WizardMac ReadStat 0.1.1 has a heap-based buffer over-read via an unterminated string.


definition_id: oval:org.debian:def:179288757670882468122909559728410738631
title: CVE-2018-5702 transmission
description:
Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.


definition_id: oval:org.debian:def:36977571624225918831299640411386899621
title: CVE-2018-5703 linux
description:
The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.14.11 allows attackers to cause a denial of service (slab out-of-bounds write) or possibly have unspecified other impact via vectors involving TLS.


definition_id: oval:org.debian:def:138751651129347494646103605338516075694
title: CVE-2018-5704 openocd
description:
Open On-Chip Debugger (OpenOCD) 0.10.0 does not block attempts to use HTTP POST for sending data to 127.0.0.1 port 4444, which allows remote attackers to conduct cross-protocol scripting attacks, and consequently execute arbitrary commands, via a crafted web site.


definition_id: oval:org.debian:def:324147308819453107799551907372963522557
title: CVE-2018-5710 krb5
description:
An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function "strlen" is getting a "NULL" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client.


definition_id: oval:org.debian:def:87396193236260663516514497134683044181
title: CVE-2018-5711 libgd2
description:
gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx.


definition_id: oval:org.debian:def:112605868006027915827703944287317178426
title: CVE-2018-5729 krb5
description:
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.


definition_id: oval:org.debian:def:941305730038890048745798362915742609
title: CVE-2018-5730 krb5
description:
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN.


definition_id: oval:org.debian:def:72238156543574583028771961041321089750
title: CVE-2018-5732 isc-dhcp
description:
Failure to properly bounds-check a buffer used for processing DHCP options allows a malicious server (or an entity masquerading as a server) to cause a buffer overflow (and resulting crash) in dhclient by sending a response containing a specially constructed options section. Affects ISC DHCP versions 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0


definition_id: oval:org.debian:def:158081126016398628975619603034550564583
title: CVE-2018-5733 isc-dhcp
description:
A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash. Affects ISC DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0.


definition_id: oval:org.debian:def:35983434779010776043848771001453991755
title: CVE-2018-5735 bind9
description:
The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages from other distributions who did similar backports for the fix for 2017-3137 may also be affected.


definition_id: oval:org.debian:def:14907387629982065219516397309953333599
title: CVE-2018-5738 bind9
description:
Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended (and documented) behavior is that if an operator has not specified a value for the "allow-recursion" setting, it SHOULD default to one of the following: none, if "recursion no;" is set in named.conf; a value inherited from the "allow-query-cache" or "allow-query" settings IF "recursion yes;" (the default for that setting) AND match lists are explicitly set for "allow-query-cache" or "allow-query" (see the BIND9 Administrative Reference Manual section 6.2 for more details); or the intended default of "allow-recursion {localhost; localnets;};" if "recursion yes;" is in effect and no values are explicitly set for "allow-query-cache" or "allow-query". However, because of the regression introduced by change #4777, it is possible when "recursion yes;" is in effect and no match list values are provided for "allow-query-cache" or "allow-query" for the setting of "allow-recursion" to inherit a setting of all hosts from the "allow-query" setting default, improperly permitting recursion to all clients. Affects BIND 9.9.12, 9.10.7, 9.11.3, 9.12.0->9.12.1-P2, the development release 9.13.0, and also releases 9.9.12-S1, 9.10.7-S1, 9.11.3-S1, and 9.11.3-S2 from BIND 9 Supported Preview Edition.


definition_id: oval:org.debian:def:209969779538517133491620778268730722199
title: CVE-2018-5740 bind9
description:
"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2.


definition_id: oval:org.debian:def:86415005392275739314289617779244019840
title: CVE-2018-5741 bind9
description:
To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update request. Unfortunately, some rule types were not initially documented, and when documentation for them was added to the Administrator Reference Manual (ARM) in change #3112, the language that was added to the ARM at that time incorrectly described the behavior of two rule types, krb5-subdomain and ms-subdomain. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. This affects BIND versions prior to BIND 9.11.5 and BIND 9.12.3.


definition_id: oval:org.debian:def:236498268168546423099436655344665298411
title: CVE-2018-5743 bind9
description:
By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of simultaneous connections contained an error which could be exploited to grow the number of simultaneous connections beyond this limit. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.6, 9.12.0 -> 9.12.4, 9.14.0. BIND 9 Supported Preview Edition versions 9.9.3-S1 -> 9.11.5-S3, and 9.11.5-S5. Versions 9.13.0 -> 9.13.7 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5743.


definition_id: oval:org.debian:def:142887797058762642553712536863714796904
title: CVE-2018-5744 bind9
description:
A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected.


definition_id: oval:org.debian:def:163907070163899085473089963116718688713
title: CVE-2018-5745 bind9
description:
"managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys which use an unsupported algorithm. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745.


definition_id: oval:org.debian:def:276873602421339394491532472367997714513
title: CVE-2018-5747 lrzip
description:
In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the ucompthread function (stream.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file.


definition_id: oval:org.debian:def:334727588591215871947086133826990235358
title: CVE-2018-5748 libvirt
description:
qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply.


definition_id: oval:org.debian:def:1754975447902372540656108052193133208
title: CVE-2018-5750 linux
description:
The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain sensitive address information by reading dmesg data from an SBS HC printk call.


definition_id: oval:org.debian:def:291468686712933440715095682626897682695
title: CVE-2018-5764 rsync
description:
The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism.


definition_id: oval:org.debian:def:280942503127986671281761456819783824499
title: CVE-2018-5776 wordpress
description:
WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).


definition_id: oval:org.debian:def:102693230904558747168823471229206827191
title: CVE-2018-5783 libpodofo
description:
In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function (base/PdfVecObjects.h). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file.


definition_id: oval:org.debian:def:263491058164333982736801549896620430816
title: CVE-2018-5784 tiff
description:
In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries.


definition_id: oval:org.debian:def:211481234199648856463740519834511934973
title: CVE-2018-5785 openjpeg2
description:
In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder function (openjp2/j2k.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.


definition_id: oval:org.debian:def:283879501887704854779032608033355913651
title: CVE-2018-5800 libraw
description:
An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.7 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash.


definition_id: oval:org.debian:def:56044143270289762609418288602192287035
title: CVE-2018-5801 libraw
description:
An error within the "LibRaw::unpack()" function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL pointer dereference.


definition_id: oval:org.debian:def:202991239056484304935258347690193220261
title: CVE-2018-5802 libraw
description:
An error within the "kodak_radc_load_raw()" function (internal/dcraw_common.cpp) related to the "buf" variable in LibRaw versions prior to 0.18.7 can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash.


definition_id: oval:org.debian:def:275848574662300401439030785690291994869
title: CVE-2018-5803 linux
description:
In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "_sctp_make_chunk()" function (net/sctp/sm_make_chunk.c) when handling SCTP packets length can be exploited to cause a kernel crash.


definition_id: oval:org.debian:def:208213342009327694035081898863799788790
title: CVE-2018-5804 libraw
description:
A type confusion error within the "identify()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to trigger a division by zero.


definition_id: oval:org.debian:def:49773252696925187361487736561889491950
title: CVE-2018-5805 libraw
description:
A boundary error within the "quicktake_100_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to cause a stack-based buffer overflow and subsequently cause a crash.


definition_id: oval:org.debian:def:198261892620610049342685155296953030284
title: CVE-2018-5806 libraw
description:
An error within the "leaf_hdr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to trigger a NULL pointer dereference.


definition_id: oval:org.debian:def:63733199945292511777720960686720434137
title: CVE-2018-5807 libraw
description:
An error within the "samsung_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash.


definition_id: oval:org.debian:def:8347359662864433537959909025560623430
title: CVE-2018-5808 libraw
description:
An error within the "find_green()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause a stack-based buffer overflow and subsequently execute arbitrary code.


definition_id: oval:org.debian:def:25491180505621552095088946816647258507
title: CVE-2018-5809 libraw
description:
An error within the "LibRaw::parse_exif()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause a stack-based buffer overflow and subsequently execute arbitrary code.


definition_id: oval:org.debian:def:233498501044418092713328456854104230809
title: CVE-2018-5810 libraw
description:
An error within the "rollei_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash.


definition_id: oval:org.debian:def:108162229836269499157693057067374499586
title: CVE-2018-5811 libraw
description:
An error within the "nikon_coolscan_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash.


definition_id: oval:org.debian:def:314018458080095017619603377638632496212
title: CVE-2018-5812 libraw
description:
An error within the "nikon_coolscan_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to trigger a NULL pointer dereference.


definition_id: oval:org.debian:def:195677930374926733263136158272308732053
title: CVE-2018-5813 libraw
description:
An error within the "parse_minolta()" function (dcraw/dcraw.c) in LibRaw versions prior to 0.18.11 can be exploited to trigger an infinite loop via a specially crafted file.


definition_id: oval:org.debian:def:132289254440694443323647906885332123205
title: CVE-2018-5814 linux
description:
In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets.


definition_id: oval:org.debian:def:314939439337807602231566716223740968361
title: CVE-2018-5815 libraw
description:
An integer overflow error within the "parse_qt()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.12 can be exploited to trigger an infinite loop via a specially crafted Apple QuickTime file.


definition_id: oval:org.debian:def:4940730426263206902876234984776953071
title: CVE-2018-5816 libraw
description:
An integer overflow error within the "identify()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.12 can be exploited to trigger a division by zero via specially crafted NOKIARAW file (Note: This vulnerability is caused due to an incomplete fix of CVE-2018-5804).


definition_id: oval:org.debian:def:200260853224662865689552080518387731743
title: CVE-2018-5817 libraw
description:
A type confusion error within the "unpacked_load_raw()" function within LibRaw versions prior to 0.19.1 (internal/dcraw_common.cpp) can be exploited to trigger an infinite loop.


definition_id: oval:org.debian:def:24830970155922157752218136171179775442
title: CVE-2018-5818 libraw
description:
An error within the "parse_rollei()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger an infinite loop.


definition_id: oval:org.debian:def:185173564916574507258507525495180614255
title: CVE-2018-5819 libraw
description:
An error within the "parse_sinar_ia()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU resources.


definition_id: oval:org.debian:def:47527816053973432943941882081622444835
title: CVE-2018-5848 linux
description:
In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.


definition_id: oval:org.debian:def:29988394359537526605381129428115503492
title: CVE-2018-5873 linux
description:
An issue was discovered in the __ns_get_path function in fs/nsfs.c in the Linux kernel before 4.11. Due to a race condition when accessing files, a Use After Free condition can occur. This also affects all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-07-05.


definition_id: oval:org.debian:def:240773029016123041121824540534718056876
title: CVE-2018-5950 mailman
description:
Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.


definition_id: oval:org.debian:def:80071528295063918428333008698893203150
title: CVE-2018-5953 linux
description:
The swiotlb_print_info function in lib/swiotlb.c in the Linux kernel through 4.14.14 allows local users to obtain sensitive address information by reading dmesg data from a "software IO TLB" printk call.


definition_id: oval:org.debian:def:130633199343912534416184061426735920449
title: CVE-2018-5968 jackson-databind
description:
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.


definition_id: oval:org.debian:def:170754492280563480733833956183273609919
title: CVE-2018-5996 p7zip-rar
description:
Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, allows remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.


definition_id: oval:org.debian:def:121147976749168699536088798207720530612
title: CVE-2018-6003 libtasn1-6
description:
An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.


definition_id: oval:org.debian:def:194086719357349721219928438926299653671
title: CVE-2018-6126 firefox-esr
description:
A precision error in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.


definition_id: oval:org.debian:def:239581881336185273492056282199015032164
title: CVE-2018-6187 mupdf
description:
In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the pdf/pdf-write.c file. Remote attackers could leverage the vulnerability to cause a denial of service via a crafted pdf file.


definition_id: oval:org.debian:def:79163680904671561546592067460919102253
title: CVE-2018-6188 python-django
description:
django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.


definition_id: oval:org.debian:def:260874210749771935217556852731229115238
title: CVE-2018-6192 mupdf
description:
In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf-xref.c allows remote attackers to cause a denial of service (segmentation violation and application crash) via a crafted pdf file.


definition_id: oval:org.debian:def:85775161118897165571974026359235481756
title: CVE-2018-6196 w3m
description:
w3m through 0.5.3 is prone to an infinite recursion flaw in HTMLlineproc0 because the feed_table_block_tag function in table.c does not prevent a negative indent value.


definition_id: oval:org.debian:def:13549224272247697884486417330935056429
title: CVE-2018-6198 w3m
description:
w3m through 0.5.3 does not properly handle temporary files when the ~/.w3m directory is unwritable, which allows a local attacker to craft a symlink attack to overwrite arbitrary files.


definition_id: oval:org.debian:def:26861797250231917297278141666617851038
title: CVE-2018-6249 nvidia-graphics-drivers
description:
NVIDIA GPU Display Driver contains a vulnerability in kernel mode layer handler where a NULL pointer dereference may lead to denial of service or potential escalation of privileges.


definition_id: oval:org.debian:def:195486595089910652685355020374647600141
title: CVE-2018-6253 nvidia-graphics-drivers
description:
NVIDIA GPU Display Driver contains a vulnerability in the DirectX and OpenGL Usermode drivers where a specially crafted pixel shader can cause infinite recursion leading to denial of service.


definition_id: oval:org.debian:def:228010419096237939152906310282061316210
title: CVE-2018-6260 nvidia-graphics-drivers
description:
NVIDIA graphics driver contains a vulnerability that may allow access to application data processed on the GPU through a side channel exposed by the GPU performance counters. Local user access is required. This is not a network or remote attack vector.


definition_id: oval:org.debian:def:235915578764897705653132927359545906673
title: CVE-2018-6307 libvncserver
description:
LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.


definition_id: oval:org.debian:def:103189636809317878586971100862150159801
title: CVE-2018-6323 binutils
description:
The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:68634473660482903469936979089862753854
title: CVE-2018-6352 libpodofo
description:
In PoDoFo 0.9.5, there is an Excessive Iteration in the PdfParser::ReadObjectsInternal function of base/PdfParser.cpp. Remote attackers could leverage this vulnerability to cause a denial of service through a crafted pdf file.


definition_id: oval:org.debian:def:242401458337910758633017711545575602224
title: CVE-2018-6360 mpv
description:
mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdl_hook.lua. For example, an av://lavfi:ladspa=file= URL signifies that the product should call dlopen on a shared object file located at an arbitrary local pathname. The issue exists because the product does not consider that youtube-dl can provide a potentially unsafe URL.


definition_id: oval:org.debian:def:158975623000691540257603135390542434581
title: CVE-2018-6381 zziplib
description:
In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.56 there is a segmentation fault caused by invalid memory access in the zzip_disk_fread function (zzip/mmapped.c) because the size variable is not validated against the amount of file->stored data.


definition_id: oval:org.debian:def:199588585844705237148522714898452426706
title: CVE-2018-6392 ffmpeg
description:
The filter_slice function in libavfilter/vf_transpose.c in FFmpeg through 3.4.1 allows remote attackers to cause a denial of service (out-of-array access) via a crafted MP4 file.


definition_id: oval:org.debian:def:124255412962077450299439708495341693532
title: CVE-2018-6405 imagemagick
description:
In the ReadDCMImage function in coders/dcm.c in ImageMagick before 7.0.7-23, each redmap, greenmap, and bluemap variable can be overwritten by a new pointer. The previous pointer is lost, which leads to a memory leak. This allows remote attackers to cause a denial of service.


definition_id: oval:org.debian:def:259060667270643623282622008167889386896
title: CVE-2018-6412 linux
description:
In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands.


definition_id: oval:org.debian:def:138065997406234733950912602996199700085
title: CVE-2018-6459 strongswan
description:
The rsa_pss_params_parse function in libstrongswan/credentials/keys/signature_params.c in strongSwan 5.6.1 allows remote attackers to cause a denial of service via a crafted RSASSA-PSS signature that lacks a mask generation function parameter.


definition_id: oval:org.debian:def:111072897987457800337124642427230893010
title: CVE-2018-6484 zziplib
description:
In ZZIPlib 0.13.67, there is a memory alignment error and bus error in the __zzip_fetch_disk_trailer function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.


definition_id: oval:org.debian:def:278955443372705625833020211080110120203
title: CVE-2018-6485 glibc
description:
An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.


definition_id: oval:org.debian:def:204853761276284471406752258111130216353
title: CVE-2018-6508 puppet-module-puppetlabs-apache
description:
Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability.


definition_id: oval:org.debian:def:117906059719365991036712192094204113168
title: CVE-2018-6519 simplesamlphp
description:
The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerability for fraction-of-seconds data in a timestamp.


definition_id: oval:org.debian:def:292222414575160363463924511152705640895
title: CVE-2018-6520 simplesamlphp
description:
SimpleSAMLphp before 1.15.2 allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL.


definition_id: oval:org.debian:def:159477001169522458247045850788160163748
title: CVE-2018-6521 simplesamlphp
description:
The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in which this allows remote attackers to bypass intended access restrictions.


definition_id: oval:org.debian:def:201790292445370568402477892454800856611
title: CVE-2018-6532 icinga2
description:
An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted (authenticated and unauthenticated) requests, an attacker can exhaust a lot of memory on the server side, triggering the OOM killer.


definition_id: oval:org.debian:def:133886176194362201957919123686918531022
title: CVE-2018-6533 icinga2
description:
An issue was discovered in Icinga 2.x through 2.8.1. By editing the init.conf file, Icinga 2 can be run as root. Following this the program can be used to run arbitrary code as root. This was fixed by no longer using init.conf to determine account information for any root-executed code (a larger issue than CVE-2017-16933).


definition_id: oval:org.debian:def:809836610436438784020810885825322818
title: CVE-2018-6534 icinga2
description:
An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an attacker can cause a NULL pointer dereference, which can cause the product to crash.


definition_id: oval:org.debian:def:230433846494292112587662673393052353629
title: CVE-2018-6535 icinga2
description:
An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can disclose the password to an attacker.


definition_id: oval:org.debian:def:187269994874178630183756900115543457615
title: CVE-2018-6536 icinga2
description:
An issue was discovered in Icinga 2.x through 2.8.1. The daemon creates an icinga2.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for icinga2.pid modification before a root script executes a "kill `cat /pathname/icinga2.pid`" command, as demonstrated by icinga2.init.d.cmake.


definition_id: oval:org.debian:def:236439519607497453043820771119957468244
title: CVE-2018-6540 zziplib
description:
In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address in the zzip_disk_findfirst function of zzip/mmapped.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.


definition_id: oval:org.debian:def:325814619718060051597970837113250875766
title: CVE-2018-6541 zziplib
description:
In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.


definition_id: oval:org.debian:def:243881927986761521037057200048877061898
title: CVE-2018-6543 binutils
description:
In GNU Binutils 2.30, there's an integer overflow in the function load_specific_debug_section() in objdump.c, which results in `malloc()` with 0 size. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:168499295824058261180775632243197585077
title: CVE-2018-6544 mupdf
description:
pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows remote attackers to cause a denial of service via a crafted PDF document.


definition_id: oval:org.debian:def:143967650909352705346867534544308980444
title: CVE-2018-6551 glibc
description:
The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.


definition_id: oval:org.debian:def:219748538191132677214401052753526597425
title: CVE-2018-6553 cups
description:
The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. A local attacker could possibly use this issue to escape confinement. This flaw affects versions prior to 2.2.7-1ubuntu2.1 in Ubuntu 18.04 LTS, prior to 2.2.4-7ubuntu3.1 in Ubuntu 17.10, prior to 2.1.3-4ubuntu0.5 in Ubuntu 16.04 LTS, and prior to 1.7.2-0ubuntu1.10 in Ubuntu 14.04 LTS.


definition_id: oval:org.debian:def:274984533339114872433348560513992726032
title: CVE-2018-6554 linux
description:
Memory leak in the irda_bind function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket.


definition_id: oval:org.debian:def:300855745490159973338902116674559377263
title: CVE-2018-6555 linux
description:
The irda_setsockopt function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket.


definition_id: oval:org.debian:def:146085864063393117128785343743933866081
title: CVE-2018-6556 lxc
description:
lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). Affected releases are LXC: 2.0 versions above and including 2.0.9; 3.0 versions above and including 3.0.0, prior to 3.0.2.


definition_id: oval:org.debian:def:240286826087700920180093573990635152198
title: CVE-2018-6558 fscrypt
description:
The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).


definition_id: oval:org.debian:def:193984037003596365743423324873316923134
title: CVE-2018-6560 flatpak
description:
In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.


definition_id: oval:org.debian:def:185469776447079911802031743467893646383
title: CVE-2018-6594 pycryptodome
description:
lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.


definition_id: oval:org.debian:def:71900296553603351974533635583473451882
title: CVE-2018-6596 django-anymail
description:
webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events.


definition_id: oval:org.debian:def:205809379517739649331855074274437551991
title: CVE-2018-6611 libopenmpt
description:
soundlib/Load_stp.cpp in OpenMPT through 1.27.04.00, and libopenmpt before 0.3.6, has an out-of-bounds read via a malformed STP file.


definition_id: oval:org.debian:def:60729560795276647018942620532451564226
title: CVE-2018-6612 jhead
description:
An integer underflow bug in the process_EXIF function of the exif.c file of jhead 3.00 raises a heap-based buffer over-read when processing a malicious JPEG file, which may allow a remote attacker to cause a denial-of-service attack or unspecified other impact.


definition_id: oval:org.debian:def:331797862805074312104288955803605421765
title: CVE-2018-6616 openjpeg2
description:
In OpenJPEG 2.3.0, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.


definition_id: oval:org.debian:def:103394651632249358657679164219881377064
title: CVE-2018-6621 ffmpeg
description:
The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.


definition_id: oval:org.debian:def:271898837948514865090841353011719221290
title: CVE-2018-6758 uwsgi
description:
The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.


definition_id: oval:org.debian:def:196652064086110206672757892980531598681
title: CVE-2018-6759 binutils
description:
The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, has an unchecked strnlen operation. Remote attackers could leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted ELF file.


definition_id: oval:org.debian:def:333953870488488595206214033899303121702
title: CVE-2018-6764 libvirt
description:
util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module.


definition_id: oval:org.debian:def:228039227824355212058364695748214322246
title: CVE-2018-6767 wavpack
description:
A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.


definition_id: oval:org.debian:def:110366984585245815202603386530357527505
title: CVE-2018-6789 exim4
description:
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.


definition_id: oval:org.debian:def:225404606661174377075227938212872917509
title: CVE-2018-6790 plasma-workspace
description:
An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows remote attackers to discover client IP addresses via a URL in a notification, as demonstrated by the src attribute of an IMG element.


definition_id: oval:org.debian:def:125640195889152044912365724230237504135
title: CVE-2018-6791 plasma-workspace
description:
An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains `` or $() in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary command execution. An example of an offending volume label is "$(touch b)" -- this will create a file called b in the home folder.


definition_id: oval:org.debian:def:171489931077367795427611076703036134753
title: CVE-2018-6794 suricata
description:
Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.


definition_id: oval:org.debian:def:338418685558960128825023484689544651001
title: CVE-2018-6797 perl
description:
An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written.


definition_id: oval:org.debian:def:119041486114209044863363032863932747306
title: CVE-2018-6798 perl
description:
An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.


definition_id: oval:org.debian:def:238001933269156607465851238999206094732
title: CVE-2018-6799 graphicsmagick
description:
The AcquireCacheNexus function in magick/pixel_cache.c in GraphicsMagick before 1.3.28 allows remote attackers to cause a denial of service (heap overwrite) or possibly have unspecified other impact via a crafted image file, because a pixel staging area is not used.


definition_id: oval:org.debian:def:173420089695688224989383486518187994244
title: CVE-2018-6869 zziplib
description:
In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.


definition_id: oval:org.debian:def:93272088778082285827107869875937562790
title: CVE-2018-6871 libreoffice
description:
LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function.


definition_id: oval:org.debian:def:259134784004983895004169891082308644199
title: CVE-2018-6872 binutils
description:
The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment.


definition_id: oval:org.debian:def:99315380299541610156763322795899961149
title: CVE-2018-6912 ffmpeg
description:
The decode_plane function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.


definition_id: oval:org.debian:def:139188549353316211797857702660546788521
title: CVE-2018-6913 perl
description:
Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.


definition_id: oval:org.debian:def:173995801971393819488000292610789399470
title: CVE-2018-6914 ruby2.5
description:
Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.


definition_id: oval:org.debian:def:335895118583720769929895467691193074457
title: CVE-2018-6927 linux
description:
The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a negative wake or requeue value.


definition_id: oval:org.debian:def:316877848785679397921486225589048022779
title: CVE-2018-6942 freetype
description:
An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lead to DoS via a crafted font file.


definition_id: oval:org.debian:def:131364872728239417664954308675766021407
title: CVE-2018-6954 systemd
description:
systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.


definition_id: oval:org.debian:def:157363607310189888677949086449312368367
title: CVE-2018-7032 myrepos
description:
webcheckout in myrepos through 1.20171231 does not sanitize URLs that are passed to git clone, allowing a malicious website operator or a MitM attacker to take advantage of it for arbitrary code execution, as demonstrated by an "ext::sh -c" attack or an option injection attack.


definition_id: oval:org.debian:def:208091645826167897097337795499075181803
title: CVE-2018-7033 slurm-llnl
description:
SchedMD Slurm before 17.02.10 and 17.11.x before 17.11.5 allows SQL Injection attacks against SlurmDBD.


definition_id: oval:org.debian:def:250794216583435289704427367485284014747
title: CVE-2018-7050 irssi
description:
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. A NULL pointer dereference occurs for an "empty" nick.


definition_id: oval:org.debian:def:153716778932918858245261498516814920009
title: CVE-2018-7051 irssi
description:
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. Certain nick names could result in out-of-bounds access when printing theme strings.


definition_id: oval:org.debian:def:199910009365790938751459815455972108056
title: CVE-2018-7052 irssi
description:
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. When the number of windows exceeds the available space, a crash due to a NULL pointer dereference would occur.


definition_id: oval:org.debian:def:32122373526565296984173331386375586643
title: CVE-2018-7053 irssi
description:
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when SASL messages are received in an unexpected order.


definition_id: oval:org.debian:def:221575397814793170252118571940209657756
title: CVE-2018-7054 irssi
description:
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when a server is disconnected during netsplits. NOTE: this issue exists because of an incomplete fix for CVE-2017-7191.


definition_id: oval:org.debian:def:223617219927835767246224334608572739632
title: CVE-2018-7158 nodejs
description:
The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.


definition_id: oval:org.debian:def:44203354668390427380772416568344723574
title: CVE-2018-7159 nodejs
description:
The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.


definition_id: oval:org.debian:def:208668525604165390853666475252232116723
title: CVE-2018-7160 nodejs
description:
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.


definition_id: oval:org.debian:def:220749834692681868515718636419983047869
title: CVE-2018-7161 nodejs
description:
All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.


definition_id: oval:org.debian:def:265586578177292753123790039075353714090
title: CVE-2018-7162 nodejs
description:
All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation.


definition_id: oval:org.debian:def:34704123829432206846752012764874992208
title: CVE-2018-7164 nodejs
description:
Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour.


definition_id: oval:org.debian:def:143105356177941013734256935026421673269
title: CVE-2018-7167 nodejs
description:
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.


definition_id: oval:org.debian:def:296219413464261268785781933162843749560
title: CVE-2018-7170 ntp
description:
ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.


definition_id: oval:org.debian:def:65299808058196498928427215963129504277
title: CVE-2018-7182 ntp
description:
The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10.


definition_id: oval:org.debian:def:216216483514554765215305702086867416013
title: CVE-2018-7183 ntp
description:
Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.


definition_id: oval:org.debian:def:173582850325046950567801931249274912103
title: CVE-2018-7184 ntp
description:
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.


definition_id: oval:org.debian:def:328662636111213647582512909174365301969
title: CVE-2018-7185 ntp
description:
The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association.


definition_id: oval:org.debian:def:197105600779458206027704950214441583754
title: CVE-2018-7186 leptonlib
description:
Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a long string, as demonstrated by the gplotRead and ptaReadStream functions.


definition_id: oval:org.debian:def:308616906250680019705384258822755042554
title: CVE-2018-7191 linux
description:
In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343.


definition_id: oval:org.debian:def:321985991413350162848927118520145381694
title: CVE-2018-7208 binutils
description:
In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not validated, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as demonstrated by objcopy of a COFF object.


definition_id: oval:org.debian:def:245681065395105653943284517381771802268
title: CVE-2018-7225 libvncserver
description:
An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets.


definition_id: oval:org.debian:def:57834806073793685367442236614979198835
title: CVE-2018-7247 leptonlib
description:
An issue was discovered in pixHtmlViewer in prog/htmlviewer.c in Leptonica before 1.75.3. Unsanitized input (rootname) can overflow a buffer, leading potentially to arbitrary code execution or possibly unspecified other impact.


definition_id: oval:org.debian:def:124016831208125656547047045854198199818
title: CVE-2018-7253 wavpack
description:
The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.


definition_id: oval:org.debian:def:180433123634939147223969140685274832924
title: CVE-2018-7254 wavpack
description:
The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.


definition_id: oval:org.debian:def:310999928541578266567536084211038970493
title: CVE-2018-7273 linux
description:
In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls within the function show_floppy in drivers/block/floppy.c. An attacker can read this information from dmesg and use the addresses to find the locations of kernel code and data and bypass kernel security protections such as KASLR.


definition_id: oval:org.debian:def:252744363478528555359420226757479203016
title: CVE-2018-7284 asterisk
description:
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash.


definition_id: oval:org.debian:def:199755498996158372670677249141948451724
title: CVE-2018-7286 asterisk
description:
An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. res_pjsip allows remote authenticated users to crash Asterisk (segmentation fault) by sending a number of SIP INVITE messages on a TCP or TLS connection and then suddenly closing the connection.


definition_id: oval:org.debian:def:159814313181637155282767553452363486611
title: CVE-2018-7320 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the SIGCOMP protocol dissector could crash. This was addressed in epan/dissectors/packet-sigcomp.c by validating operand offsets.


definition_id: oval:org.debian:def:46548968295038919530137333257932690602
title: CVE-2018-7321 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-thrift.c had a large loop that was addressed by not proceeding with dissection after encountering an unexpected type.


definition_id: oval:org.debian:def:226743714414917769852674500514557439250
title: CVE-2018-7322 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-dcm.c had an infinite loop that was addressed by checking for integer wraparound.


definition_id: oval:org.debian:def:283594822917209857545475645661246851782
title: CVE-2018-7323 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-wccp.c had a large loop that was addressed by ensuring that a calculated length was monotonically increasing.


definition_id: oval:org.debian:def:322054781809143607531910489995270881621
title: CVE-2018-7324 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-sccp.c had an infinite loop that was addressed by using a correct integer data type.


definition_id: oval:org.debian:def:138860315537437483254314919236962718782
title: CVE-2018-7325 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-rpki-rtr.c had an infinite loop that was addressed by validating a length field.


definition_id: oval:org.debian:def:234030876990560212680611428356896306440
title: CVE-2018-7326 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-lltd.c had an infinite loop that was addressed by using a correct integer data type.


definition_id: oval:org.debian:def:315119613675057989284456164260536519259
title: CVE-2018-7327 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-openflow_v6.c had an infinite loop that was addressed by validating property lengths.


definition_id: oval:org.debian:def:285458815916844609711007768072471873997
title: CVE-2018-7328 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-usb.c had an infinite loop that was addressed by rejecting short frame header lengths.


definition_id: oval:org.debian:def:17729036809818928152153035571068355487
title: CVE-2018-7329 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-s7comm.c had an infinite loop that was addressed by correcting off-by-one errors.


definition_id: oval:org.debian:def:249461244834798995043879957737344492040
title: CVE-2018-7330 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-thread.c had an infinite loop that was addressed by using a correct integer data type.


definition_id: oval:org.debian:def:62191788429406093185999677290817192710
title: CVE-2018-7331 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-ber.c had an infinite loop that was addressed by validating a length.


definition_id: oval:org.debian:def:238372952052662106295831908128061540706
title: CVE-2018-7332 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-reload.c had an infinite loop that was addressed by validating a length.


definition_id: oval:org.debian:def:291231795606371734145051054601361324382
title: CVE-2018-7333 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-rpcrdma.c had an infinite loop that was addressed by validating a chunk size.


definition_id: oval:org.debian:def:241518337090263243405300710733677474501
title: CVE-2018-7334 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the UMTS MAC dissector could crash. This was addressed in epan/dissectors/packet-umts_mac.c by rejecting a certain reserved value.


definition_id: oval:org.debian:def:27723500549668963044560202229576340520
title: CVE-2018-7335 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the IEEE 802.11 dissector could crash. This was addressed in epan/crypt/airpdcap.c by rejecting lengths that are too small.


definition_id: oval:org.debian:def:242419362582529017523527666185164336815
title: CVE-2018-7336 wireshark
description:
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the FCP protocol dissector could crash. This was addressed in epan/dissectors/packet-fcp.c by checking for a NULL pointer.


definition_id: oval:org.debian:def:336424111901870145037909862956728333452
title: CVE-2018-7337 wireshark
description:
In Wireshark 2.4.0 to 2.4.4, the DOCSIS protocol dissector could crash. This was addressed in plugins/docsis/packet-docsis.c by removing the recursive algorithm that had been used for concatenated PDUs.


definition_id: oval:org.debian:def:291992734173535914989203534434203631952
title: CVE-2018-7409 unixodbc
description:
In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.


definition_id: oval:org.debian:def:175535691469939177816266875326617837684
title: CVE-2018-7417 wireshark
description:
In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the IPMI dissector could crash. This was addressed in epan/dissectors/packet-ipmi-picmg.c by adding support for crafted packets that lack an IPMI header.


definition_id: oval:org.debian:def:57886686208739067971407043823710956857
title: CVE-2018-7418 wireshark
description:
In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the SIGCOMP dissector could crash. This was addressed in epan/dissectors/packet-sigcomp.c by correcting the extraction of the length value.


definition_id: oval:org.debian:def:254406030700433356514110326605927823479
title: CVE-2018-7419 wireshark
description:
In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the NBAP dissector could crash. This was addressed in epan/dissectors/asn1/nbap/nbap.cnf by ensuring DCH ID initialization.


definition_id: oval:org.debian:def:190614665744242715929979215616845162651
title: CVE-2018-7420 wireshark
description:
In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the pcapng file parser could crash. This was addressed in wiretap/pcapng.c by adding a block-size check for sysdig event blocks.


definition_id: oval:org.debian:def:175398587518362087546483010727545403337
title: CVE-2018-7421 wireshark
description:
In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the DMP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-dmp.c by correctly supporting a bounded number of Security Categories for a DMP Security Classification.


definition_id: oval:org.debian:def:304631044753739650370718309173407308847
title: CVE-2018-7435 freexl
description:
An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the freexl::destroy_cell function.


definition_id: oval:org.debian:def:44612693146126727184001897294592902664
title: CVE-2018-7436 freexl
description:
An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a pointer dereference of the parse_SST function.


definition_id: oval:org.debian:def:114564191485648864185591157714497389498
title: CVE-2018-7437 freexl
description:
An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a memcpy call of the parse_SST function.


definition_id: oval:org.debian:def:294952900307434612055368357183028851821
title: CVE-2018-7438 freexl
description:
An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the parse_unicode_string function.


definition_id: oval:org.debian:def:161780144430120914099203255142967987117
title: CVE-2018-7439 freexl
description:
An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the function read_mini_biff_next_record.


definition_id: oval:org.debian:def:186207483996561485717499388860583242264
title: CVE-2018-7440 leptonlib
description:
An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function allows command injection via a $(command) approach in the gplot rootname argument. This issue exists because of an incomplete fix for CVE-2018-3836.


definition_id: oval:org.debian:def:12678152529147592688423862801738501513
title: CVE-2018-7441 leptonlib
description:
Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by creating files in advance or winning a race condition, as demonstrated by /tmp/junk_split_image.ps in prog/splitimage2pdf.c.


definition_id: oval:org.debian:def:197451326125808750058600312487556063232
title: CVE-2018-7442 leptonlib
description:
An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function does not block '/' characters in the gplot rootname argument, potentially leading to path traversal and arbitrary file overwrite.


definition_id: oval:org.debian:def:289944688238016768330563677839956215344
title: CVE-2018-7443 imagemagick
description:
The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-23 Q16 does not properly validate the amount of image data in a file, which allows remote attackers to cause a denial of service (memory allocation failure in the AcquireMagickMemory function in MagickCore/memory.c).


definition_id: oval:org.debian:def:252481725996482066352417251080457229296
title: CVE-2018-7456 tiff
description:
A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)


definition_id: oval:org.debian:def:267103303270648394377095105607715757744
title: CVE-2018-7470 imagemagick
description:
An issue was discovered in ImageMagick 7.0.7-22 Q16. The IsWEBPImageLossless function in coders/webp.c allows attackers to cause a denial of service (segmentation violation) via a crafted file.


definition_id: oval:org.debian:def:340003258741336184949601551829597629340
title: CVE-2018-7480 linux
description:
The blkcg_init_queue function in block/blk-cgroup.c in the Linux kernel before 4.11 allows local users to cause a denial of service (double free) or possibly have unspecified other impact by triggering a creation failure.


definition_id: oval:org.debian:def:280100928922019476536147840471466289167
title: CVE-2018-7489 jackson-databind
description:
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.


definition_id: oval:org.debian:def:323838956189310988107541542769815599739
title: CVE-2018-7490 uwsgi
description:
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.


definition_id: oval:org.debian:def:131822960531201124431156597738133553336
title: CVE-2018-7492 linux
description:
A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function in the Linux kernel before 4.14.7 allowing local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST.


definition_id: oval:org.debian:def:293061400995834922108744173112872543416
title: CVE-2018-7536 python-django
description:
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.


definition_id: oval:org.debian:def:226571230401006248925740023644830384557
title: CVE-2018-7537 python-django
description:
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.


definition_id: oval:org.debian:def:318295966699832498299774591933641667641
title: CVE-2018-7540 xen
description:
An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (host OS CPU hang) via non-preemptable L3/L4 pagetable freeing.


definition_id: oval:org.debian:def:248092099024910017625244335835285107645
title: CVE-2018-7541 xen
description:
An issue was discovered in Xen through 4.10.x allowing guest OS users to cause a denial of service (hypervisor crash) or gain privileges by triggering a grant-table transition from v2 to v1.


definition_id: oval:org.debian:def:149363011893861628685922431950062693012
title: CVE-2018-7542 xen
description:
An issue was discovered in Xen 4.8.x through 4.10.x allowing x86 PVH guest OS users to cause a denial of service (NULL pointer dereference and hypervisor crash) by leveraging the mishandling of configurations that lack a Local APIC.


definition_id: oval:org.debian:def:7104191628722071605248310566847277430
title: CVE-2018-7548 zsh
description:
In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.


definition_id: oval:org.debian:def:166527996284002952967605452805233586534
title: CVE-2018-7549 zsh
description:
In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p.


definition_id: oval:org.debian:def:25438537908900073907210961102123215837
title: CVE-2018-7550 qemu
description:
The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access.


definition_id: oval:org.debian:def:315040488809911635144978539412160870249
title: CVE-2018-7557 ffmpeg
description:
The decode_init function in libavcodec/utvideodec.c in FFmpeg 2.8 through 3.4.2 allows remote attackers to cause a denial of service (Out of array read) via an AVI file with crafted dimensions within chroma subsampling data.


definition_id: oval:org.debian:def:119231347409252569831460445770171568918
title: CVE-2018-7566 linux
description:
The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user.


definition_id: oval:org.debian:def:3493957839906347816820173073700767799
title: CVE-2018-7568 binutils
description:
The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm.


definition_id: oval:org.debian:def:155465698893590967792415959729668004966
title: CVE-2018-7569 binutils
description:
dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer underflow or overflow, and application crash) via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm.


definition_id: oval:org.debian:def:289179661931696133717292735075845232040
title: CVE-2018-7570 binutils
description:
The assign_file_positions_for_non_load_sections function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an ELF file with a RELRO segment that lacks a matching LOAD segment, as demonstrated by objcopy.


definition_id: oval:org.debian:def:147790938529548298995948551312464386865
title: CVE-2018-7588 cimg
description:
An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image.


definition_id: oval:org.debian:def:17849570837983787769759146166525492619
title: CVE-2018-7589 cimg
description:
An issue was discovered in CImg v.220. A double free in load_bmp in CImg.h occurs when loading a crafted bmp image.


definition_id: oval:org.debian:def:268005176041010643778484178728445645899
title: CVE-2018-7637 cimg
description:
An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a "16 colors" case, aka case 4.


definition_id: oval:org.debian:def:49717074294092311330121642434855429486
title: CVE-2018-7638 cimg
description:
An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a "256 colors" case, aka case 8.


definition_id: oval:org.debian:def:318398172377485393883012713072897978595
title: CVE-2018-7639 cimg
description:
An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a "16 bits colors" case, aka case 16.


definition_id: oval:org.debian:def:214827783292114837565834725500829429281
title: CVE-2018-7640 cimg
description:
An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a Monochrome case, aka case 1.


definition_id: oval:org.debian:def:253300955640200563266039431872299457120
title: CVE-2018-7641 cimg
description:
An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a "32 bits colors" case, aka case 32.


definition_id: oval:org.debian:def:334493321816234893627734159259514571969
title: CVE-2018-7642 binutils
description:
The swap_std_reloc_in function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (aout_32_swap_std_reloc_out NULL pointer dereference and application crash) via a crafted ELF file, as demonstrated by objcopy.


definition_id: oval:org.debian:def:328943033794916380149201729083195376839
title: CVE-2018-7643 binutils
description:
The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, as demonstrated by objdump.


definition_id: oval:org.debian:def:14559458406723305329469878200654160121
title: CVE-2018-7644 simplesamlphp
description:
The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key confusion issue.


definition_id: oval:org.debian:def:200194331225787941304532906332022011985
title: CVE-2018-7651 node-ssri
description:
index.js in the ssri module before 5.2.2 for Node.js is prone to a regular expression denial of service vulnerability in strict mode functionality via a long base64 hash string.


definition_id: oval:org.debian:def:252997344583141685381009242728936055575
title: CVE-2018-7685 libzypp
description:
The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download.


definition_id: oval:org.debian:def:248542669257207059456355590752660604458
title: CVE-2018-7711 simplesamlphp
description:
HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This occurs because of a dependency on PHP functionality that interprets a -1 error code as a true boolean value.


definition_id: oval:org.debian:def:76751066734592419550164076711435940059
title: CVE-2018-7725 zziplib
description:
An issue was discovered in ZZIPlib 0.13.68. An invalid memory address dereference was discovered in zzip_disk_fread in mmapped.c. The vulnerability causes an application crash, which leads to denial of service.


definition_id: oval:org.debian:def:52334194797969804651192667419856460001
title: CVE-2018-7726 zziplib
description:
An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.


definition_id: oval:org.debian:def:198909443183585510890877885166473635233
title: CVE-2018-7728 exempi
description:
An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FileHandlers/TIFF_Handler.cpp mishandles a case of a zero length, leading to a heap-based buffer over-read in the MD5Update() function in third-party/zuid/interfaces/MD5.cpp.


definition_id: oval:org.debian:def:310263505609375083958156325600814226232
title: CVE-2018-7729 exempi
description:
An issue was discovered in Exempi through 2.4.4. There is a stack-based buffer over-read in the PostScript_MetaHandler::ParsePSFile() function in XMPFiles/source/FileHandlers/PostScript_Handler.cpp.


definition_id: oval:org.debian:def:158877770649974336810570346262598154707
title: CVE-2018-7730 exempi
description:
An issue was discovered in Exempi through 2.4.4. A certain case of a 0xffffffff length is mishandled in XMPFiles/source/FormatSupport/PSIR_FileWriter.cpp, leading to a heap-based buffer over-read in the PSD_MetaHandler::CacheFileData() function.


definition_id: oval:org.debian:def:192954450223450790202777314608381934122
title: CVE-2018-7731 exempi
description:
An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FormatSupport/WEBP_Support.cpp does not check whether a bitstream has a NULL value, leading to a NULL pointer dereference in the WEBP::VP8XChunk class.


definition_id: oval:org.debian:def:256466310505965012033461426875422834965
title: CVE-2018-7738 util-linux
description:
In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.


definition_id: oval:org.debian:def:307353598903588556287738849689532069092
title: CVE-2018-7740 linux
description:
The resv_map_release function in mm/hugetlb.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (BUG) via a crafted application that makes mmap system calls and has a large pgoff argument to the remap_file_pages system call.


definition_id: oval:org.debian:def:27907635909667094642696654295916070846
title: CVE-2018-7749 python-asyncssh
description:
The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.


definition_id: oval:org.debian:def:180459308371298361385325351901248705420
title: CVE-2018-7750 paramiko
description:
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.


definition_id: oval:org.debian:def:186303104331733947016237968878901492765
title: CVE-2018-7751 ffmpeg
description:
The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file.


definition_id: oval:org.debian:def:198657570742917767644235038509130060084
title: CVE-2018-7752 gpac
description:
GPAC through 0.7.1 has a Buffer Overflow in the gf_media_avc_read_sps function in media_tools/av_parsers.c, a different vulnerability than CVE-2018-1000100.


definition_id: oval:org.debian:def:250511278143221632689586970965326821394
title: CVE-2018-7753 python-bleach
description:
An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.


definition_id: oval:org.debian:def:120981084884728394163136924393286463880
title: CVE-2018-7754 linux
description:
The aoedisk_debugfs_show function in drivers/block/aoe/aoeblk.c in the Linux kernel through 4.16.4rc4 allows local users to obtain sensitive address information by reading "ffree: " lines in a debugfs file.


definition_id: oval:org.debian:def:213543120502395466510365886381143138412
title: CVE-2018-7755 linux
description:
An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR.


definition_id: oval:org.debian:def:27476880322155591741181086115326198717
title: CVE-2018-7757 linux
description:
Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file.


definition_id: oval:org.debian:def:55157255526705964044411104805319328533
title: CVE-2018-7858 qemu
description:
Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.


definition_id: oval:org.debian:def:172935336242046920622804106771290168655
title: CVE-2018-7889 calibre
description:
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.


definition_id: oval:org.debian:def:267648379212894658998467260366958481557
title: CVE-2018-7995 linux
description:
** DISPUTED ** Race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval file in a /sys/devices/system/machinecheck/machinecheck<cpu number> directory. NOTE: a third party has indicated that this report is not security relevant.


definition_id: oval:org.debian:def:149855123224052383221310964429238610859
title: CVE-2018-7998 vips
description:
In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.


definition_id: oval:org.debian:def:112750280441019529969656355942695605047
title: CVE-2018-7999 graphite2
description:
In libgraphite2 in graphite2 1.3.11, a NULL pointer dereference vulnerability was found in Segment.cpp during a dumbRendering operation, which may allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .ttf file.


definition_id: oval:org.debian:def:72039934823324037338543963304150621830
title: CVE-2018-8001 libpodofo
description:
In PoDoFo 0.9.5, there exists a heap-based buffer over-read vulnerability in UnescapeName() in PdfName.cpp. Remote attackers could leverage this vulnerability to cause a denial-of-service or possibly unspecified other impact via a crafted pdf file.


definition_id: oval:org.debian:def:288333466225774887351433052886915453953
title: CVE-2018-8004 trafficserver
description:
There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.


definition_id: oval:org.debian:def:255000967315854717566631123103194666424
title: CVE-2018-8005 trafficserver
description:
When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.


definition_id: oval:org.debian:def:73242961539866536069375682624620928622
title: CVE-2018-8006 activemq
description:
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.


definition_id: oval:org.debian:def:274323948232165928530880705951518393825
title: CVE-2018-8011 apache2
description:
By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).


definition_id: oval:org.debian:def:161733080624824986513061757641962799596
title: CVE-2018-8012 zookeeper
description:
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.


definition_id: oval:org.debian:def:200799474192777306278755258158213814824
title: CVE-2018-8013 batik
description:
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.


definition_id: oval:org.debian:def:58792307333295151736591819117432671786
title: CVE-2018-8017 tika
description:
In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.


definition_id: oval:org.debian:def:169362694975928144066173908060918437049
title: CVE-2018-8019 tomcat-native
description:
When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.


definition_id: oval:org.debian:def:315436838846058963460644979143895225767
title: CVE-2018-8020 tomcat-native
description:
Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses. Subsequently, revoked client certificates may not be properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS. Users not using OCSP checks are not affected by this vulnerability.


definition_id: oval:org.debian:def:322784335294564249368268773848899054941
title: CVE-2018-8022 trafficserver
description:
A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions.


definition_id: oval:org.debian:def:83287645062965518786819458307943519825
title: CVE-2018-8032 axis
description:
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.


definition_id: oval:org.debian:def:175377094700263292130336080076228443443
title: CVE-2018-8036 libpdfbox-java
description:
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.


definition_id: oval:org.debian:def:142664345632267830800603070437344972078
title: CVE-2018-8040 trafficserver
description:
Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache Traffic Server (ATS) versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.


definition_id: oval:org.debian:def:95758223604586427487095595394259287296
title: CVE-2018-8043 linux
description:
The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c in the Linux kernel through 4.15.8 does not validate certain resource availability, which allows local users to cause a denial of service (NULL pointer dereference).


definition_id: oval:org.debian:def:310929688903881059358789862467637071162
title: CVE-2018-8048 ruby-loofah
description:
In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.


definition_id: oval:org.debian:def:316334257110546789417628222865385518432
title: CVE-2018-8050 afflib
description:
The af_get_page() function in lib/afflib_pages.cpp in AFFLIB (aka AFFLIBv3) through 3.7.16 allows remote attackers to cause a denial of service (segmentation fault) via a corrupt AFF image that triggers an unexpected pagesize value.


definition_id: oval:org.debian:def:247177335825475582959207764381606782724
title: CVE-2018-8087 linux
description:
Memory leak in the hwsim_new_radio_nl function in drivers/net/wireless/mac80211_hwsim.c in the Linux kernel through 4.15.9 allows local users to cause a denial of service (memory consumption) by triggering an out-of-array error case.


definition_id: oval:org.debian:def:100489370707866204529793921905343347916
title: CVE-2018-8088 libslf4j-java
description:
org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.


definition_id: oval:org.debian:def:137224207984159496146593222219866036352
title: CVE-2018-8098 libgit2
description:
Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in libgit2 before v0.26.2 allows an attacker to cause a denial of service (out-of-bounds read) via a crafted repository index file.


definition_id: oval:org.debian:def:109494479185944876583327710401983408369
title: CVE-2018-8099 libgit2
description:
Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a denial of service via a crafted repository index file.


definition_id: oval:org.debian:def:233219130040069278024299723197491405884
title: CVE-2018-8740 sqlite3
description:
In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.


definition_id: oval:org.debian:def:169174716123255681509765366042845216266
title: CVE-2018-8754 libevt
description:
** DISPUTED ** The libevt_record_values_read_event() function in libevt_record_values.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub.


definition_id: oval:org.debian:def:254132440448793773935650680060776017249
title: CVE-2018-8768 ipython
description:
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.


definition_id: oval:org.debian:def:212648608508028699208514353505569964483
title: CVE-2018-8777 ruby2.5
description:
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).


definition_id: oval:org.debian:def:41135050516582827857170894670339640284
title: CVE-2018-8778 ruby2.5
description:
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.


definition_id: oval:org.debian:def:74959013636162805020725483367099372526
title: CVE-2018-8779 ruby2.5
description:
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket.


definition_id: oval:org.debian:def:155866045387474567288360966527178606779
title: CVE-2018-8780 ruby2.5
description:
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.


definition_id: oval:org.debian:def:106695637787180275409487035000047572637
title: CVE-2018-8781 linux
description:
The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel version 3.4 and up to and including 4.15 has an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space.


definition_id: oval:org.debian:def:156351738035155777306047773067880626554
title: CVE-2018-8784 freerdp2
description:
FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress_segment() that results in a memory corruption and probably even a remote code execution.


definition_id: oval:org.debian:def:160343369007260228813383905807184751092
title: CVE-2018-8785 freerdp2
description:
FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress() that results in a memory corruption and probably even a remote code execution.


definition_id: oval:org.debian:def:167760059774273612734221984817612638199
title: CVE-2018-8786 freerdp2
description:
FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code execution.


definition_id: oval:org.debian:def:230593008222640417552077950138854027713
title: CVE-2018-8787 freerdp2
description:
FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_Decompress() and results in a memory corruption and probably even a remote code execution.


definition_id: oval:org.debian:def:267562135787963609283804300321706482504
title: CVE-2018-8788 freerdp2
description:
FreeRDP prior to version 2.0.0-rc4 contains an Out-Of-Bounds Write of up to 4 bytes in function nsc_rle_decode() that results in a memory corruption and possibly even a remote code execution.


definition_id: oval:org.debian:def:329130447562085080572983373505518038580
title: CVE-2018-8789 freerdp2
description:
FreeRDP prior to version 2.0.0-rc4 contains several Out-Of-Bounds Reads in the NTLM Authentication module that results in a Denial of Service (segfault).


definition_id: oval:org.debian:def:144432126766047374272119999705917287646
title: CVE-2018-8791 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpdr_process() that results in an information leak.


definition_id: oval:org.debian:def:196685452468086120437658914886115588632
title: CVE-2018-8792 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function cssp_read_tsrequest() that results in a Denial of Service (segfault).


definition_id: oval:org.debian:def:144118393296438614763334174820124604948
title: CVE-2018-8793 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function cssp_read_tsrequest() that results in a memory corruption and probably even a remote code execution.


definition_id: oval:org.debian:def:262673464604018254899124954817537737361
title: CVE-2018-8794 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to an Out-Of-Bounds Write in function process_bitmap_updates() and results in a memory corruption and possibly even a remote code execution.


definition_id: oval:org.debian:def:121914986712310123727340426645907333693
title: CVE-2018-8795 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in function process_bitmap_updates() and results in a memory corruption and probably even a remote code execution.


definition_id: oval:org.debian:def:166689517400816079101315409679078684951
title: CVE-2018-8796 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_bitmap_updates() that results in a Denial of Service (segfault).


definition_id: oval:org.debian:def:153197859490431488548163485527985657985
title: CVE-2018-8797 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function process_plane() that results in a memory corruption and probably even a remote code execution.


definition_id: oval:org.debian:def:239510900678516139332751176747253715356
title: CVE-2018-8798 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpsnd_process_ping() that results in an information leak.


definition_id: oval:org.debian:def:40858796843870789345831438698863080883
title: CVE-2018-8799 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_secondary_order() that results in a Denial of Service (segfault).


definition_id: oval:org.debian:def:51700145042038279613876900938877207977
title: CVE-2018-8800 rdesktop
description:
rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function ui_clip_handle_data() that results in a memory corruption and probably even a remote code execution.


definition_id: oval:org.debian:def:95678510799002783640528398632173793696
title: CVE-2018-8804 imagemagick
description:
WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:23802710056277203491551211228907042985
title: CVE-2018-8822 linux
description:
Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in the Linux kernel through 4.15.11, and in drivers/staging/ncpfs/ncplib_kernel.c in the Linux kernel 4.16-rc through 4.16-rc6, could be exploited by malicious NCPFS servers to crash the kernel or execute code.


definition_id: oval:org.debian:def:150575274633859595342237808610757281345
title: CVE-2018-8828 kamailio
description:
A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap-based buffer overflow in the tmx_check_pretran function in modules/tmx/tmx_pretran.c.


definition_id: oval:org.debian:def:255843418080981381330089144034749649834
title: CVE-2018-8881 nasm
description:
Netwide Assembler (NASM) 2.13.02rc2 has a heap-based buffer over-read in the function tokenize in asm/preproc.c, related to an unterminated string.


definition_id: oval:org.debian:def:163321000823076750299491883732158908299
title: CVE-2018-8882 nasm
description:
Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.


definition_id: oval:org.debian:def:274003866915349993475385353338524614000
title: CVE-2018-8883 nasm
description:
Netwide Assembler (NASM) 2.13.02rc2 has a buffer over-read in the parse_line function in asm/parser.c via uncontrolled access to nasm_reg_flags.


definition_id: oval:org.debian:def:110853753377788543075901419612040607338
title: CVE-2018-8897 linux
description:
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.


definition_id: oval:org.debian:def:320466207899385559954968958735704130714
title: CVE-2018-8905 tiff
description:
In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps.


definition_id: oval:org.debian:def:309228307239314846158952260627230141440
title: CVE-2018-8945 binutils
description:
The bfd_section_from_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (segmentation fault) via a large attribute section.


definition_id: oval:org.debian:def:102863990027204652779899705510092506286
title: CVE-2018-8960 imagemagick
description:
The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-26 Q16 does not properly restrict memory allocation, leading to a heap-based buffer over-read.


definition_id: oval:org.debian:def:205604151323410562456067561151607332721
title: CVE-2018-8976 exiv2
description:
In Exiv2 0.26, jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringFormat out-of-bounds read) via a crafted file.


definition_id: oval:org.debian:def:19964879263549625793444280127646924590
title: CVE-2018-9018 graphicsmagick
description:
In GraphicsMagick 1.3.28, there is a divide-by-zero in the ReadMNGImage function of coders/png.c. Remote attackers could leverage this vulnerability to cause a crash and denial of service via a crafted mng file.


definition_id: oval:org.debian:def:184075962675369633853790891662885513975
title: CVE-2018-9058 lrzip
description:
In Long Range Zip (aka lrzip) 0.631, there is an infinite loop in the runzip_fd function of runzip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file.


definition_id: oval:org.debian:def:266288021316891714323438751472192972716
title: CVE-2018-9127 botan
description:
Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character.


definition_id: oval:org.debian:def:96431122715869685345870794239063200582
title: CVE-2018-9133 imagemagick
description:
ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file.


definition_id: oval:org.debian:def:240037858134823637419905454155744330333
title: CVE-2018-9135 imagemagick
description:
In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.


definition_id: oval:org.debian:def:159088775139249435335672932620481466770
title: CVE-2018-9234 gnupg2
description:
GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.


definition_id: oval:org.debian:def:144614972016359594512565230928927742534
title: CVE-2018-9240 ncmpc
description:
ncmpc through 0.29 is prone to a NULL pointer dereference flaw. If a user uses the chat screen and another client sends a long chat message, a crash and denial of service could occur.


definition_id: oval:org.debian:def:209394224368954404717227982291412960614
title: CVE-2018-9246 libpgobject-util-dbadmin-perl
description:
The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create(), run_file(), backup(), or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.


definition_id: oval:org.debian:def:281059182336719978255608241050615775300
title: CVE-2018-9256 wireshark
description:
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the LWAPP dissector could crash. This was addressed in epan/dissectors/packet-lwapp.c by limiting the encapsulation levels to restrict the recursion depth.


definition_id: oval:org.debian:def:168107067358699647780688784489868920985
title: CVE-2018-9257 wireshark
description:
In Wireshark 2.4.0 to 2.4.5, the CQL dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-cql.c by checking for a nonzero number of columns.


definition_id: oval:org.debian:def:113746143941003249866168169172296610118
title: CVE-2018-9258 wireshark
description:
In Wireshark 2.4.0 to 2.4.5, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by preserving valid data sources.


definition_id: oval:org.debian:def:240519458758458864575086052514875385434
title: CVE-2018-9259 wireshark
description:
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the MP4 dissector could crash. This was addressed in epan/dissectors/file-mp4.c by restricting the box recursion depth.


definition_id: oval:org.debian:def:51233015241470981693595667824138997362
title: CVE-2018-9260 wireshark
description:
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the IEEE 802.15.4 dissector could crash. This was addressed in epan/dissectors/packet-ieee802154.c by ensuring that an allocation step occurs.


definition_id: oval:org.debian:def:822906396649326920458799271068410847
title: CVE-2018-9261 wireshark
description:
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the NBAP dissector could crash with a large loop that ends with a heap-based buffer overflow. This was addressed in epan/dissectors/packet-nbap.c by prohibiting the self-linking of DCH-IDs.


definition_id: oval:org.debian:def:219101670581364400589368245794533468546
title: CVE-2018-9262 wireshark
description:
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the VLAN dissector could crash. This was addressed in epan/dissectors/packet-vlan.c by limiting VLAN tag nesting to restrict the recursion depth.


definition_id: oval:org.debian:def:321736301073400138193340281906241625380
title: CVE-2018-9263 wireshark
description:
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the Kerberos dissector could crash. This was addressed in epan/dissectors/packet-kerberos.c by ensuring a nonzero key length.


definition_id: oval:org.debian:def:329070088368864257315021861156753702218
title: CVE-2018-9264 wireshark
description:
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the ADB dissector could crash with a heap-based buffer overflow. This was addressed in epan/dissectors/packet-adb.c by checking for a length inconsistency.


definition_id: oval:org.debian:def:337903473540140023153282024923867579944
title: CVE-2018-9271 wireshark
description:
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-multipart.c has a memory leak.


definition_id: oval:org.debian:def:109105396275036174610510182226869022450
title: CVE-2018-9275 yubico-pam
description:
In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through 2.25, successful logins can leak file descriptors to the auth mapping file, which can lead to information disclosure (serial number of a device) and/or DoS (reaching the maximum number of file descriptors).


definition_id: oval:org.debian:def:176447549716693230849928760718622761077
title: CVE-2018-9363 linux
description:
In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds write with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-65853588 References: Upstream kernel.


definition_id: oval:org.debian:def:240049122721435279140777161117009000453
title: CVE-2018-9385 linux
description:
In driver_override_store of bus.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-74128061 References: Upstream kernel.


definition_id: oval:org.debian:def:227929509664909333723816810975970998678
title: CVE-2018-9415 linux
description:
In driver_override_store and driver_override_show of bus.c, there is a possible double free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-69129004 References: Upstream kernel.


definition_id: oval:org.debian:def:110887832179277155209616088917766873567
title: CVE-2018-9422 linux
description:
In get_futex_key of futex.c, there is a use-after-free due to improper locking. This could lead to local escalation of privilege with no additional privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-74250718 References: Upstream kernel.


definition_id: oval:org.debian:def:98978995898607149328444762591850799685
title: CVE-2018-9465 linux
description:
In task_get_unused_fd_flags of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-69164715 References: Upstream kernel.


definition_id: oval:org.debian:def:241466233786193283937397526210287326414
title: CVE-2018-9516 linux
description:
In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-71361580.


definition_id: oval:org.debian:def:29297166047335908629759755513220723423
title: CVE-2018-9517 linux
description:
In pppol2tp_connect, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-38159931.


definition_id: oval:org.debian:def:103371370017213729885149669838001538588
title: CVE-2018-9518 linux
description:
In nfc_llcp_build_sdreq_tlv of llcp_commands.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-73083945.


definition_id: oval:org.debian:def:244217887777140690812476495960953161870
title: CVE-2018-9568 linux
description:
In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-113509306. References: Upstream kernel.


definition_id: oval:org.debian:def:40185117020379368743529426656708693697
title: CVE-2018-9838 ocaml
description:
The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object.


definition_id: oval:org.debian:def:53401880822424110294669436945797470432
title: CVE-2018-9841 ffmpeg
description:
The export function in libavfilter/vf_signature.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a long filename.


definition_id: oval:org.debian:def:227448745794271847994409650236304124946
title: CVE-2018-9846 roundcube
description:
In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.


definition_id: oval:org.debian:def:19952303115507570816106739657940505155
title: CVE-2018-9860 botan
description:
An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext could cause the receiving side to include in the HMAC computation exactly 64K bytes of data following the record buffer, aka an over-read. The MAC comparison will subsequently fail and the connection will be closed. This could be used for denial of service. No information leak occurs.


definition_id: oval:org.debian:def:43504712337042551438607388574065081209
title: CVE-2018-9918 qpdf
description:
libqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key but found non-name object" cases, allowing remote attackers to cause a denial of service (stack exhaustion), related to the QPDFObjectHandle and QPDF_Dictionary classes, because nesting in direct objects is not restricted.


definition_id: oval:org.debian:def:70377615960093617053265216773726266753
title: CVE-2018-9988 mbedtls
description:
ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.


definition_id: oval:org.debian:def:262992424968350872831723672953732681547
title: CVE-2018-9989 mbedtls
description:
ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input.


definition_id: oval:org.debian:def:287244298087616963160784673576272687515
title: CVE-2019-0053 inetutils
description:
Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffer overflows, which can be exploited to bypass veriexec restrictions on Junos OS. A stack-based overflow is present in the handling of environment variables when connecting via the telnet client to remote telnet servers. This issue only affects the telnet client — accessible from the CLI or shell — in Junos OS. Inbound telnet services are not affected by this issue. This issue affects: Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions prior to 14.1X53-D130, 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D170; 15.1X53 versions prior to 15.1X53-D237, 15.1X53-D496, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S11, 16.1R7-S4; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S4; 17.4 versions prior to 17.4R1-S6, 17.4R2-S3, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R1-S5, 18.2R2-S2, 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3, 18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2.


definition_id: oval:org.debian:def:51578821623923895610460459473510312299
title: CVE-2019-0136 linux
description:
Insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver before version 21.10 may allow an unauthenticated user to potentially enable denial of service via adjacent access.


definition_id: oval:org.debian:def:20136082596207874695969532293753199748
title: CVE-2019-0145 linux
description:
Buffer overflow in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable an escalation of privilege via local access.


definition_id: oval:org.debian:def:235562918687422532707928500274874525351
title: CVE-2019-0146 linux
description:
Resource leak in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 2.8.43 may allow an authenticated user to potentially enable a denial of service via local access.


definition_id: oval:org.debian:def:59404037208517675487700733057442694623
title: CVE-2019-0147 linux
description:
Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access.


definition_id: oval:org.debian:def:102897180526983991229711406363758225313
title: CVE-2019-0148 linux
description:
Resource leak in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access.


definition_id: oval:org.debian:def:285804017909204981150453855697222261812
title: CVE-2019-0149 linux
description:
Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 2.8.43 may allow an authenticated user to potentially enable a denial of service via local access.


definition_id: oval:org.debian:def:47541910835453408896625237031440754910
title: CVE-2019-0160 edk2
description:
Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access.


definition_id: oval:org.debian:def:158051212426411335327311873353132112661
title: CVE-2019-0161 edk2
description:
Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.


definition_id: oval:org.debian:def:292218648853577489341742842250135774476
title: CVE-2019-0190 apache2
description:
A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.


definition_id: oval:org.debian:def:86822284064281262092669809085797056545
title: CVE-2019-0193 lucene-solr
description:
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.


definition_id: oval:org.debian:def:114406566330628737612480702478534110929
title: CVE-2019-0196 apache2
description:
A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.


definition_id: oval:org.debian:def:264011619377341170881119085993202980050
title: CVE-2019-0197 apache2
description:
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.


definition_id: oval:org.debian:def:146800756173870655583170414664572244578
title: CVE-2019-0199 tomcat9
description:
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.


definition_id: oval:org.debian:def:75119788483757117443098122282383813301
title: CVE-2019-0201 zookeeper
description:
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.


definition_id: oval:org.debian:def:74474041643317843905786668841264541495
title: CVE-2019-0211 apache2
description:
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.


definition_id: oval:org.debian:def:213956177661280238263380083803620477519
title: CVE-2019-0215 apache2
description:
In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.


definition_id: oval:org.debian:def:147489634544217051049886924156971803872
title: CVE-2019-0217 apache2
description:
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.


definition_id: oval:org.debian:def:287786807147675581389581575343517325419
title: CVE-2019-0220 apache2
description:
A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.


definition_id: oval:org.debian:def:113961013928007886677394405690904383496
title: CVE-2019-0221 tomcat9
description:
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.


definition_id: oval:org.debian:def:309386116758438146205049948404509143698
title: CVE-2019-0222 mqtt-client
description:
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.


definition_id: oval:org.debian:def:78594845289776995620625742213292191240
title: CVE-2019-0223 qpid-proton
description:
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.


definition_id: oval:org.debian:def:39809170537071444477787328487495431296
title: CVE-2019-0804 waagent
description:
An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent Information Disclosure Vulnerability'.


definition_id: oval:org.debian:def:88868342865248879637974926112815520797
title: CVE-2019-0816 cloud-init
description:
A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'.


definition_id: oval:org.debian:def:50627945238386765584476435177113046866
title: CVE-2019-1000007 python-aioxmpp
description:
aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, rollback during error processing, aioxmpp.xso.model.guard function that can result in Denial of Service, Other. This attack appears to be exploitable via Remote. A crafted stanza can be sent to an application which uses the vulnerable components to either inject data in a different context or cause the application to reconnect (potentially losing data). This vulnerability appears to have been fixed in 0.10.3.


definition_id: oval:org.debian:def:143159034675990291416049148141664630718
title: CVE-2019-1000016 ffmpeg
description:
FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in after commit b97a4b658814b2de8b9f2a3bce491c002d34de31.


definition_id: oval:org.debian:def:329679644343725911908904376682714215020
title: CVE-2019-1000019 libarchive
description:
libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.


definition_id: oval:org.debian:def:20851070286685133164532184843169903433
title: CVE-2019-1000020 libarchive
description:
libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file.


definition_id: oval:org.debian:def:217121631816491956546343831960176412187
title: CVE-2019-1000021 slixmpp
description:
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.


definition_id: oval:org.debian:def:222984236481932311000445802656229510695
title: CVE-2019-10018 poppler
description:
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpIdiv case.


definition_id: oval:org.debian:def:230874339706684701865077531613156019686
title: CVE-2019-10061 node-opencv
description:
utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.


definition_id: oval:org.debian:def:233464113243373907732399286541246659922
title: CVE-2019-10063 flatpak
description:
Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.


definition_id: oval:org.debian:def:304856802752278288677573972343905850302
title: CVE-2019-10064 wpa
description:
hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.


definition_id: oval:org.debian:def:99234446644916953214583397307865896826
title: CVE-2019-10066 otrs2
description:
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentCalendar 5.0.x through 5.0.12. An attacker who is logged into OTRS as an agent with appropriate permissions may create a carefully crafted calendar appointment in order to cause execution of JavaScript in the context of OTRS.


definition_id: oval:org.debian:def:261527573922591708128991350916697657566
title: CVE-2019-10067 otrs2
description:
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context of OTRS.


definition_id: oval:org.debian:def:17218049849430591447547485549507787890
title: CVE-2019-10079 trafficserver
description:
Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using the HTTP/2 protocol. Users should upgrade to Apache Traffic Server 7.1.7, 8.0.4, or later versions.


definition_id: oval:org.debian:def:320672850943598133919367470826449016394
title: CVE-2019-1010004 sox
description:
SoX - Sound eXchange 14.4.2 and earlier is affected by: Out-of-bounds Read. The impact is: Denial of Service. The component is: read_samples function at xa.c:219. The attack vector is: Victim must open specially crafted .xa file. NOTE: this may overlap CVE-2017-18189.


definition_id: oval:org.debian:def:68886257041936857996633972843984421049
title: CVE-2019-1010006 atril
description:
Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.


definition_id: oval:org.debian:def:80562996027100032181925755990532153959
title: CVE-2019-1010057 nfdump
description:
nfdump 1.6.16 and earlier is affected by: Buffer Overflow. The impact is: The impact could range from a denial of service to local code execution. The component is: nfx.c:546, nffile_inline.c:83, minilzo.c (redistributed). The attack vector is: nfdump must read and process a specially crafted file. The fixed version is: after commit 9f0fe9563366f62a71d34c92229da3432ec5cf0e.


definition_id: oval:org.debian:def:47088576326781511352509057722910039234
title: CVE-2019-1010060 cfitsio
description:
NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. The impact is: arbitrary code execution. The component is: over 40 source code files were changed. The attack vector is: remote unauthenticated attacker. The fixed version is: 3.43. NOTE: this CVE refers to the issues not covered by CVE-2018-3846, CVE-2018-3847, CVE-2018-3848, and CVE-2018-3849. One example is ftp_status in drvrnet.c mishandling a long string beginning with a '4' character.


definition_id: oval:org.debian:def:159389571999712980603436772509385325869
title: CVE-2019-1010065 sleuthkit
description:
The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfs_dent.c:237. The component is: Overflow in fls tool used on HFS image. Bug is in tsk/fs/hfs.c file in function hfs_cat_traverse() in lines: 952, 1062. The attack vector is: Victim must open a crafted HFS filesystem image.


definition_id: oval:org.debian:def:37215870111571684439878102461787995259
title: CVE-2019-1010069 abcm2ps
description:
moinejf abcm2ps 8.13.20 is affected by: Incorrect Access Control. The impact is: Allows attackers to cause a denial of service attack via a crafted file. The component is: front.c, function txt_add. The fixed version is: after commit commit 08aef597656d065e86075f3d53fda89765845eae.


definition_id: oval:org.debian:def:291251990658863350335841071550131189989
title: CVE-2019-1010083 flask
description:
The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.


definition_id: oval:org.debian:def:262840356071829934896920904418139545566
title: CVE-2019-1010127 vcftools
description:
VCFTools vcftools prior to version 0.1.15 is affected by: Use-after-free. The impact is: Denial of Service or possibly other impact (eg. code execution or information disclosure). The component is: The header::add_FILTER_descriptor method in header.cpp. The attack vector is: The victim must open a specially crafted VCF file.


definition_id: oval:org.debian:def:290983902876401354103088121475129950914
title: CVE-2019-1010174 cimg
description:
CImg The CImg Library v.2.3.3 and earlier is affected by: command injection. The impact is: RCE. The component is: load_network() function. The attack vector is: Loading an image from a user-controllable url can lead to command injection, because no string sanitization is done on the url. The fixed version is: v.2.3.4.


definition_id: oval:org.debian:def:146926114477188437658309008679597927662
title: CVE-2019-1010189 mgetty
description:
mgetty prior to version 1.2.1 is affected by: Infinite Loop. The impact is: DoS, the program does never terminates. The component is: g3/g32pbm.c. The attack vector is: Local, the user should open a specially crafted file. The fixed version is: 1.2.1.


definition_id: oval:org.debian:def:77520626206369100588023532016616234442
title: CVE-2019-1010190 mgetty
description:
mgetty prior to 1.2.1 is affected by: out-of-bounds read. The impact is: DoS, the program may crash if the memory is not mapped. The component is: putwhitespan() in g3/pbm2g3.c. The attack vector is: Local, the victim must open a specially crafted file. The fixed version is: 1.2.1.


definition_id: oval:org.debian:def:116895348400728651939191148756278029572
title: CVE-2019-1010228 dcmtk
description:
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.


definition_id: oval:org.debian:def:149426464433535239338816052553411542936
title: CVE-2019-1010239 cjson
description:
DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. The impact is: Null dereference, so attack can cause denial of service. The component is: cJSON_GetObjectItemCaseSensitive() function. The attack vector is: crafted json file. The fixed version is: 1.7.9 and later.


definition_id: oval:org.debian:def:32766933624250402377028151625365295249
title: CVE-2019-1010247 libapache2-mod-auth-openidc
description:
ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2.


definition_id: oval:org.debian:def:281053686882319866714164029655336727284
title: CVE-2019-1010251 suricata
description:
Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed network packet. The component is: app-layer-detect-proto.c, decode.c, decode-teredo.c and decode-ipv6.c (https://github.com/OISF/suricata/pull/3590/commits/11f3659f64a4e42e90cb3c09fcef66894205aefe, https://github.com/OISF/suricata/pull/3590/commits/8357ef3f8ffc7d99ef6571350724160de356158b). The attack vector is: An attacker can trigger the vulnerability by sending a specifically crafted network request. The fixed version is: 4.1.2.


definition_id: oval:org.debian:def:140630846210594495674661525716611885617
title: CVE-2019-1010259 salt
description:
SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.


definition_id: oval:org.debian:def:287321846113515602326355352082683711788
title: CVE-2019-1010266 node-lodash
description:
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.


definition_id: oval:org.debian:def:74237986589600507141574064512964742132
title: CVE-2019-1010299 rustc
description:
The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory could be printed to string or to log file. The component is: Debug trait implementation for std::collections::vec_deque::Iter. The attack vector is: The program needs to invoke debug printing for iterator over an empty VecDeque. The fixed version is: 1.30.0, nightly versions after commit b85e4cc8fadaabd41da5b9645c08c68b8f89908d.


definition_id: oval:org.debian:def:85114716910460432846380571896815571145
title: CVE-2019-1010305 libmspack
description:
libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d.


definition_id: oval:org.debian:def:207060495196818197624242913422622889504
title: CVE-2019-1010315 wavpack
description:
WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to sudden crash of a software/service that tries to parse a .wav file. The component is: ParseDsdiffHeaderConfig (dsdiff.c:282). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc.


definition_id: oval:org.debian:def:96156439110176068176162349234904585117
title: CVE-2019-1010317 wavpack
description:
WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b.


definition_id: oval:org.debian:def:336056202141850630734397193636380761840
title: CVE-2019-1010319 wavpack
description:
WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe.


definition_id: oval:org.debian:def:73285224901078064170470885967236243894
title: CVE-2019-10125 linux
description:
An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be released by aio_poll_wake() if an expected event is triggered immediately (e.g., by the close of a pair of pipes) after the return of vfs_poll(), and this will cause a use-after-free.


definition_id: oval:org.debian:def:229289589656319768995076378713937381541
title: CVE-2019-10126 linux
description:
A flaw was found in the mwifiex implementation in the Linux kernel. A system connecting to wireless access point could be manipulated by an attacker with advanced permissions on the access point into localized memory corruption or possibly privilege escalation.


definition_id: oval:org.debian:def:225495310202977419123289538581145470675
title: CVE-2019-10129 postgresql-11
description:
A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any user can create a partitioned table suitable for this attack. (Exploit prerequisites are the same as for CVE-2018-1052).


definition_id: oval:org.debian:def:110617343657651985497879147981325244822
title: CVE-2019-10130 postgresql-11
description:
A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.


definition_id: oval:org.debian:def:337280719517035377075917604364360197881
title: CVE-2019-10131 imagemagick
description:
An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.


definition_id: oval:org.debian:def:225652128680935191512241134374649764328
title: CVE-2019-10132 libvirt
description:
A flaw was found in libvirt in version 4.1.0 and earlier. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


definition_id: oval:org.debian:def:305955924712769270970685416003450467927
title: CVE-2019-10141 ironic-inspector
description:
A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service.


definition_id: oval:org.debian:def:140986649789452271851520333580492186394
title: CVE-2019-10142 linux
description:
A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A parameter passed to an ioctl was incorrectly validated and used in size calculations for the page size calculation. An attacker can use this flaw to crash the system, corrupt memory, or create other adverse security affects.


definition_id: oval:org.debian:def:29138894278576880233429495884435401937
title: CVE-2019-10149 exim4
description:
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.


definition_id: oval:org.debian:def:62603241553632028554688177390739686482
title: CVE-2019-10153 fence-agents
description:
A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm to exit with an exception. In cluster environments, this could lead to preventing automated recovery or otherwise denying service to clusters of which that VM is a member.


definition_id: oval:org.debian:def:24690797163955627694538279634353185177
title: CVE-2019-10155 libreswan
description:
The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.


definition_id: oval:org.debian:def:88050204192332915762552369885814050740
title: CVE-2019-10160 python2.7
description:
A security regression of CVE-2019-9636 was discovered in python, since commit d537ab0ff9767ef024f26246899728f0116b1ec3, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.


definition_id: oval:org.debian:def:291922650030807510120413505220350053067
title: CVE-2019-10161 libvirt
description:
It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.


definition_id: oval:org.debian:def:120775417541446807808161864217874505494
title: CVE-2019-10162 pdns
description:
A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while looking up the NS/A/AAAA records it is about to use for an outgoing notify.


definition_id: oval:org.debian:def:50859535899975094444916222499040529875
title: CVE-2019-10163 pdns
description:
A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to cause a high CPU load or even prevent any further updates to any slave zone by sending a large number of NOTIFY messages. Note that only servers configured as slaves are affected by this issue.


definition_id: oval:org.debian:def:316344836464354217345870357372097397638
title: CVE-2019-10164 postgresql-11
description:
PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.


definition_id: oval:org.debian:def:298102625145783907315744881675400870180
title: CVE-2019-10166 libvirt
description:
It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.


definition_id: oval:org.debian:def:96993968008241269631492040842629459844
title: CVE-2019-10167 libvirt
description:
The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.


definition_id: oval:org.debian:def:31417636294946264826960142216649843102
title: CVE-2019-10168 libvirt
description:
The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.


definition_id: oval:org.debian:def:47983872894823017264020299055965156157
title: CVE-2019-10172 libjackson-json-java
description:
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.


definition_id: oval:org.debian:def:167787588038353863966466801365651112234
title: CVE-2019-10173 libxstream-java
description:
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)


definition_id: oval:org.debian:def:30011039707028509060509718106076743820
title: CVE-2019-10203 pdns
description:
PowerDNS Authoritative daemon , pdns versions 4.0.x before 4.0.9, 4.1.x before 4.1.11, exiting when encountering a serial between 2^31 and 2^32-1 while trying to notify a slave leads to DoS.


definition_id: oval:org.debian:def:73123511990737182920529607689292858427
title: CVE-2019-10220 linux
description:
Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.


definition_id: oval:org.debian:def:297456510542575975931643495753774412008
title: CVE-2019-10255 jupyter-notebook
description:
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.


definition_id: oval:org.debian:def:319067834649497798702327329246149722770
title: CVE-2019-10269 bwa
description:
BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.


definition_id: oval:org.debian:def:313490383926670587462047228872023146538
title: CVE-2019-10648 robocode
description:
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.


definition_id: oval:org.debian:def:170618286315586851880136180317406995521
title: CVE-2019-10650 imagemagick
description:
In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file.


definition_id: oval:org.debian:def:326419225054521798032365738363145963301
title: CVE-2019-10672 libmysofa
description:
treeRead in hdf/btree.c in libmysofa before 0.7 does not properly validate multiplications and additions.


definition_id: oval:org.debian:def:86750726971845199518939112484318048678
title: CVE-2019-10691 dovecot
description:
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username.


definition_id: oval:org.debian:def:185574812756451407700285274924986764429
title: CVE-2019-10740 roundcube
description:
In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.


definition_id: oval:org.debian:def:226154701881270964536299805300586330402
title: CVE-2019-10742 node-axios
description:
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.


definition_id: oval:org.debian:def:224382187591943199259430097599382701548
title: CVE-2019-10744 node-lodash
description:
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.


definition_id: oval:org.debian:def:147690483969411847131226054756449516275
title: CVE-2019-10746 node-mixin-deep
description:
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.


definition_id: oval:org.debian:def:237858757551828395427520006002118414279
title: CVE-2019-10747 node-set-value
description:
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.


definition_id: oval:org.debian:def:162430616190735890699889466881315754987
title: CVE-2019-10785 dojo
description:
dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.


definition_id: oval:org.debian:def:194433022354599376934496561888479175571
title: CVE-2019-10868 tryton-server
description:
In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values.


definition_id: oval:org.debian:def:22326581039986035781555714856399820320
title: CVE-2019-10872 poppler
description:
An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc.


definition_id: oval:org.debian:def:171493327851570338126937332817925809998
title: CVE-2019-10873 poppler
description:
An issue was discovered in Poppler 0.74.0. There is a NULL pointer dereference in the function SplashClip::clipAALine at splash/SplashClip.cc.


definition_id: oval:org.debian:def:32520860450293925176747187537355274255
title: CVE-2019-10876 neutron
description:
An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.


definition_id: oval:org.debian:def:160139745698000801298291220994416099815
title: CVE-2019-10877 teeworlds
description:
In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled.


definition_id: oval:org.debian:def:195941794230491972142309466838096822720
title: CVE-2019-10878 teeworlds
description:
In Teeworlds 0.7.2, there is a failed bounds check in CDataFileReader::GetData() and CDataFileReader::ReplaceData() and related functions in engine/shared/datafile.cpp that can lead to an arbitrary free and out-of-bounds pointer write, possibly resulting in remote code execution.


definition_id: oval:org.debian:def:263619606749579373927608054597245104990
title: CVE-2019-10879 teeworlds
description:
In Teeworlds 0.7.2, there is an integer overflow in CDataFileReader::Open() in engine/shared/datafile.cpp that can lead to a buffer overflow and possibly remote code execution, because size-related multiplications are mishandled.


definition_id: oval:org.debian:def:183179348847165946587199839680840530489
title: CVE-2019-10894 wireshark
description:
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the GSS-API dissector could crash. This was addressed in epan/dissectors/packet-gssapi.c by ensuring that a valid dissector is called.


definition_id: oval:org.debian:def:91672507345708751346404166873875206038
title: CVE-2019-10895 wireshark
description:
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.


definition_id: oval:org.debian:def:82524198472559574363585485973910981798
title: CVE-2019-10896 wireshark
description:
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes.


definition_id: oval:org.debian:def:120943031069914113236161216684317025104
title: CVE-2019-10899 wireshark
description:
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash. This was addressed in epan/dissectors/packet-srvloc.c by preventing a heap-based buffer under-read.


definition_id: oval:org.debian:def:109603995902321557834933506163405877326
title: CVE-2019-10901 wireshark
description:
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by handling file digests properly.


definition_id: oval:org.debian:def:68440761352203050533880892397002109332
title: CVE-2019-10903 wireshark
description:
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DCERPC SPOOLSS dissector could crash. This was addressed in epan/dissectors/packet-dcerpc-spoolss.c by adding a boundary check.


definition_id: oval:org.debian:def:323204744686677286602639315162878529642
title: CVE-2019-10909 symfony
description:
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.


definition_id: oval:org.debian:def:98018068708614106949489530122491950231
title: CVE-2019-10910 symfony
description:
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.


definition_id: oval:org.debian:def:10987072441465157295503685886758866943
title: CVE-2019-10911 symfony
description:
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.


definition_id: oval:org.debian:def:260388785416823892137416430060532284127
title: CVE-2019-10912 symfony
description:
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.


definition_id: oval:org.debian:def:73006867087956598379673231591126754193
title: CVE-2019-10913 symfony
description:
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.


definition_id: oval:org.debian:def:314901521384739634533035517655748888424
title: CVE-2019-11025 cacti
description:
In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS.


definition_id: oval:org.debian:def:262462728337357706862035694881122455177
title: CVE-2019-11034 php7.3
description:
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.


definition_id: oval:org.debian:def:307735272501450300028893980596325044495
title: CVE-2019-11035 php7.3
description:
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.


definition_id: oval:org.debian:def:330945296362752426675524327268536963779
title: CVE-2019-11037 php-imagick
description:
In PHP imagick extension in versions between 3.3.0 and 3.4.4, writing to an array of values in ImagickKernel::fromMatrix() function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled by untrusted party.


definition_id: oval:org.debian:def:186722841168957312905006932109676874352
title: CVE-2019-11038 libgd2
description:
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.


definition_id: oval:org.debian:def:47948344587048774767020867511900963295
title: CVE-2019-11059 u-boot
description:
Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension, resulting in a buffer overflow.


definition_id: oval:org.debian:def:76272140693093077514677787628223454131
title: CVE-2019-11068 libxslt
description:
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.


definition_id: oval:org.debian:def:84839971710264662055849095048335171045
title: CVE-2019-11070 webkit2gtk
description:
WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization. This issue was corrected by changing the way livestreams are downloaded.


definition_id: oval:org.debian:def:22829904829092502922190100896769289954
title: CVE-2019-11071 spip
description:
SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled.


definition_id: oval:org.debian:def:18016420911166670792935999318638898381
title: CVE-2019-11072 lighttpd
description:
** DISPUTED ** lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTE: The developer states "The feature which can be abused to cause the crash is a new feature in lighttpd 1.4.50, and is not enabled by default. It must be explicitly configured in the config file (e.g. lighttpd.conf). Certain input will trigger an abort() in lighttpd when that feature is enabled. lighttpd detects the underflow or realloc() will fail (in both 32-bit and 64-bit executables), also detected in lighttpd. Either triggers an explicit abort() by lighttpd. This is not exploitable beyond triggering the explicit abort() with subsequent application exit."


definition_id: oval:org.debian:def:327509929872836128778855211538217763132
title: CVE-2019-11085 linux
description:
Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.


definition_id: oval:org.debian:def:197640186515852493754711630871322473276
title: CVE-2019-11091 intel-microcode
description:
Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf


definition_id: oval:org.debian:def:93010194436276028188327097138727422334
title: CVE-2019-11187 fusiondirectory
description:
Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided.


definition_id: oval:org.debian:def:200490157850094795159323470057189115600
title: CVE-2019-11190 linux
description:
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.


definition_id: oval:org.debian:def:41985536786079889355557480732228307358
title: CVE-2019-11222 gpac
description:
gf_bin128_parse in utils/os_divers.c in GPAC 0.7.1 has a buffer overflow issue for the crypt feature when encountering a crafted_drm_file.xml file.


definition_id: oval:org.debian:def:76209521492083007959286616400837808008
title: CVE-2019-11234 freeradius
description:
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.


definition_id: oval:org.debian:def:76711848057958136967146656122771647589
title: CVE-2019-11235 freeradius
description:
FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.


definition_id: oval:org.debian:def:107057804833887945097525434960896260806
title: CVE-2019-11338 ffmpeg
description:
libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.


definition_id: oval:org.debian:def:98041100720860601776263371223299483299
title: CVE-2019-11339 ffmpeg
description:
The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data.


definition_id: oval:org.debian:def:161529345649572442271487585503573417639
title: CVE-2019-11356 cyrus-imapd
description:
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.


definition_id: oval:org.debian:def:41860873003861682294652207024529384233
title: CVE-2019-11358 jquery
description:
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.


definition_id: oval:org.debian:def:73112437442977964299074032667155665456
title: CVE-2019-11365 atftp
description:
An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered by sending an error packet of 3 bytes or fewer. There are multiple instances of this vulnerable strncpy pattern within the code base, specifically within tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and tftp_mtftp.c.


definition_id: oval:org.debian:def:301552289847756407437761071532347194965
title: CVE-2019-11366 atftp
description:
An issue was discovered in atftpd in atftp 0.7.1. It does not lock the thread_list_mutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If thread_data is NULL when assigned to current, and modified by another thread before a certain tftpd_list.c check, there is a crash when dereferencing current->next.


definition_id: oval:org.debian:def:336463042015684599254570550588607133398
title: CVE-2019-11372 libmediainfo
description:
An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.


definition_id: oval:org.debian:def:178070238017875848966952592227826337062
title: CVE-2019-11373 libmediainfo
description:
An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.


definition_id: oval:org.debian:def:99374272970766301808879602293080541223
title: CVE-2019-11387 modsecurity-crs
description:
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with nested repetition operators.


definition_id: oval:org.debian:def:44278057809952258037102256886928552844
title: CVE-2019-11459 atril
description:
The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.


definition_id: oval:org.debian:def:48122286610385794350224790806052150083
title: CVE-2019-11460 gnome-desktop3
description:
An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063.


definition_id: oval:org.debian:def:245396170779933034354719704942216266020
title: CVE-2019-11461 nautilus
description:
An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063.


definition_id: oval:org.debian:def:235735242382132400149014437785666489701
title: CVE-2019-11471 libheif
description:
libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context.cc mishandles references to non-existing alpha images.


definition_id: oval:org.debian:def:47955718496120008045188639200205236391
title: CVE-2019-11477 linux
description:
Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.


definition_id: oval:org.debian:def:251354181683812246346750401406361567645
title: CVE-2019-11478 linux
description:
Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.


definition_id: oval:org.debian:def:144778696460749870694610088504317916622
title: CVE-2019-11479 linux
description:
Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.


definition_id: oval:org.debian:def:127805617895350491571221265641304359413
title: CVE-2019-11486 linux
description:
The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions.


definition_id: oval:org.debian:def:147359725171225663602520004308630648018
title: CVE-2019-11487 linux
description:
The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can occur with FUSE requests.


definition_id: oval:org.debian:def:153873590610570150293522504817936537728
title: CVE-2019-11494 dovecot
description:
In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects prematurely during the AUTH command.


definition_id: oval:org.debian:def:183003887006772808961027793940297804830
title: CVE-2019-11498 wavpack
description:
WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.


definition_id: oval:org.debian:def:228647312527644859284104426809632071223
title: CVE-2019-11499 dovecot
description:
In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured channel with an unacceptable authentication message.


definition_id: oval:org.debian:def:65807101151426663014491538890317375134
title: CVE-2019-11555 wpa
description:
The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL pointer dereference (denial of service). This affects eap_server/eap_server_pwd.c and eap_peer/eap_pwd.c.


definition_id: oval:org.debian:def:187628094263578939350807060438897086929
title: CVE-2019-11577 dhcpcd5
description:
dhcpcd before 7.2.1 contains a buffer overflow in dhcp6_findna in dhcp6.c when reading NA/TA addresses.


definition_id: oval:org.debian:def:45965430871701866413752552175570503312
title: CVE-2019-11596 memcached
description:
In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.


definition_id: oval:org.debian:def:137361991060341992140471163633218697628
title: CVE-2019-11599 linux
description:
The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c.


definition_id: oval:org.debian:def:74567654152040523601592964837878297390
title: CVE-2019-11627 signing-party
description:
gpg-key2ps in signing-party 1.1.x and 2.x before 2.10-1 contains an unsafe shell call enabling shell injection via a User ID.


definition_id: oval:org.debian:def:216380304025275866327270566873397509145
title: CVE-2019-11675 groonga
description:
The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain root access because of unsafe interaction with logrotate. For example, an attacker can exploit a race condition to insert a symlink from /var/log/groonga/httpd to /etc/bash_completion.d. NOTE: this is an issue in the Debian packaging of the Groonga HTTP server.


definition_id: oval:org.debian:def:151506896527038780318423433231697594358
title: CVE-2019-11690 u-boot
description:
gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in scenarios where CONFIG_RANDOM_UUID is enabled, and Das U-Boot is relied upon for UUID values of a GUID Partition Table of a boot device.


definition_id: oval:org.debian:def:215871215583376563041012003216303711278
title: CVE-2019-11691 firefox-esr
description:
A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.


definition_id: oval:org.debian:def:222714933982926819317690294862826596008
title: CVE-2019-11692 firefox-esr
description:
A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.


definition_id: oval:org.debian:def:300008040322161668574708262579862993702
title: CVE-2019-11693 firefox-esr
description:
The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.


definition_id: oval:org.debian:def:165698974199896552393493648667107917324
title: CVE-2019-11698 firefox-esr
description:
If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.


definition_id: oval:org.debian:def:319073959582016043887568847288915109219
title: CVE-2019-11703 thunderbird
description:
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.


definition_id: oval:org.debian:def:64228315459286033094998459048130034609
title: CVE-2019-11704 thunderbird
description:
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.


definition_id: oval:org.debian:def:244975740669548126317370086933621379671
title: CVE-2019-11705 thunderbird
description:
A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.


definition_id: oval:org.debian:def:106168539473303779823790332321756153991
title: CVE-2019-11706 thunderbird
description:
A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulting in a crash. This vulnerability affects Thunderbird < 60.7.1.


definition_id: oval:org.debian:def:336405548350373054858724548690303004537
title: CVE-2019-11707 firefox-esr
description:
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.


definition_id: oval:org.debian:def:171352508029344674496862735774292638364
title: CVE-2019-11708 firefox-esr
description:
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.


definition_id: oval:org.debian:def:38148908871249405106281646003571192729
title: CVE-2019-11719 nss
description:
When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.


definition_id: oval:org.debian:def:128412597525441776250899858180967813555
title: CVE-2019-11727 nss
description:
A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.


definition_id: oval:org.debian:def:134530336763637309730146524031508023530
title: CVE-2019-11729 nss
description:
Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.


definition_id: oval:org.debian:def:238906916219326161217712473039272180946
title: CVE-2019-11766 dhcpcd5
description:
dhcp6.c in dhcpcd before 6.11.7 and 7.x before 7.2.2 has a buffer over-read in the D6_OPTION_PD_EXCLUDE feature.


definition_id: oval:org.debian:def:327621994161900793072226129326685789214
title: CVE-2019-11810 linux
description:
An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free.


definition_id: oval:org.debian:def:38516891016480055306913879710007674070
title: CVE-2019-11811 linux
description:
An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module is removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c.


definition_id: oval:org.debian:def:185316410456899991660270356191280163536
title: CVE-2019-11815 linux
description:
An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cleanup.


definition_id: oval:org.debian:def:34029879200228558392901408720527156254
title: CVE-2019-11833 linux
description:
fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem.


definition_id: oval:org.debian:def:275753215385471352944599963065635067838
title: CVE-2019-11884 linux
description:
The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\0' character.


definition_id: oval:org.debian:def:167341748854445707512237053230472978358
title: CVE-2019-11922 libzstd
description:
A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.


definition_id: oval:org.debian:def:159310502780247816076899963958291186360
title: CVE-2019-12086 jackson-databind
description:
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.


definition_id: oval:org.debian:def:280905861612793533905038285877280841994
title: CVE-2019-12095 php-horde
description:
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload.


definition_id: oval:org.debian:def:251181962207988663812372462215847684097
title: CVE-2019-12098 heimdal
description:
In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.


definition_id: oval:org.debian:def:96325963067273110590350719283666735725
title: CVE-2019-12106 minissdpd
description:
The updateDevice function in minissdpd.c in MiniUPnP MiniSSDPd 1.4 and 1.5 allows a remote attacker to crash the process due to a Use After Free vulnerability.


definition_id: oval:org.debian:def:204783691420352467380417056625745437871
title: CVE-2019-12107 miniupnpd
description:
The upnp_event_prepare function in upnpevents.c in MiniUPnP MiniUPnPd through 2.1 allows a remote attacker to leak information from the heap due to improper validation of an snprintf return value.


definition_id: oval:org.debian:def:212988216999113761844473326273891896470
title: CVE-2019-12108 miniupnpd
description:
A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for int_port.


definition_id: oval:org.debian:def:63164990447133145242856448187684925071
title: CVE-2019-12109 miniupnpd
description:
A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for rem_port.


definition_id: oval:org.debian:def:142014915597928494372192126453107766214
title: CVE-2019-12110 miniupnpd
description:
An AddPortMapping Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in upnpredirect.c.


definition_id: oval:org.debian:def:131709183154191188208679992462996795038
title: CVE-2019-12111 miniupnpd
description:
A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in copyIPv6IfDifferent in pcpserver.c.


definition_id: oval:org.debian:def:315451068408896033707585295966423966390
title: CVE-2019-12155 qemu
description:
interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.


definition_id: oval:org.debian:def:338761274766141350632485471634634230591
title: CVE-2019-12209 pam-u2f
description:
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.


definition_id: oval:org.debian:def:11693197566258710911454402402074785770
title: CVE-2019-12210 pam-u2f
description:
In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.


definition_id: oval:org.debian:def:21074596376874342752812355638385385559
title: CVE-2019-12216 libsdl2-image
description:
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a heap-based buffer overflow in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c.


definition_id: oval:org.debian:def:124224754386580390564968363342007138355
title: CVE-2019-12217 libsdl2-image
description:
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL stdio_read function in file/SDL_rwops.c.


definition_id: oval:org.debian:def:82578519215420670868507428943011513072
title: CVE-2019-12218 libsdl2-image
description:
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c.


definition_id: oval:org.debian:def:315079490267268848553428077754842956122
title: CVE-2019-12219 libsdl2-image
description:
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an invalid free error in the SDL function SDL_SetError_REAL at SDL_error.c.


definition_id: oval:org.debian:def:289621548285417272712214211069882536997
title: CVE-2019-12220 libsdl2-image
description:
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c.


definition_id: oval:org.debian:def:120227186767426806956006613873260407619
title: CVE-2019-12221 libsdl2-image
description:
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a SEGV in the SDL function SDL_free_REAL at stdlib/SDL_malloc.c.


definition_id: oval:org.debian:def:152357492681951733921432247367426405717
title: CVE-2019-12222 libsdl2-image
description:
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap at video/SDL_pixels.c.


definition_id: oval:org.debian:def:306813424278107535755129433275812554108
title: CVE-2019-12269 enigmail
description:
Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a "correctly signed" message indication, but display different unauthenticated text.


definition_id: oval:org.debian:def:242945212295610187094556919691961408895
title: CVE-2019-12293 poppler
description:
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.


definition_id: oval:org.debian:def:253303887773738960159308532467429440500
title: CVE-2019-12295 wireshark
description:
In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion.


definition_id: oval:org.debian:def:136827421110771906939312267964599518416
title: CVE-2019-12300 buildbot
description:
Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details of a victim, they can login as the victim.


definition_id: oval:org.debian:def:190969604384351593148668842481410217739
title: CVE-2019-12308 python-django
description:
An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.


definition_id: oval:org.debian:def:155774036953158252743061782475180508300
title: CVE-2019-12312 libreswan
description:
In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.


definition_id: oval:org.debian:def:223952199875576599100489653933395169838
title: CVE-2019-12360 poppler
description:
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.


definition_id: oval:org.debian:def:202013190413001901630832905662363660465
title: CVE-2019-12387 twisted
description:
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.


definition_id: oval:org.debian:def:257820806461642566135526150230942866278
title: CVE-2019-12402 libcommons-compress-java
description:
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.


definition_id: oval:org.debian:def:77828829642262445960619423531846153570
title: CVE-2019-12435 samba
description:
Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference, leading to Denial of Service. This is related to the AD DC DNS management server (dnsserver) RPC server process.


definition_id: oval:org.debian:def:218128596960096352873356406550866886742
title: CVE-2019-12439 bubblewrap
description:
bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.


definition_id: oval:org.debian:def:137158336288499254926168813687096713917
title: CVE-2019-12447 gvfs
description:
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used.


definition_id: oval:org.debian:def:116293487782614319241805565104588767887
title: CVE-2019-12448 gvfs
description:
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement query_info_on_read/write.


definition_id: oval:org.debian:def:323074255553606522298714093315928579807
title: CVE-2019-12449 gvfs
description:
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations from admin:// to file:// URIs, because root privileges are unavailable.


definition_id: oval:org.debian:def:337601804571158855078911601479861054080
title: CVE-2019-12450 glib2.0
description:
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.


definition_id: oval:org.debian:def:188756750629817012517966796097113733502
title: CVE-2019-12467 mediawiki
description:
MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.


definition_id: oval:org.debian:def:307793299172902268927730650844197810917
title: CVE-2019-12468 mediawiki
description:
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover.


definition_id: oval:org.debian:def:123074751037126619197133957455010552867
title: CVE-2019-12469 mediawiki
description:
MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.


definition_id: oval:org.debian:def:116417653059241489241443532224310292487
title: CVE-2019-12470 mediawiki
description:
Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.


definition_id: oval:org.debian:def:59175846913127931056085322801265324925
title: CVE-2019-12471 mediawiki
description:
Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.


definition_id: oval:org.debian:def:276027300214433065469191993122870765690
title: CVE-2019-12472 mediawiki
description:
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.


definition_id: oval:org.debian:def:321731586507973623642689691198747602602
title: CVE-2019-12473 mediawiki
description:
Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.


definition_id: oval:org.debian:def:126968603063647743549210307878504011460
title: CVE-2019-12474 mediawiki
description:
Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak. Privileged API responses that include whether a recent change has been patrolled may be cached publicly. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.


definition_id: oval:org.debian:def:92196233704778195009540766233015701191
title: CVE-2019-12493 poppler
description:
A stack-based buffer over-read exists in PostScriptFunction::transform in Function.cc in Xpdf 4.01.01 because GfxSeparationColorSpace and GfxDeviceNColorSpace mishandle tint transform functions. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data.


definition_id: oval:org.debian:def:52495316115881196752182368061569132593
title: CVE-2019-12499 firejail
description:
Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail sandbox and having the sandbox terminated. To succeed, certain conditions need to be fulfilled: The jail (with the exploit code inside) needs to be started as root, and it also needs to be terminated as root from the host (either by stopping it ungracefully (e.g., SIGKILL), or by using the --shutdown control command). This is similar to CVE-2019-5736.


definition_id: oval:org.debian:def:101486119326965778303502451044675664103
title: CVE-2019-12589 firejail
description:
In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.


definition_id: oval:org.debian:def:234596020462685780289752087633404216501
title: CVE-2019-12614 linux
description:
An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).


definition_id: oval:org.debian:def:321505338845814852870931518329706745913
title: CVE-2019-12625 clamav
description:
ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system.


definition_id: oval:org.debian:def:279491705402718431065703048862532899483
title: CVE-2019-12735 neovim
description:
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.


definition_id: oval:org.debian:def:240143468567242073853955187969767728136
title: CVE-2019-12749 dbus
description:
dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.


definition_id: oval:org.debian:def:313874385858584636975530778200022035379
title: CVE-2019-12779 libqb
description:
libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.


definition_id: oval:org.debian:def:287518655043825473975420270358689089366
title: CVE-2019-12781 python-django
description:
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.


definition_id: oval:org.debian:def:269975271104504342944075855219304094211
title: CVE-2019-12795 gvfs
description:
daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. (Note that the server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.)


definition_id: oval:org.debian:def:232098700417194751618613353322936059170
title: CVE-2019-12814 jackson-databind
description:
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.


definition_id: oval:org.debian:def:288980874052565455213218784774047308482
title: CVE-2019-12816 znc
description:
Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a crafted name.


definition_id: oval:org.debian:def:240552891142978237868783329546794146148
title: CVE-2019-12818 linux
description:
An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This affects nfc_llcp_build_gb in net/nfc/llcp_core.c.


definition_id: oval:org.debian:def:266458431545744958656705430202691620675
title: CVE-2019-12819 linux
description:
An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in drivers/net/phy/mdio_bus.c calls put_device(), which will trigger a fixed_mdio_bus_init use-after-free. This will cause a denial of service.


definition_id: oval:org.debian:def:241151427159911842766401920771757261822
title: CVE-2019-12827 asterisk
description:
Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message.


definition_id: oval:org.debian:def:62244410411762331156394206480944209039
title: CVE-2019-12855 twisted
description:
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.


definition_id: oval:org.debian:def:315746008494463547477985581654732916471
title: CVE-2019-12874 vlc
description:
An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.


definition_id: oval:org.debian:def:262260964805143338785214777523333929375
title: CVE-2019-12881 linux
description:
i915_gem_userptr_get_pages in drivers/gpu/drm/i915/i915_gem_userptr.c in the Linux kernel 4.15.0 on Ubuntu 18.04.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) or possibly have unspecified other impact via crafted ioctl calls to /dev/dri/card0.


definition_id: oval:org.debian:def:339287787326349979117142249304912102503
title: CVE-2019-12900 bzip2
description:
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.


definition_id: oval:org.debian:def:167681072887997456555064038732371766167
title: CVE-2019-12953 dropbear
description:
Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599.


definition_id: oval:org.debian:def:237079285059350975089204819960276804593
title: CVE-2019-12957 poppler
description:
In Xpdf 4.01.01, a buffer over-read could be triggered in FoFiType1C::convertToType1 in fofi/FoFiType1C.cc when the index number is larger than the charset array bounds. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.


definition_id: oval:org.debian:def:84906508767654232095966170680418518784
title: CVE-2019-13012 glib2.0
description:
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.


definition_id: oval:org.debian:def:31812350415413500584176661743070797463
title: CVE-2019-13031 lemonldap-ng
description:
LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification to the notification server. By default, the notification server is not enabled and has a "deny all" rule.


definition_id: oval:org.debian:def:305463545982410844215279936270495830565
title: CVE-2019-13032 flightcrew
description:
An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to xc::XMLUri::isValidURI(). This affects third-party software (not Sigil) that uses FlightCrew as a library.


definition_id: oval:org.debian:def:241569975991231168636393849786328950186
title: CVE-2019-13045 irssi
description:
Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server.


definition_id: oval:org.debian:def:279827161952037420241480185623188697537
title: CVE-2019-13057 openldap
description:
An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)


definition_id: oval:org.debian:def:210870010820361255684750478596932891862
title: CVE-2019-13075 firefox-esr
description:
Tor Browser through 8.5.3 has an information exposure vulnerability. It allows remote attackers to detect the browser's language via vectors involving an IFRAME element, because text in that language is included in the title attribute of a LINK element for a non-HTML page. This is related to a behavior of Firefox before 68.


definition_id: oval:org.debian:def:146439659059834019352225693685776313562
title: CVE-2019-13110 exiv2
description:
A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted CRW image file.


definition_id: oval:org.debian:def:337329914811575686468085041042892346436
title: CVE-2019-13112 exiv2
description:
A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to an std::bad_alloc exception) via a crafted PNG image file.


definition_id: oval:org.debian:def:82282751177537660137673386659021492386
title: CVE-2019-13114 exiv2
description:
http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted response that lacks a space character.


definition_id: oval:org.debian:def:76217603876768649840534842290784307989
title: CVE-2019-13117 libxslt
description:
In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.


definition_id: oval:org.debian:def:213794807542080013489380815140812887303
title: CVE-2019-13118 libxslt
description:
In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.


definition_id: oval:org.debian:def:125094878837788922130915999800016781380
title: CVE-2019-13161 asterisk
description:
An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL stream and another media stream containing only a codec (which is not permitted according to the chan_sip configuration).


definition_id: oval:org.debian:def:4988960661896687118690406167144519533
title: CVE-2019-13173 node-fstream
description:
fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.


definition_id: oval:org.debian:def:279565832502583176533808968315877378715
title: CVE-2019-13179 calamares-settings-debian
description:
Calamares versions 3.1 through 3.2.10 copies a LUKS encryption keyfile from /crypto_keyfile.bin (mode 0600 owned by root) to /boot within a globally readable initramfs image with insecure permissions, which allows this originally protected file to be read by any user, thereby disclosing decryption keys for LUKS containers created with Full Disk Encryption.


definition_id: oval:org.debian:def:292840468109836923962796922162317246533
title: CVE-2019-13217 libstb
description:
A heap buffer overflow in the start_decoder function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.


definition_id: oval:org.debian:def:261049481329845934618401357449629577580
title: CVE-2019-13218 libstb
description:
Division by zero in the predict_point function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.


definition_id: oval:org.debian:def:115199495407843103929153397074876024247
title: CVE-2019-13219 libstb
description:
A NULL pointer dereference in the get_window function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.


definition_id: oval:org.debian:def:314574240481424748491358362726156629300
title: CVE-2019-13220 libstb
description:
Use of uninitialized stack variables in the start_decoder function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or disclose sensitive information by opening a crafted Ogg Vorbis file.


definition_id: oval:org.debian:def:22511985464263264176503717008317706162
title: CVE-2019-13221 libstb
description:
A stack buffer overflow in the compute_codewords function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.


definition_id: oval:org.debian:def:180091030578220638601387312903659973598
title: CVE-2019-13222 libstb
description:
An out-of-bounds read of a global buffer in the draw_line function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or disclose sensitive information by opening a crafted Ogg Vorbis file.


definition_id: oval:org.debian:def:74081555342146176378972898883382918870
title: CVE-2019-13223 libstb
description:
A reachable assertion in the lookup1_values function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.


definition_id: oval:org.debian:def:100568240015432932374550035528491332630
title: CVE-2019-13224 php7.3
description:
A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.


definition_id: oval:org.debian:def:58171873107345512908510443259981574407
title: CVE-2019-13232 unzip
description:
Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.


definition_id: oval:org.debian:def:257750942877934072023571507081057224923
title: CVE-2019-13241 flightcrew
description:
FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.


definition_id: oval:org.debian:def:102254126238541291466429544915717774072
title: CVE-2019-13273 xymon
description:
In Xymon through 4.3.28, a buffer overflow vulnerability exists in the csvinfo CGI script. The overflow may be exploited by sending a crafted GET request that triggers an sprintf of the srcdb parameter.


definition_id: oval:org.debian:def:126462523521972881852323499197599266364
title: CVE-2019-13274 xymon
description:
In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter.


definition_id: oval:org.debian:def:107848693109121745615001675508786444063
title: CVE-2019-13306 imagemagick
description:
ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.


definition_id: oval:org.debian:def:337249846321529241414171224033471891318
title: CVE-2019-13391 imagemagick
description:
In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels.


definition_id: oval:org.debian:def:223489398208763723992788327549142478971
title: CVE-2019-13445 ros-ros-comm
description:
An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. parseOptions() in tools/rosbag/src/record.cpp has an integer overflow when a crafted split option can be entered on the command line.


definition_id: oval:org.debian:def:22468028971497911809347119938535349732
title: CVE-2019-13453 zipios++
description:
Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().


definition_id: oval:org.debian:def:158655925922420846246190738658109311116
title: CVE-2019-13455 xymon
description:
In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the alert acknowledgment CGI tool because of &nbsp; expansion in acknowledge.c.


definition_id: oval:org.debian:def:248184782034822881578291604279511263146
title: CVE-2019-13456 freeradius
description:
In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the "Dragonblood" attack and CVE-2019-9494.


definition_id: oval:org.debian:def:331616361997053917399373455818330482088
title: CVE-2019-13464 modsecurity-crs
description:
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid.


definition_id: oval:org.debian:def:213186849125630915283180756468914176524
title: CVE-2019-13465 ros-ros-comm
description:
An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. ROS_ASSERT_MSG only works when ROS_ASSERT_ENABLED is defined. This leads to a problem in the remove() function in clients/roscpp/src/libros/spinner.cpp. When ROS_ASSERT_ENABLED is not defined, the iterator loop will run out of the scope of the array, and cause denial of service for other components (that depend on the communication-related functions of this package). NOTE: The reporter of this issue now believes it was a false alarm.


definition_id: oval:org.debian:def:120730481798556878906638196951729602938
title: CVE-2019-13484 xymon
description:
In Xymon through 4.3.28, a buffer overflow exists in the status-log viewer CGI because of &nbsp; expansion in appfeed.c.


definition_id: oval:org.debian:def:239696480315863918246406198720769702762
title: CVE-2019-13485 xymon
description:
In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the history viewer component via a long hostname or service parameter to history.c.


definition_id: oval:org.debian:def:154450423757913737045475217607643142641
title: CVE-2019-13486 xymon
description:
In Xymon through 4.3.28, a stack-based buffer overflow exists in the status-log viewer component because of &nbsp; expansion in svcstatus.c.


definition_id: oval:org.debian:def:236680996300732088801581681007752190039
title: CVE-2019-1350 git
description:
A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.


definition_id: oval:org.debian:def:316572639057736087941545188612186819893
title: CVE-2019-13504 exiv2
description:
There is an out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp in Exiv2 through 0.27.2.


definition_id: oval:org.debian:def:280338942825172085362273073972213639635
title: CVE-2019-1351 git
description:
A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'.


definition_id: oval:org.debian:def:91225849265231761394907656883937097233
title: CVE-2019-1354 git
description:
A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1352, CVE-2019-1387.


definition_id: oval:org.debian:def:31001318059827955352061490931546219301
title: CVE-2019-13565 openldap
description:
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.


definition_id: oval:org.debian:def:98036285146223489314664408313163628858
title: CVE-2019-13566 ros-ros-comm
description:
An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. A buffer overflow allows attackers to cause a denial of service and possibly execute arbitrary code via an IP address with a long hostname.


definition_id: oval:org.debian:def:82925370800513851453454086005961055805
title: CVE-2019-13590 sox
description:
An issue was discovered in libsox.a in SoX 14.4.2. In sox-fmt.h (startread function), there is an integer overflow on the result of integer addition (wraparound to 0) fed into the lsx_calloc macro that wraps malloc. When a NULL pointer is returned, it is used without a prior check that it is a valid pointer, leading to a NULL pointer dereference on lsx_readbuf in formats_i.c.


definition_id: oval:org.debian:def:278578715243993468943377869009226265271
title: CVE-2019-13615 libebml
description:
libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.


definition_id: oval:org.debian:def:318960818820417353766426716756998258059
title: CVE-2019-13616 libsdl1.2
description:
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.


definition_id: oval:org.debian:def:43107282615863190304635937330353951082
title: CVE-2019-13619 wireshark
description:
In Wireshark 3.0.0 to 3.0.2, 2.6.0 to 2.6.9, and 2.4.0 to 2.4.15, the ASN.1 BER dissector and related dissectors could crash. This was addressed in epan/asn1.c by properly restricting buffer increments.


definition_id: oval:org.debian:def:47546553759718664921480285042994021065
title: CVE-2019-13626 libsdl2
description:
SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-read in Fill_IMA_ADPCM_block, caused by an integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c.


definition_id: oval:org.debian:def:229319401822552805658576737062887827165
title: CVE-2019-13672 chromium
description:
Incorrect security UI in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page on iOS.


definition_id: oval:org.debian:def:145096616707894213120081544539982330356
title: CVE-2019-13684 chromium
description:
Inappropriate implementation in JavaScript in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page.


definition_id: oval:org.debian:def:22359928438300740689485906206476640350
title: CVE-2019-13698 chromium
description:
Out of bounds memory access in JavaScript in Google Chrome prior to 73.0.3683.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:290456723914125067798055325237684967414
title: CVE-2019-13765 chromium
description:
Use-after-free in content delivery manager in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:242260191998421519120649495975566811905
title: CVE-2019-13766 chromium
description:
Use-after-free in accessibility in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:247437372745932673198171847925392221819
title: CVE-2019-13952 gdnsd
description:
The set_ipv6() function in zscan_rfc1035.rl in gdnsd before 2.4.3 and 3.x before 3.2.1 has a stack-based buffer overflow via a long and malformed IPv6 address in zone data.


definition_id: oval:org.debian:def:44411492214153606143368629578712101852
title: CVE-2019-14247 mpg321
description:
The scan() function in mad.c in mpg321 0.3.2 allows remote attackers to trigger an out-of-bounds write via a zero bitrate in an MP3 file.


definition_id: oval:org.debian:def:331926981154510872133913706499719846016
title: CVE-2019-14369 exiv2
description:
Exiv2::PngImage::readMetadata() in pngimage.cpp in Exiv2 0.27.99.0 allows attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file.


definition_id: oval:org.debian:def:8812939388555519416063777389825124704
title: CVE-2019-14370 exiv2
description:
In Exiv2 0.27.99.0, there is an out-of-bounds read in Exiv2::MrwImage::readMetadata() in mrwimage.cpp. It could result in denial of service.


definition_id: oval:org.debian:def:193222175788040071384471240672386398882
title: CVE-2019-14378 slirp4netns
description:
ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.


definition_id: oval:org.debian:def:88062621496919391042310306359954938107
title: CVE-2019-14379 jackson-databind
description:
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.


definition_id: oval:org.debian:def:92923580254581780608403182076691795300
title: CVE-2019-14381 libopenmpt
description:
libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument to an empty instrument note map slot.


definition_id: oval:org.debian:def:244366827636009986252488004071253756965
title: CVE-2019-14433 nova
description:
An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response, and could include sensitive configuration or other data.


definition_id: oval:org.debian:def:1607211581522254027948572113877408664
title: CVE-2019-14462 libmodbus
description:
An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.


definition_id: oval:org.debian:def:186535211837355464618673940387264387415
title: CVE-2019-14463 libmodbus
description:
An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.


definition_id: oval:org.debian:def:231245920050079515830265419174185454388
title: CVE-2019-14466 gosa
description:
The GOsa_Filter_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions (in the context of the user account that runs the web server) via a crafted cookie value, because unserialize is used to restore filter settings from a cookie.


definition_id: oval:org.debian:def:211087544764326667830784294097546825568
title: CVE-2019-14494 poppler
description:
An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.


definition_id: oval:org.debian:def:314397179489411034366565474485817069344
title: CVE-2019-14496 milkytracker
description:
LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.


definition_id: oval:org.debian:def:169724184523669742179030728518716278596
title: CVE-2019-14497 milkytracker
description:
ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.


definition_id: oval:org.debian:def:281417162853092117340232496922494399095
title: CVE-2019-14513 dnsmasq
description:
Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read operation beyond the buffer allocated for the packet, a different vulnerability than CVE-2017-14491.


definition_id: oval:org.debian:def:37812984844580715012490508731316515899
title: CVE-2019-14558 edk2
description:
Insufficient control flow management in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors may allow an authenticated user to potentially enable denial of service via adjacent access.


definition_id: oval:org.debian:def:75339828416164103822537843673547880806
title: CVE-2019-14559 edk2
description:
Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access.


definition_id: oval:org.debian:def:299961477824810040164201199769353979356
title: CVE-2019-14562 edk2
description:
Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access.


definition_id: oval:org.debian:def:145694888908124734804145836247521389143
title: CVE-2019-14563 edk2
description:
Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.


definition_id: oval:org.debian:def:155790305068444346186123624674060469966
title: CVE-2019-14575 edk2
description:
Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.


definition_id: oval:org.debian:def:175715793008737229351800144099760339592
title: CVE-2019-14584 edk2
description:
Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.


definition_id: oval:org.debian:def:113766853281545279599480645348965932033
title: CVE-2019-14586 edk2
description:
Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent access.


definition_id: oval:org.debian:def:199026116430669232688882510284586821694
title: CVE-2019-14587 edk2
description:
Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.


definition_id: oval:org.debian:def:263660964137374570345220507672148591645
title: CVE-2019-14607 intel-microcode
description:
Improper conditions check in multiple Intel® Processors may allow an authenticated user to potentially enable partial escalation of privilege, denial of service and/or information disclosure via local access.


definition_id: oval:org.debian:def:20047194205081353041293900503937132265
title: CVE-2019-14615 linux
description:
Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may allow an unauthenticated user to potentially enable information disclosure via local access.


definition_id: oval:org.debian:def:71794605160584629595719845672449877524
title: CVE-2019-14664 enigmail
description:
In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, he unknowingly leaks the plaintext of the encrypted message part(s) back to the attacker. This attack variant bypasses protection mechanisms implemented after the "EFAIL" attacks.


definition_id: oval:org.debian:def:114731432570083663430483171096940978283
title: CVE-2019-14763 linux
description:
In the Linux kernel before 4.16.4, a double-locking error in drivers/usb/dwc3/gadget.c may potentially cause a deadlock with f_hid.


definition_id: oval:org.debian:def:99099330489784792243262427980055770649
title: CVE-2019-14806 python-werkzeug
description:
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.


definition_id: oval:org.debian:def:160048684277662330833826446628513729808
title: CVE-2019-14814 linux
description:
A flaw was found in the Linux kernel’s implementation of the Marvell wifi driver, which can allow a local user who has CAP_NET_ADMIN or administrative privileges to possibly cause a Denial Of Service (DOS) by corrupting memory and possible code execution.


definition_id: oval:org.debian:def:147959886258504817624027709715520513152
title: CVE-2019-14815 linux
description:
A vulnerability found in the Linux kernel's WMM implementation for Marvell WiFi-based hardware (mwifiex) could lead to a denial of service or allow arbitrary code execution. For this flaw to be executed, the attacker must be both local and privileged. There is no mitigation to this flaw. A patch has been provided to remediate this flaw.


definition_id: oval:org.debian:def:251807938117249173742212581875719681899
title: CVE-2019-14816 linux
description:
A vulnerability was found in the Linux kernel's Marvell WiFi chip driver. Where, while parsing vendor-specific informational attributes, an attacker on the same WiFi physical network segment could cause a system crash, resulting in a denial of service, or potentially execute arbitrary code. This flaw affects the network interface at the most basic level meaning the attacker only needs to affiliate with the same network device as the vulnerable system to create an attack path.


definition_id: oval:org.debian:def:91400520530000705891615433788073744316
title: CVE-2019-14857 libapache2-mod-auth-openidc
description:
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.


definition_id: oval:org.debian:def:246905935699878698912376295853251439817
title: CVE-2019-14862 node-knockout
description:
There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.


definition_id: oval:org.debian:def:161316623779931605384133269539918044080
title: CVE-2019-14863 angular.js
description:
There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.


definition_id: oval:org.debian:def:300217050729625703759946903689004573356
title: CVE-2019-14868 ksh
description:
A flaw was found in the way ksh evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.


definition_id: oval:org.debian:def:16440269237920295731804909286186449951
title: CVE-2019-14870 heimdal
description:
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set.


definition_id: oval:org.debian:def:69534748914915606779070543515397431242
title: CVE-2019-14892 jackson-databind
description:
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.


definition_id: oval:org.debian:def:211163874042787807505955142961035131658
title: CVE-2019-14893 jackson-databind
description:
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.


definition_id: oval:org.debian:def:143561556471805338714059817396458859480
title: CVE-2019-14895 linux
description:
A heap-based buffer overflow was discovered in the Linux kernel's Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could allow the remote device to cause a denial of service (system crash) or possibly execute arbitrary code.


definition_id: oval:org.debian:def:288277710053242299240667069976993299832
title: CVE-2019-14896 linux
description:
A heap-based buffer overflow vulnerability was found in the Linux kernel's Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP.


definition_id: oval:org.debian:def:295874613234564518766715172048862587076
title: CVE-2019-14897 linux
description:
A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An attacker is able to cause a denial of service (system crash) or, possibly execute arbitrary code, when a STA works in IBSS mode (allows connecting stations together without the use of an AP) and connects to another STA.


