# definitions

definition_id: oval:org.debian:def:7813188767780570930114745726624015513
title: CVE-2019-14901 linux
description:
A heap overflow flaw was found in the Linux kernel's Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs, the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system.


definition_id: oval:org.debian:def:156608971958541452341985769540318680666
title: CVE-2019-14939 node-mysql
description:
An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default.


definition_id: oval:org.debian:def:69312804465620079957691459216082412786
title: CVE-2019-15030 linux
description:
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process because of a missing arch/powerpc/kernel/process.c check.


definition_id: oval:org.debian:def:297508938002976142038290084407196379591
title: CVE-2019-15031 linux
description:
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via an interrupt. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process, because MSR_TM_ACTIVE is misused in arch/powerpc/kernel/process.c.


definition_id: oval:org.debian:def:208165409621208106343849819856104932091
title: CVE-2019-15090 linux
description:
An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the qedi_dbg_* family of functions, there is an out-of-bounds read.


definition_id: oval:org.debian:def:12731391808151500407312758161858454357
title: CVE-2019-15098 linux
description:
drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.


definition_id: oval:org.debian:def:126326652648642139844019975076681786365
title: CVE-2019-15099 linux
description:
drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.


definition_id: oval:org.debian:def:230679715457280857507265134059881933476
title: CVE-2019-15133 giflib
description:
In GIFLIB before 2019-02-16, a malformed GIF file triggers a divide-by-zero exception in the decoder function DGifSlurp in dgif_lib.c if the height field of the ImageSize data structure is equal to zero.


definition_id: oval:org.debian:def:133935979948044196189829633611374907811
title: CVE-2019-15165 libpcap
description:
sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.


definition_id: oval:org.debian:def:248633946553316652054894714297596656804
title: CVE-2019-15167 tcpdump
description:
The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 3, a different vulnerability than CVE-2018-14463.


definition_id: oval:org.debian:def:64238241469612529017784066065793490783
title: CVE-2019-15211 linux
description:
An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/v4l2-core/v4l2-dev.c driver because drivers/media/radio/radio-raremono.c does not properly allocate memory.


definition_id: oval:org.debian:def:100029339477756930487940238592268642807
title: CVE-2019-15212 linux
description:
An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB device in the drivers/usb/misc/rio500.c driver.


definition_id: oval:org.debian:def:121580940782790253003603612360329923751
title: CVE-2019-15214 linux
description:
An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data structures to be deleted too early. This is related to sound/core/init.c and sound/core/info.c.


definition_id: oval:org.debian:def:93689910555670079453689201511373071884
title: CVE-2019-15215 linux
description:
An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/cpia2/cpia2_usb.c driver.


definition_id: oval:org.debian:def:261418051053233333464453377141336531656
title: CVE-2019-15216 linux
description:
An issue was discovered in the Linux kernel before 5.0.14. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/yurex.c driver.


definition_id: oval:org.debian:def:14461487792150846981631712872466880055
title: CVE-2019-15217 linux
description:
An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver.


definition_id: oval:org.debian:def:76806156650986847443255079263264954745
title: CVE-2019-15218 linux
description:
An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/siano/smsusb.c driver.


definition_id: oval:org.debian:def:60225002594056150316803617110974441101
title: CVE-2019-15219 linux
description:
An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/sisusbvga/sisusb.c driver.


definition_id: oval:org.debian:def:339180420143943620345628052632749424001
title: CVE-2019-15220 linux
description:
An issue was discovered in the Linux kernel before 5.2.1. There is a use-after-free caused by a malicious USB device in the drivers/net/wireless/intersil/p54/p54usb.c driver.


definition_id: oval:org.debian:def:295905608243544005791996950135015801182
title: CVE-2019-15221 linux
description:
An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/pcm.c driver.


definition_id: oval:org.debian:def:7521727075592833111991240466828930634
title: CVE-2019-15291 linux
description:
An issue was discovered in the Linux kernel through 5.2.9. There is a NULL pointer dereference caused by a malicious USB device in the flexcop_usb_probe function in the drivers/media/usb/b2c2/flexcop-usb.c driver.


definition_id: oval:org.debian:def:4465022150972162777699062906207630477
title: CVE-2019-15292 linux
description:
An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit, related to net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c.


definition_id: oval:org.debian:def:4228078701655502045614745033877757472
title: CVE-2019-15296 faad2
description:
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined by ld->buffer_size - words*4, cast to uint32. If ld->buffer_size - words*4 is negative, a buffer overflow is later performed via getdword_n(&ld->start[words], ld->bytes_left).


definition_id: oval:org.debian:def:78289197159569762249897048115208056843
title: CVE-2019-15297 asterisk
description:
res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.


definition_id: oval:org.debian:def:323024772760277839329288830273981062608
title: CVE-2019-1543 openssl
description:
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j).


definition_id: oval:org.debian:def:94009937852591205556614181051051520408
title: CVE-2019-15504 linux
description:
drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir).


definition_id: oval:org.debian:def:333575640614232526008208225721565977015
title: CVE-2019-15505 linux
description:
drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which may be remote via usbip or usbredir).


definition_id: oval:org.debian:def:134917130576671396150628604443364926589
title: CVE-2019-15522 csync2
description:
An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a hello command when the configuration requires use of SSL.


definition_id: oval:org.debian:def:258919768194433594144785070888929625629
title: CVE-2019-15531 libextractor
description:
GNU Libextractor through 1.9 has a heap-based buffer over-read in the function EXTRACTOR_dvi_extract_method in plugins/dvi_extractor.c.


definition_id: oval:org.debian:def:283541126512044434039780094845256184349
title: CVE-2019-15538 linux
description:
An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.


definition_id: oval:org.debian:def:70564927983914739058017649507942338553
title: CVE-2019-1559 openssl
description:
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).


definition_id: oval:org.debian:def:194211270879810023596896742618282164476
title: CVE-2019-15605 http-parser
description:
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed


definition_id: oval:org.debian:def:198893752020900630971520636328733379299
title: CVE-2019-15666 linux
description:
An issue was discovered in the Linux kernel before 5.0.19. There is an out-of-bounds array access in __xfrm_policy_unlink, which will cause denial of service, because verify_newpolicy_info in net/xfrm/xfrm_user.c mishandles directory validation.


definition_id: oval:org.debian:def:281735669028558083768593961280764178144
title: CVE-2019-15678 tightvnc
description:
TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution.. This attack appear to be exploitable via network connectivity.


definition_id: oval:org.debian:def:238968381937731059830054720193938219000
title: CVE-2019-15679 tightvnc
description:
TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.


definition_id: oval:org.debian:def:113912171607486979779560839340164321936
title: CVE-2019-15680 tightvnc
description:
TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network connectivity.


definition_id: oval:org.debian:def:229149147636165405760999277997870717600
title: CVE-2019-15681 libvncserver
description:
LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.


definition_id: oval:org.debian:def:83254068680654876420794235851798898055
title: CVE-2019-15682 rdesktop
description:
RDesktop version 1.8.4 contains multiple out-of-bound access read vulnerabilities in its code, which results in a denial of service (DoS) condition. This attack appear to be exploitable via network connectivity. These issues have been fixed in version 1.8.5


definition_id: oval:org.debian:def:224071832887757818525743152410550368220
title: CVE-2019-15691 tigervnc
description:
TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.


definition_id: oval:org.debian:def:106248651808018923315041781339878671287
title: CVE-2019-15692 tigervnc
description:
TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered from CopyRectDecoder due to incorrect value checks. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.


definition_id: oval:org.debian:def:80401912490096884588178509365981062188
title: CVE-2019-15693 tigervnc
description:
TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.


definition_id: oval:org.debian:def:289697316809192191004143804321716774163
title: CVE-2019-15694 tigervnc
description:
TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.


definition_id: oval:org.debian:def:121387620546214578012331501662326872795
title: CVE-2019-15695 tigervnc
description:
TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.


definition_id: oval:org.debian:def:35768563659386230824449625623974244103
title: CVE-2019-15718 systemd
description:
In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.


definition_id: oval:org.debian:def:135460272673529078320407502479105626315
title: CVE-2019-15807 linux
description:
In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails. This will cause a BUG and denial of service.


definition_id: oval:org.debian:def:38472356050785480196572525226953092834
title: CVE-2019-15916 linux
description:
An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in register_queue_kobjects() in net/core/net-sysfs.c, which will cause denial of service.


definition_id: oval:org.debian:def:212417406072900905238988333152368154862
title: CVE-2019-15917 linux
description:
An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() fails in hci_uart_set_proto() in drivers/bluetooth/hci_ldisc.c.


definition_id: oval:org.debian:def:93683794729879403219617973360469490569
title: CVE-2019-15918 linux
description:
An issue was discovered in the Linux kernel before 5.0.10. SMB2_negotiate in fs/cifs/smb2pdu.c has an out-of-bounds read because data structures are incompletely updated after a change from smb30 to smb21.


definition_id: oval:org.debian:def:287833857178862129495997643592665113012
title: CVE-2019-15919 linux
description:
An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free.


definition_id: oval:org.debian:def:119676821746569832636614626204133167236
title: CVE-2019-15920 linux
description:
An issue was discovered in the Linux kernel before 5.0.10. SMB2_read in fs/cifs/smb2pdu.c has a use-after-free. NOTE: this was not fixed correctly in 5.0.10; see the 5.0.11 ChangeLog, which documents a memory leak.


definition_id: oval:org.debian:def:151151907550125889708276654663712608526
title: CVE-2019-15921 linux
description:
An issue was discovered in the Linux kernel before 5.0.6. There is a memory leak issue when idr_alloc() fails in genl_register_family() in net/netlink/genetlink.c.


definition_id: oval:org.debian:def:188791679129039751953103578087600876556
title: CVE-2019-15924 linux
description:
An issue was discovered in the Linux kernel before 5.0.11. fm10k_init_module in drivers/net/ethernet/intel/fm10k/fm10k_main.c has a NULL pointer dereference because there is no -ENOMEM upon an alloc_workqueue failure.


definition_id: oval:org.debian:def:131852974247171039987868568951684539064
title: CVE-2019-15925 linux
description:
An issue was discovered in the Linux kernel before 5.2.3. An out of bounds access exists in the function hclge_tm_schd_mode_vnet_base_cfg in the file drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c.


definition_id: oval:org.debian:def:284220985745289340374163041563123844371
title: CVE-2019-15926 linux
description:
An issue was discovered in the Linux kernel before 5.2.3. Out of bounds access exists in the functions ath6kl_wmi_pstream_timeout_event_rx and ath6kl_wmi_cac_event_rx in the file drivers/net/wireless/ath/ath6kl/wmi.c.


definition_id: oval:org.debian:def:111930972827924406507153414424881105305
title: CVE-2019-15927 linux
description:
An issue was discovered in the Linux kernel before 4.20.2. An out-of-bounds access exists in the function build_audio_procunit in the file sound/usb/mixer.c.


definition_id: oval:org.debian:def:266024007309481313750976967945218866689
title: CVE-2019-15945 opensc
description:
OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.


definition_id: oval:org.debian:def:143933904632869619236465110158130986448
title: CVE-2019-15946 opensc
description:
OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.


definition_id: oval:org.debian:def:287556849569408717376888565713813985543
title: CVE-2019-15961 clamav
description:
A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to inefficient MIME parsing routines that result in extremely long scan times of specially formatted email files. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to scan the crafted email file indefinitely, resulting in a denial of service condition.


definition_id: oval:org.debian:def:212234034995779726427982956658179363253
title: CVE-2019-16056 python2.7
description:
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.


definition_id: oval:org.debian:def:198482791403267040508206801177307922681
title: CVE-2019-16167 sysstat
description:
sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c.


definition_id: oval:org.debian:def:265219943155965757362183614253200200452
title: CVE-2019-16168 sqlite3
description:
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."


definition_id: oval:org.debian:def:175077072136465820171969025686348957070
title: CVE-2019-16319 wireshark
description:
In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop. This was addressed in plugins/epan/gryphon/packet-gryphon.c by checking for a message length of zero.


definition_id: oval:org.debian:def:174242728831623745341461423073998940120
title: CVE-2019-16413 linux
description:
An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect i_size_write() properly, which causes an i_size_read() infinite loop and denial of service on SMP systems.


definition_id: oval:org.debian:def:51618202925451961625152978080143920377
title: CVE-2019-16680 file-roller
description:
An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.


definition_id: oval:org.debian:def:48537634007728737092352053508716373210
title: CVE-2019-16712 imagemagick
description:
ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by WritePS3Image.


definition_id: oval:org.debian:def:212389347604225692396692901606086618118
title: CVE-2019-16714 linux
description:
In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos and flags fields are not initialized.


definition_id: oval:org.debian:def:146200790456988306577734896398040424701
title: CVE-2019-16746 linux
description:
An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of variable elements in a beacon head, leading to a buffer overflow.


definition_id: oval:org.debian:def:235621687299741638093005863447472271793
title: CVE-2019-16760 cargo
description:
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency, which could be squatted on crates.io to be a malicious package. This not only affects manifests that you write locally yourself, but also manifests published to crates.io. Rust 1.0.0 through Rust 1.25.0 is affected by this advisory because Cargo will ignore the `package` key in manifests. Rust 1.26.0 through Rust 1.30.0 are not affected and typically will emit an error because the `package` key is unstable. Rust 1.31.0 and after are not affected because Cargo understands the `package` key. Users of the affected versions are strongly encouraged to update their compiler to the latest available one. Preventing this issue from happening requires updating your compiler to be either Rust 1.26.0 or newer. There will be no point release for Rust versions prior to 1.26.0. Users of Rust 1.19.0 to Rust 1.25.0 can instead apply linked patches to mitigate the issue.


definition_id: oval:org.debian:def:312178518636716643330524895584578245876
title: CVE-2019-16770 puma
description:
In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.


definition_id: oval:org.debian:def:115276644769379744115296652348684043022
title: CVE-2019-16775 npm
description:
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.


definition_id: oval:org.debian:def:158597457919629676098798957913717099557
title: CVE-2019-16776 npm
description:
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.


definition_id: oval:org.debian:def:303690185114816992812620903439135857494
title: CVE-2019-16777 npm
description:
Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.


definition_id: oval:org.debian:def:235814933414446923982426092820579903286
title: CVE-2019-16785 waitress
description:
Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.


definition_id: oval:org.debian:def:176128291432853599595489336484707517608
title: CVE-2019-16786 waitress
description:
Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.


definition_id: oval:org.debian:def:76753747608835566975710338857018386124
title: CVE-2019-16789 waitress
description:
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.


definition_id: oval:org.debian:def:284360964149625764275044929253728153807
title: CVE-2019-16792 waitress
description:
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.


definition_id: oval:org.debian:def:210912423602577539642770201536757551215
title: CVE-2019-16910 mbedtls
description:
Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. (For Mbed TLS, the fix is also available in versions 2.7.12 and 2.16.3.)


definition_id: oval:org.debian:def:130893849955878849150881923471397688102
title: CVE-2019-16935 python2.7
description:
The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.


definition_id: oval:org.debian:def:246867131430096160430138788319869111678
title: CVE-2019-16994 linux
description:
In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails to register sitn->fb_tunnel_dev, which may cause denial of service, aka CID-07f12b26e21a.


definition_id: oval:org.debian:def:286309490764350958443241543033033181199
title: CVE-2019-16995 linux
description:
In the Linux kernel before 5.0.3, a memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c if hsr_add_port fails to add a port, which may cause denial of service, aka CID-6caabe7f197d.


definition_id: oval:org.debian:def:172367434497799130855382271636292473404
title: CVE-2019-17041 rsyslog
description:
An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.


definition_id: oval:org.debian:def:92722134908052177791239996710558288854
title: CVE-2019-17042 rsyslog
description:
An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon), but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.


definition_id: oval:org.debian:def:76329355145968173613037081203796666670
title: CVE-2019-17052 linux
description:
ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-0614e2b73768.


definition_id: oval:org.debian:def:76368318600809478025901457203431279344
title: CVE-2019-17053 linux
description:
ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-e69dbd4619e7.


definition_id: oval:org.debian:def:111432981898665932032059970877155930210
title: CVE-2019-17054 linux
description:
atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-6cc03e8aa36c.


definition_id: oval:org.debian:def:189618674469819771071617791712927312909
title: CVE-2019-17055 linux
description:
base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-b91ee4aa2a21.


definition_id: oval:org.debian:def:235737894707996596460602890887901968713
title: CVE-2019-17056 linux
description:
llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-3a359798b176.


definition_id: oval:org.debian:def:297675322948729791190048311818279919665
title: CVE-2019-17075 linux
description:
An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable. This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance.


definition_id: oval:org.debian:def:86360401954420406368927527008790165599
title: CVE-2019-17133 linux
description:
In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow.


definition_id: oval:org.debian:def:248115395424470652661610740052584558886
title: CVE-2019-17134 octavia
description:
Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.


definition_id: oval:org.debian:def:310211930573399793973895418816376750303
title: CVE-2019-17177 freerdp2
description:
libfreerdp/codec/region.c in FreeRDP through 1.1.x and 2.x through 2.0.0-rc4 has memory leaks because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value.


definition_id: oval:org.debian:def:135216502893380377088993205853930064590
title: CVE-2019-17178 freerdp2
description:
HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory leak because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value.


definition_id: oval:org.debian:def:163864733585847324386176906114979665910
title: CVE-2019-17185 freeradius
description:
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.


definition_id: oval:org.debian:def:121075191677659579630352496100696332290
title: CVE-2019-17267 jackson-databind
description:
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.


definition_id: oval:org.debian:def:295929929442209988507926874349931711160
title: CVE-2019-17351 linux
description:
An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of service because of unrestricted resource consumption during the mapping of guest memory, aka CID-6ef36ab967c7.


definition_id: oval:org.debian:def:262336015354987642997820813377986313322
title: CVE-2019-17402 exiv2
description:
Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.


definition_id: oval:org.debian:def:311464586307764953119498512441594027927
title: CVE-2019-17455 libntlm
description:
Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request.


definition_id: oval:org.debian:def:124779050838439406443746425045165055946
title: CVE-2019-17531 jackson-databind
description:
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.


definition_id: oval:org.debian:def:185542516359351896489999928378579068698
title: CVE-2019-17545 gdal
description:
GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.


definition_id: oval:org.debian:def:327504585808553216698783842729375968638
title: CVE-2019-17566 batik
description:
Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.


definition_id: oval:org.debian:def:48794739022754076681824077681585979594
title: CVE-2019-17594 ncurses
description:
There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.


definition_id: oval:org.debian:def:216521797059148603913879223668016591287
title: CVE-2019-17595 ncurses
description:
There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.


definition_id: oval:org.debian:def:90617776717862767401606505188048932017
title: CVE-2019-17666 linux
description:
rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow.


definition_id: oval:org.debian:def:111506632962308211454251787107750545583
title: CVE-2019-17670 wordpress
description:
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.


definition_id: oval:org.debian:def:20604520701608763869056945697193287114
title: CVE-2019-1785 clamav
description:
A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper error-handling mechanisms when processing nested RAR files sent to an affected device. An attacker could exploit this vulnerability by sending a crafted RAR file to an affected device. An exploit could allow the attacker to view or create arbitrary files on the targeted system.


definition_id: oval:org.debian:def:20463540933798944989501373533761840382
title: CVE-2019-1786 clamav
description:
A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an affected device. An attacker could exploit this vulnerability by sending crafted PDF files to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device.


definition_id: oval:org.debian:def:171610327564997121999219259667716022918
title: CVE-2019-1787 clamav
description:
A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an affected device. An attacker could exploit this vulnerability by sending crafted PDF files to an affected device. A successful exploit could allow the attacker to cause a heap buffer out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device.


definition_id: oval:org.debian:def:331539542683705029049296717330824965479
title: CVE-2019-1788 clamav
description:
A vulnerability in the Object Linking & Embedding (OLE2) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for OLE2 files sent an affected device. An attacker could exploit this vulnerability by sending malformed OLE2 files to the device running an affected version ClamAV Software. An exploit could allow the attacker to cause an out-of-bounds write condition, resulting in a crash that could result in a denial of service condition on an affected device.


definition_id: oval:org.debian:def:169003923508552289214019938965375881280
title: CVE-2019-1789 clamav
description:
ClamAV versions prior to 0.101.2 are susceptible to a denial of service (DoS) vulnerability. An out-of-bounds heap read condition may occur when scanning PE files. An example is Windows EXE and DLL files that have been packed using Aspack as a result of inadequate bound-checking.


definition_id: oval:org.debian:def:163129224133583355326046585102824881381
title: CVE-2019-1798 clamav
description:
A vulnerability in the Portable Executable (PE) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for PE files sent an affected device. An attacker could exploit this vulnerability by sending malformed PE files to the device running an affected version ClamAV Software. An exploit could allow the attacker to cause an out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device.


definition_id: oval:org.debian:def:201613024591871400745672325196392729612
title: CVE-2019-18197 libxslt
description:
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.


definition_id: oval:org.debian:def:282917656965111035016464188654713257782
title: CVE-2019-18222 mbedtls
description:
The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.


definition_id: oval:org.debian:def:58794466112214623665257937653375991522
title: CVE-2019-18277 haproxy
description:
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).


definition_id: oval:org.debian:def:311921501607011860133861924892263328396
title: CVE-2019-18282 linux
description:
The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code.


definition_id: oval:org.debian:def:121319220875333159197058049579551444109
title: CVE-2019-18388 virglrenderer
description:
A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via malformed commands.


definition_id: oval:org.debian:def:2127111423140721947591741682849684412
title: CVE-2019-18389 virglrenderer
description:
A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service, or QEMU guest-to-host escape and code execution, via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.


definition_id: oval:org.debian:def:60431259989174074869053145302400685495
title: CVE-2019-18390 virglrenderer
description:
An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_BLIT commands.


definition_id: oval:org.debian:def:92710861710373262222423960969622165624
title: CVE-2019-18391 virglrenderer
description:
A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.


definition_id: oval:org.debian:def:19227779986063580220882875708905733380
title: CVE-2019-18610 asterisk
description:
An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.


definition_id: oval:org.debian:def:166295318691414883768517949761942299352
title: CVE-2019-18634 sudo
description:
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.


definition_id: oval:org.debian:def:64783072317677907926213865138297538928
title: CVE-2019-18660 linux
description:
The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c.


definition_id: oval:org.debian:def:172417400865569969238133254261902928563
title: CVE-2019-18675 linux
description:
The Linux kernel through 5.3.13 has a start_offset+size Integer Overflow in cpia2_remap_buffer in drivers/media/usb/cpia2/cpia2_core.c because cpia2 has its own mmap implementation. This allows local users (with /dev/video0 access) to obtain read and write permissions on kernel physical pages, which can possibly result in a privilege escalation.


definition_id: oval:org.debian:def:136807679720124574407281573987259700979
title: CVE-2019-18683 linux
description:
An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free.


definition_id: oval:org.debian:def:42887315230980910363384075186273402311
title: CVE-2019-18786 linux
description:
In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is uninitialized in rcar_drif_g_fmt_sdr_cap in drivers/media/platform/rcar_drif.c, which could cause a memory disclosure problem.


definition_id: oval:org.debian:def:252665967352795470354640375121395067444
title: CVE-2019-18790 asterisk
description:
An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.


definition_id: oval:org.debian:def:129142572504068265906999593663334758572
title: CVE-2019-18805 linux
description:
An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6.


definition_id: oval:org.debian:def:328625139257332946825387808066974553940
title: CVE-2019-18806 linux
description:
A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c in the Linux kernel before 5.3.5 allows local users to cause a denial of service (memory consumption) by triggering pci_dma_mapping_error() failures, aka CID-1acb8f2a7a9f.


definition_id: oval:org.debian:def:138704951105644821509685019185926912354
title: CVE-2019-18808 linux
description:
A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-128c66429247.


definition_id: oval:org.debian:def:114981620773302751671120030774778502340
title: CVE-2019-18809 linux
description:
A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559.


definition_id: oval:org.debian:def:259227955466490723872398254131682434548
title: CVE-2019-18813 linux
description:
A memory leak in the dwc3_pci_probe() function in drivers/usb/dwc3/dwc3-pci.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering platform_device_add_properties() failures, aka CID-9bbfceea12a8.


definition_id: oval:org.debian:def:119357268179844868562438907768411545910
title: CVE-2019-18814 linux
description:
An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/audit.c.


definition_id: oval:org.debian:def:312967804978666152161602519072341629632
title: CVE-2019-18849 tnef
description:
In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup.


definition_id: oval:org.debian:def:149460329312917676939423624360089950865
title: CVE-2019-18862 mailutils
description:
maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode.


definition_id: oval:org.debian:def:134939669704704432756286262746148820427
title: CVE-2019-18885 linux
description:
fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verify_dev_extents NULL pointer dereference via a crafted btrfs image because fs_devices->devices is mishandled within find_device, aka CID-09ba3bc9dd15.


definition_id: oval:org.debian:def:164905055514242502752112617943271861716
title: CVE-2019-18928 cyrus-imapd
description:
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.


definition_id: oval:org.debian:def:253865153744681806912087290005756858324
title: CVE-2019-18976 asterisk
description:
An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940.


definition_id: oval:org.debian:def:130490965763502915348795692123495404059
title: CVE-2019-19010 limnoria
description:
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.


definition_id: oval:org.debian:def:247919996620187129211591217474280214969
title: CVE-2019-19036 linux
description:
btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_dereference(root->node) can be zero.


definition_id: oval:org.debian:def:26257627037074414978399538619112471537
title: CVE-2019-19037 linux
description:
ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DIRENT_HTREE) can be zero.


definition_id: oval:org.debian:def:245064982407682217145149879134079826005
title: CVE-2019-19039 linux
description:
** DISPUTED ** __btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program. NOTE: The BTRFS development team disputes this issues as not being a vulnerability because “1) The kernel provide facilities to restrict access to dmesg - dmesg_restrict=1 sysctl option. So it's really up to the system administrator to judge whether dmesg access shall be disallowed or not. 2) WARN/WARN_ON are widely used macros in the linux kernel. If this CVE is considered valid this would mean there are literally thousands CVE lurking in the kernel - something which clearly is not the case.”


definition_id: oval:org.debian:def:122265436948239287951107892338178098856
title: CVE-2019-19045 linux
description:
A memory leak in the mlx5_fpga_conn_create_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mlx5_vector2eqn() failures, aka CID-c8c2a057fdc7.


definition_id: oval:org.debian:def:227502064298342766507083068659592217040
title: CVE-2019-19046 linux
description:
** DISPUTED ** A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering ida_simple_get() failure, aka CID-4aa7afb0ee20. NOTE: third parties dispute the relevance of this because an attacker cannot realistically control this failure at probe time.


definition_id: oval:org.debian:def:142458148969611238212666583079414166203
title: CVE-2019-19048 linux
description:
A memory leak in the crypto_reportstat() function in drivers/virt/vboxguest/vboxguest_utils.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering copy_form_user() failures, aka CID-e0b0cb938864.


definition_id: oval:org.debian:def:322729430008753805718707136670431033551
title: CVE-2019-19049 linux
description:
** DISPUTED ** A memory leak in the unittest_data_add() function in drivers/of/unittest.c in the Linux kernel before 5.3.10 allows attackers to cause a denial of service (memory consumption) by triggering of_fdt_unflatten_tree() failures, aka CID-e13de8fe0d6a. NOTE: third parties dispute the relevance of this because unittest.c can only be reached during boot.


definition_id: oval:org.debian:def:317560085824342620595311306362643681486
title: CVE-2019-19051 linux
description:
A memory leak in the i2400m_op_rfkill_sw_toggle() function in drivers/net/wimax/i2400m/op-rfkill.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-6f3ef5c25cc7.


definition_id: oval:org.debian:def:327348178424932063850049522196401421731
title: CVE-2019-19052 linux
description:
A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-fb5be6a7b486.


definition_id: oval:org.debian:def:246910243634854965729697785934192140347
title: CVE-2019-19054 linux
description:
A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering kfifo_alloc() failures, aka CID-a7b2df76b42b.


definition_id: oval:org.debian:def:136621098611020484793928858907779493991
title: CVE-2019-19056 linux
description:
A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-db8fd2cde932.


definition_id: oval:org.debian:def:4383031795442807883472045606651074150
title: CVE-2019-19057 linux
description:
Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-d10dcb615c8e.


definition_id: oval:org.debian:def:139728878132107557022980376650523058214
title: CVE-2019-19058 linux
description:
A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering alloc_page() failures, aka CID-b4b814fec1a5.


definition_id: oval:org.debian:def:175944333113203188707062934192143247840
title: CVE-2019-19059 linux
description:
Multiple memory leaks in the iwl_pcie_ctxt_info_gen3_init() function in drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering iwl_pcie_init_fw_sec() or dma_alloc_coherent() failures, aka CID-0f4f199443fa.


definition_id: oval:org.debian:def:133042013442992409490886713248246189229
title: CVE-2019-19060 linux
description:
A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-ab612b1daf41.


definition_id: oval:org.debian:def:146422228378615191680979089929731220371
title: CVE-2019-19061 linux
description:
A memory leak in the adis_update_scan_mode_burst() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-9c0530e898f3.


definition_id: oval:org.debian:def:13828042443824516811833155782630932715
title: CVE-2019-19062 linux
description:
A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042.


definition_id: oval:org.debian:def:31983823699302963243328618993545962205
title: CVE-2019-19063 linux
description:
Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption), aka CID-3f9361695113.


definition_id: oval:org.debian:def:25646490365615318496152119137930843049
title: CVE-2019-19065 linux
description:
** DISPUTED ** A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering rhashtable_init() failures, aka CID-34b3be18a04e. NOTE: This has been disputed as not a vulnerability because "rhashtable_init() can only fail if it is passed invalid values in the second parameter's struct, but when invoked from sdma_init() that is a pointer to a static const struct, so an attacker could only trigger failure if they could corrupt kernel memory (in which case a small memory leak is not a significant problem)."


definition_id: oval:org.debian:def:322518633570071449830617687309007054217
title: CVE-2019-19066 linux
description:
A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering bfa_port_get_stats() failures, aka CID-0e62395da2bd.


definition_id: oval:org.debian:def:277445724134572587291582722169654678966
title: CVE-2019-19067 linux
description:
** DISPUTED ** Four memory leaks in the acp_hw_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption) by triggering mfd_add_hotplug_devices() or pm_genpd_add_device() failures, aka CID-57be09c6e874. NOTE: third parties dispute the relevance of this because the attacker must already have privileges for module loading.


definition_id: oval:org.debian:def:184924619749294573150847265176173006606
title: CVE-2019-19068 linux
description:
A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-a2cdd07488e6.


definition_id: oval:org.debian:def:88832532256280155860809750637232097561
title: CVE-2019-19071 linux
description:
A memory leak in the rsi_send_beacon() function in drivers/net/wireless/rsi/rsi_91x_mgmt.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering rsi_prepare_beacon() failures, aka CID-d563131ef23c.


definition_id: oval:org.debian:def:163410846105660073388464692815489802326
title: CVE-2019-19072 linux
description:
A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-96c5c6e6a5b6.


definition_id: oval:org.debian:def:325472723437770872023722991199348991473
title: CVE-2019-19073 linux
description:
Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout() failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, and the htc_connect_service() function, aka CID-853acf7caf10.


definition_id: oval:org.debian:def:138745576953706029994313246446340058324
title: CVE-2019-19074 linux
description:
A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4.


definition_id: oval:org.debian:def:189196942051485155706478675874064188100
title: CVE-2019-19075 linux
description:
A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering ca8210_get_platform_data() failures, aka CID-6402939ec86e.


definition_id: oval:org.debian:def:187859207152238691982802913052649266864
title: CVE-2019-19077 linux
description:
A memory leak in the bnxt_re_create_srq() function in drivers/infiniband/hw/bnxt_re/ib_verbs.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering copy to udata failures, aka CID-4a9d46a9fe14.


definition_id: oval:org.debian:def:124850603434463393544390469502431594637
title: CVE-2019-19078 linux
description:
A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-b8d17e7d93d2.


definition_id: oval:org.debian:def:73151291657248084723836720396622054655
title: CVE-2019-19079 linux
description:
A memory leak in the qrtr_tun_write_iter() function in net/qrtr/tun.c in the Linux kernel before 5.3 allows attackers to cause a denial of service (memory consumption), aka CID-a21b7f0cff19.


definition_id: oval:org.debian:def:71652554045732540862001314161367098036
title: CVE-2019-19080 linux
description:
Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attackers to cause a denial of service (memory consumption), aka CID-8572cea1461a.


definition_id: oval:org.debian:def:83969742388517281994786967797522259657
title: CVE-2019-19081 linux
description:
A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attackers to cause a denial of service (memory consumption), aka CID-8ce39eb5a67a.


definition_id: oval:org.debian:def:303088005695545063680658391399271812481
title: CVE-2019-19082 linux
description:
Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption). This affects the dce120_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the dce110_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c, the dce100_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the dcn10_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, and the dce112_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c, aka CID-104c307147ad.


definition_id: oval:org.debian:def:158158643591699412771810892147899785615
title: CVE-2019-19126 glibc
description:
On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.


definition_id: oval:org.debian:def:242551095624230113841043923835797517212
title: CVE-2019-19221 libarchive
description:
In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive.


definition_id: oval:org.debian:def:308756703323345987868663514005737506561
title: CVE-2019-19227 linux
description:
In the AppleTalk subsystem in the Linux kernel before 5.1, there is a potential NULL pointer dereference because register_snap_client may return NULL. This will lead to denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c, as demonstrated by unregister_snap_client, aka CID-9804501fa122.


definition_id: oval:org.debian:def:160091642697034950410364220861891632830
title: CVE-2019-19252 linux
description:
vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access to vcsu devices, aka CID-0c9acb1af77a.


definition_id: oval:org.debian:def:83646003527160592802169322365881563090
title: CVE-2019-19269 proftpd-dfsg
description:
An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL sk_X509_REVOKED_value() function when encountering an empty CRL installed by a system administrator. The dereference occurs when validating the certificate of a client connecting to the server in a TLS client/server mutual-authentication setup.


definition_id: oval:org.debian:def:139228302471797144600954415666935243147
title: CVE-2019-19270 proftpd-dfsg
description:
An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rather than once for subject and once for issuer) prevents some valid CRLs from being taken into account, and can allow clients whose certificates have been revoked to proceed with a connection to the server.


definition_id: oval:org.debian:def:23814114879599300518794866716904731006
title: CVE-2019-19271 proftpd-dfsg
description:
An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries (installed by a system administrator), can cause some CRL entries to be ignored, and can allow clients whose certificates have been revoked to proceed with a connection to the server.


definition_id: oval:org.debian:def:157804678103304705342662422688777896764
title: CVE-2019-19272 proftpd-dfsg
description:
An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. Direct dereference of a NULL pointer (a variable initialized to NULL) leads to a crash when validating the certificate of a client connecting to the server in a TLS client/server mutual-authentication setup.


definition_id: oval:org.debian:def:66934777135240745751646001950994596051
title: CVE-2019-19318 linux
description:
In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in kernel/locking/rwsem.c) rwsem_owner_flags returns an already freed pointer,


definition_id: oval:org.debian:def:2893919982359046267825978073646359231
title: CVE-2019-19319 linux
description:
In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access because of an ext4_xattr_set_entry use-after-free in fs/ext4/xattr.c when a large old_size value is used in a memset call, aka CID-345c0dbf3a30.


definition_id: oval:org.debian:def:22417661021047146896061535732765196018
title: CVE-2019-19332 linux
description:
An out-of-bounds memory write issue was found in the way the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulting in a denial of service.


definition_id: oval:org.debian:def:203573092512263168985351269743574377302
title: CVE-2019-19333 libyang
description:
In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "bits". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.


definition_id: oval:org.debian:def:48992219416069187034431142946164587052
title: CVE-2019-19334 libyang
description:
In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.


definition_id: oval:org.debian:def:143341867849063191046407679726922597692
title: CVE-2019-19377 linux
description:
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c.


definition_id: oval:org.debian:def:26194070909629919362991168765972369940
title: CVE-2019-19447 linux
description:
In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list in fs/ext4/super.c.


definition_id: oval:org.debian:def:142109655407161898609644722989596862787
title: CVE-2019-19448 linux
description:
In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure.


definition_id: oval:org.debian:def:303110715792162847311438201860298464193
title: CVE-2019-19479 opensc
description:
An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SETCOS file attribute.


definition_id: oval:org.debian:def:144700890516828146223109249049826008762
title: CVE-2019-19481 opensc
description:
An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-cac1.c mishandles buffer limits for CAC certificates.


definition_id: oval:org.debian:def:150393073060429664499422776811426488382
title: CVE-2019-19523 linux
description:
In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux.c driver, aka CID-44efc269db79.


definition_id: oval:org.debian:def:60099697987091381146184569792509089801
title: CVE-2019-19524 linux
description:
In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9.


definition_id: oval:org.debian:def:280738072997990195977135460975518769371
title: CVE-2019-19525 linux
description:
In the Linux kernel before 5.3.6, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/atusb.c driver, aka CID-7fd25e6fc035.


definition_id: oval:org.debian:def:274962016463006255500677542373432965998
title: CVE-2019-19526 linux
description:
In the Linux kernel before 5.3.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c driver, aka CID-6af3aa57a098.


definition_id: oval:org.debian:def:17235730589543112039474836685286142300
title: CVE-2019-19527 linux
description:
In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver, aka CID-9c09b214f30e.


definition_id: oval:org.debian:def:78592337657393124856532620353086070405
title: CVE-2019-19528 linux
description:
In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver, aka CID-edc4746f253d.


definition_id: oval:org.debian:def:257735620829264428680052330314881770565
title: CVE-2019-19529 linux
description:
In the Linux kernel before 5.3.11, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/can/usb/mcba_usb.c driver, aka CID-4d6636498c41.


definition_id: oval:org.debian:def:82174509353658099093763391921706887630
title: CVE-2019-19530 linux
description:
In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver, aka CID-c52873e5a1ef.


definition_id: oval:org.debian:def:293663264470682431461971986998979707114
title: CVE-2019-19531 linux
description:
In the Linux kernel before 5.2.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/yurex.c driver, aka CID-fc05481b2fca.


definition_id: oval:org.debian:def:136762397338697057869781559908523818591
title: CVE-2019-19532 linux
description:
In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kernel HID drivers, aka CID-d9d4b1e46d95. This affects drivers/hid/hid-axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c, drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c, drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c, drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c, drivers/hid/hid-logitech-hidpp.c, drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c, drivers/hid/hid-tmff.c, and drivers/hid/hid-zpff.c.


definition_id: oval:org.debian:def:43658479158386939189438553988709252138
title: CVE-2019-19533 linux
description:
In the Linux kernel before 5.3.4, there is an info-leak bug that can be caused by a malicious USB device in the drivers/media/usb/ttusb-dec/ttusb_dec.c driver, aka CID-a10feaf8c464.


definition_id: oval:org.debian:def:200876685534750396013437816259076151083
title: CVE-2019-19534 linux
description:
In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka CID-f7a1337f0d29.


definition_id: oval:org.debian:def:51468481417001770954509550103306231352
title: CVE-2019-19535 linux
description:
In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driver, aka CID-30a8beeb3042.


definition_id: oval:org.debian:def:47682711558951772943511155251090152381
title: CVE-2019-19536 linux
description:
In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_pro.c driver, aka CID-ead16e53c2f0.


definition_id: oval:org.debian:def:299003807498690585396917628158983557824
title: CVE-2019-19537 linux
description:
In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9. This affects drivers/usb/core/file.c.


definition_id: oval:org.debian:def:142628401622235237467710002878541111798
title: CVE-2019-19543 linux
description:
In the Linux kernel before 5.1.6, there is a use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c.


definition_id: oval:org.debian:def:163823433034389416245620382608193026088
title: CVE-2019-19553 wireshark
description:
In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/asn1/cms/packet-cms-template.c by ensuring that an object identifier is set to NULL after a ContentInfo dissection.


definition_id: oval:org.debian:def:171405542727701196740626521533096338551
title: CVE-2019-19555 fig2dev
description:
read_textobject in read.c in Xfig fig2dev 3.2.7b has a stack-based buffer overflow because of an incorrect sscanf.


definition_id: oval:org.debian:def:298480599946756875606470129628442639181
title: CVE-2019-19630 htmldoc
description:
HTMLDOC 1.9.7 allows a stack-based buffer overflow in the hd_strlcpy() function in string.c (when called from render_contents in ps-pdf.cxx) via a crafted HTML document.


definition_id: oval:org.debian:def:249589107443741870298203533189389515760
title: CVE-2019-19721 vlc
description:
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.


definition_id: oval:org.debian:def:188685100002950666833633438196527021285
title: CVE-2019-19746 fig2dev
description:
make_arrow in arrow.c in Xfig fig2dev 3.2.7b allows a segmentation fault and out-of-bounds write because of an integer overflow via a large arrow type.


definition_id: oval:org.debian:def:105951260510859638163169741525738858957
title: CVE-2019-19767 linux
description:
The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163.


definition_id: oval:org.debian:def:111227927318486145945328813649887555991
title: CVE-2019-19768 linux
description:
In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer).


definition_id: oval:org.debian:def:327010901078360245886344826653232979766
title: CVE-2019-19770 linux
description:
** DISPUTED ** In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously created with a call to another debugfs function such as debugfs_create_file). NOTE: Linux kernel developers dispute this issue as not being an issue with debugfs, instead this is an issue with misuse of debugfs within blktrace.


definition_id: oval:org.debian:def:38361483621780716930300293932033099423
title: CVE-2019-19813 linux
description:
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in __mutex_lock in kernel/locking/mutex.c. This is related to mutex_can_spin_on_owner in kernel/locking/mutex.c, __btrfs_qgroup_free_meta in fs/btrfs/qgroup.c, and btrfs_insert_delayed_items in fs/btrfs/delayed-inode.c.


definition_id: oval:org.debian:def:258069254770215208650730584282501654159
title: CVE-2019-19815 linux
description:
In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause a NULL pointer dereference in f2fs_recover_fsync_data in fs/f2fs/recovery.c. This is related to F2FS_P_SB in fs/f2fs/f2fs.h.


definition_id: oval:org.debian:def:269660680709503753112749661850552249688
title: CVE-2019-19816 linux
description:
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a value of 1 for the number of data stripes is mishandled.


definition_id: oval:org.debian:def:131637966857985195778350455659050907333
title: CVE-2019-19886 modsecurity
description:
Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or unresponsive (Denial of Service) because of a flaw in Transaction::addRequestHeader in transaction.cc.


definition_id: oval:org.debian:def:50568712632659218986974396244665581796
title: CVE-2019-19919 node-handlebars
description:
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.


definition_id: oval:org.debian:def:83551039473845141419121365695795310574
title: CVE-2019-19922 linux
description:
kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)


definition_id: oval:org.debian:def:25672026130174845348380844067573193828
title: CVE-2019-19923 sqlite3
description:
flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).


definition_id: oval:org.debian:def:245404496118784544233064186303792213126
title: CVE-2019-19925 sqlite3
description:
zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.


definition_id: oval:org.debian:def:296619410792215824094987238781471356624
title: CVE-2019-19927 linux
description:
In the Linux kernel 5.0.0-rc7 (as distributed in ubuntu/linux.git on kernel.ubuntu.com), mounting a crafted f2fs filesystem image and performing some operations can lead to slab-out-of-bounds read access in ttm_put_pages in drivers/gpu/drm/ttm/ttm_page_alloc.c. This is related to the vmwgfx or ttm module.


definition_id: oval:org.debian:def:308070244460013067578788398238203628162
title: CVE-2019-19947 linux
description:
In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c driver, aka CID-da2311a6385c.


definition_id: oval:org.debian:def:179271421814107047128611322434810558566
title: CVE-2019-19956 libxml2
description:
xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.


definition_id: oval:org.debian:def:255245007497957239257611089943891203150
title: CVE-2019-19959 sqlite3
description:
ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.


definition_id: oval:org.debian:def:133623563158864683090535898504383783492
title: CVE-2019-19965 linux
description:
In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition, aka CID-f70267f379b5.


definition_id: oval:org.debian:def:138764669854702362464192913090806261999
title: CVE-2019-19966 linux
description:
In the Linux kernel before 5.1.6, there is a use-after-free in cpia2_exit() in drivers/media/usb/cpia2/cpia2_v4l.c that will cause denial of service, aka CID-dea37a972655.


definition_id: oval:org.debian:def:306295267729350726415497868476186592763
title: CVE-2019-20054 linux
description:
In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e.


definition_id: oval:org.debian:def:21232755508174389139320498409094864932
title: CVE-2019-20063 libmysofa
description:
hdf/dataobject.c in libmysofa before 0.8 has an uninitialized use of memory, as demonstrated by mysofa2json.


definition_id: oval:org.debian:def:214538767941385903972335072172411717086
title: CVE-2019-20095 linux
description:
mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82. This will cause a memory leak and denial of service.


definition_id: oval:org.debian:def:36673263326045577242953182722282596751
title: CVE-2019-20096 linux
description:
In the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause denial of service, aka CID-1d3ff0950e2b.


definition_id: oval:org.debian:def:191027681040104222845963450504534055915
title: CVE-2019-20149 node-kind-of
description:
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.


definition_id: oval:org.debian:def:270101423708694394866658072314486512274
title: CVE-2019-20218 sqlite3
description:
selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.


definition_id: oval:org.debian:def:91907952745047249896732731005485628764
title: CVE-2019-2024 linux
description:
In em28xx_unregister_dvb of em28xx-dvb.c, there is a possible use after free issue. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-111761954References: Upstream kernel


definition_id: oval:org.debian:def:328200305685287842203849681286129018148
title: CVE-2019-2025 linux
description:
In binder_thread_read of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-116855682References: Upstream kernel


definition_id: oval:org.debian:def:294517750377389732757800441059546318503
title: CVE-2019-20326 gthumb
description:
A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file.


definition_id: oval:org.debian:def:227901207226897576445711008188016707852
title: CVE-2019-20367 libbsd
description:
nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).


definition_id: oval:org.debian:def:16535088335790005100620268489449694345
title: CVE-2019-20372 nginx
description:
NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.


definition_id: oval:org.debian:def:82636169958370536901905206022532988070
title: CVE-2019-20387 libsolv
description:
repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input schema.


definition_id: oval:org.debian:def:323175371303361975105335230279567553351
title: CVE-2019-20446 librsvg
description:
In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.


definition_id: oval:org.debian:def:96060310797409284964343460183481086523
title: CVE-2019-2054 linux
description:
In the seccomp implementation prior to kernel version 4.8, there is a possible seccomp bypass due to seccomp policies that allow the use of ptrace. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-119769499


definition_id: oval:org.debian:def:140262128046156856288918379698178946548
title: CVE-2019-20636 linux
description:
In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode table, as demonstrated by input_set_keycode, aka CID-cb222aed03d7.


definition_id: oval:org.debian:def:109862333063369073970598149110002071083
title: CVE-2019-20788 libvncserver
description:
libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.


definition_id: oval:org.debian:def:205213190889967950417499093601378048182
title: CVE-2019-20792 opensc
description:
OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.


definition_id: oval:org.debian:def:33224938232582097778039601883410758045
title: CVE-2019-20806 linux
description:
An issue was discovered in the Linux kernel before 5.2. There is a NULL pointer dereference in tw5864_handle_frame() in drivers/media/pci/tw5864/tw5864-video.c, which may cause denial of service, aka CID-2e7682ebfc75.


definition_id: oval:org.debian:def:326598770115820884243744031398806233149
title: CVE-2019-20807 vim
description:
In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).


definition_id: oval:org.debian:def:111454776380518841680576224673430249605
title: CVE-2019-20810 linux
description:
go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586.


definition_id: oval:org.debian:def:239801730614053771283378845107146128904
title: CVE-2019-20811 linux
description:
An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.


definition_id: oval:org.debian:def:307207915138451006296308412339591360166
title: CVE-2019-20812 linux
description:
An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3, aka CID-b43d1f9f7067.


definition_id: oval:org.debian:def:13052679075584063318447037264694071696
title: CVE-2019-20839 libvncserver
description:
libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.


definition_id: oval:org.debian:def:146321405429678531107420094620511093325
title: CVE-2019-20907 python3.7
description:
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.


definition_id: oval:org.debian:def:246900256545053518345662486801221062749
title: CVE-2019-20908 linux
description:
An issue was discovered in drivers/firmware/efi/efi.c in the Linux kernel before 5.4. Incorrect access permissions for the efivar_ssdt ACPI variable could be used by attackers to bypass lockdown or secure boot restrictions, aka CID-1957a85b0032.


definition_id: oval:org.debian:def:131396078538212089591264220843246143421
title: CVE-2019-20919 libdbi-perl
description:
An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference.


definition_id: oval:org.debian:def:13445489936190913793808391849416601106
title: CVE-2019-20920 node-handlebars
description:
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).


definition_id: oval:org.debian:def:64473485221423591586497640373387728206
title: CVE-2019-20934 linux
description:
An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats() because NUMA fault statistics are inappropriately freed, aka CID-16d51a590a8c.


definition_id: oval:org.debian:def:272405959951910989268158669441409656456
title: CVE-2019-2101 linux
description:
In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-111760968.


definition_id: oval:org.debian:def:210427611881883010839253642700122058236
title: CVE-2019-2180 cups
description:
In ippSetValueTag of ipp.c in Android 8.0, 8.1 and 9, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure from the printer service with no additional execution privileges needed. User interaction is not needed for exploitation.


definition_id: oval:org.debian:def:323951668421975076766810988872556910355
title: CVE-2019-2182 linux
description:
In the Android kernel in the kernel MMU code there is a possible execution path leaving some kernel text and rodata pages writable. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.


definition_id: oval:org.debian:def:177462467220060029782730477950532296532
title: CVE-2019-2201 libjpeg-turbo
description:
In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-120551338


definition_id: oval:org.debian:def:301424335558568226318462983207949820434
title: CVE-2019-2213 linux
description:
In binder_free_transaction of binder.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-133758011References: Upstream kernel


definition_id: oval:org.debian:def:279949368967008822244685026114528494135
title: CVE-2019-2215 linux
description:
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095


definition_id: oval:org.debian:def:20619067311188709847686253383119787900
title: CVE-2019-2228 cups
description:
In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196


definition_id: oval:org.debian:def:274993239883688872164662809571005475048
title: CVE-2019-2391 node-mongodb
description:
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.


definition_id: oval:org.debian:def:310238569363536972250016683939133091116
title: CVE-2019-2422 openjdk-11
description:
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).


definition_id: oval:org.debian:def:307316442981791850469397876136291715822
title: CVE-2019-25013 glibc
description:
The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.


definition_id: oval:org.debian:def:244056305003393773617990638077608752524
title: CVE-2019-25045 linux
description:
An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free, related to an xfrm_state_fini panic, aka CID-dbb2483b2a46.


definition_id: oval:org.debian:def:322639890607810079963603953231205891250
title: CVE-2019-25059 ghostscript
description:
Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839.


definition_id: oval:org.debian:def:183691216216058465117118776771183807581
title: CVE-2019-2510 mariadb-10.3
description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


definition_id: oval:org.debian:def:38855433374806056384907849212478452485
title: CVE-2019-2537 mariadb-10.3
description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


definition_id: oval:org.debian:def:231811682466481369652353686868654514988
title: CVE-2019-2602 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Java SE, Java SE Embedded. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).


definition_id: oval:org.debian:def:168113690375345417162795359707959324514
title: CVE-2019-2614 mariadb-10.3
description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).


definition_id: oval:org.debian:def:116513792311943113913660132333805469498
title: CVE-2019-2627 mariadb-10.3
description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


definition_id: oval:org.debian:def:218660118285044233735520525379161379776
title: CVE-2019-2628 mariadb-10.3
description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


definition_id: oval:org.debian:def:241699912843906132474952813435503394273
title: CVE-2019-2684 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).


definition_id: oval:org.debian:def:189328016018677731271467817156250235375
title: CVE-2019-2698 openjdk-11
description:
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).


definition_id: oval:org.debian:def:84296381018014637254680320393961520144
title: CVE-2019-2737 mariadb-10.3
description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Pluggable Auth). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


definition_id: oval:org.debian:def:265134491989701913119679255980212500949
title: CVE-2019-2739 mariadb-10.3
description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).


definition_id: oval:org.debian:def:63903273864426472840032407530350473730
title: CVE-2019-2740 mariadb-10.3
description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: XML). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).


definition_id: oval:org.debian:def:164685738753445568108406280344041797357
title: CVE-2019-2758 mariadb-10.3
description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).


definition_id: oval:org.debian:def:152443855445827880367529152630860807782
title: CVE-2019-2805 mariadb-10.3
description:
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).


definition_id: oval:org.debian:def:146877455401069511201580448879657477573
title: CVE-2019-2894 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).


definition_id: oval:org.debian:def:120828232959895016570880652999517322756
title: CVE-2019-2938 mariadb-10.3
description:
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).


definition_id: oval:org.debian:def:108241241314949033945531225345958586123
title: CVE-2019-2945 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).


definition_id: oval:org.debian:def:25376463105541548243956412411280968693
title: CVE-2019-2949 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Kerberos). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).


definition_id: oval:org.debian:def:246769275971249511818534077228592610116
title: CVE-2019-2962 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).


definition_id: oval:org.debian:def:176772592741169987739726991235173448961
title: CVE-2019-2964 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).


definition_id: oval:org.debian:def:53359181316114804595284771444149963962
title: CVE-2019-2973 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).


definition_id: oval:org.debian:def:280954175966452240127057108182625411076
title: CVE-2019-2974 mariadb-10.3
description:
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).


definition_id: oval:org.debian:def:181822874441137139073895980576005812984
title: CVE-2019-2975 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L).


definition_id: oval:org.debian:def:275543244673637768609331249942638975351
title: CVE-2019-2977 openjdk-11
description:
Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.8 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).


definition_id: oval:org.debian:def:198977958229022191376686055665586736154
title: CVE-2019-2978 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).


definition_id: oval:org.debian:def:66869789415712678351042583673724570146
title: CVE-2019-2983 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).


definition_id: oval:org.debian:def:259089611776884997652827742289426576545
title: CVE-2019-2987 openjdk-11
description:
Vulnerability in the Java SE product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).


definition_id: oval:org.debian:def:154130351691570477554148592496896023750
title: CVE-2019-2988 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).


definition_id: oval:org.debian:def:302096421552864796285161732564516323522
title: CVE-2019-2989 openjdk-11
description:
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 6.8 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N).


definition_id: oval:org.debian:def:124040752776325181522704903264137027705
title: CVE-2019-2999 openjdk-11
description:
Vulnerability in the Java SE product of Oracle Java SE (component: Javadoc). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).


definition_id: oval:org.debian:def:3066397411503933835964809578093932435
title: CVE-2019-3459 linux
description:
A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1.


definition_id: oval:org.debian:def:222009574273717171971467916890033711820
title: CVE-2019-3460 linux
description:
A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1.


definition_id: oval:org.debian:def:61167662451780203530538372655471806239
title: CVE-2019-3461 tmpreaper
description:
Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which could result in local privilege escalation. Mounting via rename() could potentially lead to a file being placed elsewhereon the filesystem hierarchy (e.g. /etc/cron.d/) if the directory being cleaned up was on the same physical filesystem. Fixed versions include 1.6.13+nmu1+deb9u1 and 1.6.14.


definition_id: oval:org.debian:def:27230053019941433412344568475848606748
title: CVE-2019-3462 apt
description:
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.


definition_id: oval:org.debian:def:184641713920266815340373103245240361052
title: CVE-2019-3466 postgresql-common
description:
The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.


definition_id: oval:org.debian:def:38938900692488946855455481308959310514
title: CVE-2019-3498 python-django
description:
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.


definition_id: oval:org.debian:def:282399451818125316724533387353078516369
title: CVE-2019-3500 aria2
description:
aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.


definition_id: oval:org.debian:def:89426845549486604004021134465232678057
title: CVE-2019-3573 libsixel
description:
In libsixel v1.8.2, there is an infinite loop in the function sixel_decode_raw_impl() in the file fromsixel.c, as demonstrated by sixel2png.


definition_id: oval:org.debian:def:203478204300818589208197574658913523854
title: CVE-2019-3574 libsixel
description:
In libsixel v1.8.2, there is a heap-based buffer over-read in the function load_jpeg() in the file loader.c, as demonstrated by img2sixel.


definition_id: oval:org.debian:def:72265202735442517425541690148106696415
title: CVE-2019-3689 nfs-utils
description:
The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.


definition_id: oval:org.debian:def:173884327867181577487230902988020951975
title: CVE-2019-3701 linux
description:
An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field. The privileged user "root" with CAP_NET_ADMIN can create a CAN frame modification rule that makes the data length code a higher value than the available CAN frame data size. In combination with a configured checksum calculation where the result is stored relatively to the end of the data (e.g. cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in skb_shared_info) can be rewritten which finally can cause a system crash. Because of a missing check, the CAN drivers may write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames.


definition_id: oval:org.debian:def:210495034021581547549353001863756250195
title: CVE-2019-3804 cockpit
description:
It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a specially crafted request with an invalid base64-encoded cookie which could cause the web service to crash.


definition_id: oval:org.debian:def:23847329009388326649571117874936004642
title: CVE-2019-3806 pdns-recursor
description:
An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.


definition_id: oval:org.debian:def:251718782472093209949357282486230826539
title: CVE-2019-3807 pdns-recursor
description:
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.


definition_id: oval:org.debian:def:217195150148279516474921282094700494402
title: CVE-2019-3812 qemu
description:
QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host.


definition_id: oval:org.debian:def:74081836512724665698423851899761340539
title: CVE-2019-3813 spice
description:
Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.


definition_id: oval:org.debian:def:159246560937564931460514804575054107342
title: CVE-2019-3814 dovecot
description:
It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users.


definition_id: oval:org.debian:def:17827360680519273550215563497883228040
title: CVE-2019-3819 linux
description:
A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ("root") can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable.


definition_id: oval:org.debian:def:38878706206637119751952833127331822116
title: CVE-2019-3820 gnome-shell
description:
It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions.


definition_id: oval:org.debian:def:65980270921003886259136300786076588445
title: CVE-2019-3822 curl
description:
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.


definition_id: oval:org.debian:def:99488997459419904822537769805742599654
title: CVE-2019-3823 curl
description:
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.


definition_id: oval:org.debian:def:114234548366962141890764055107899886760
title: CVE-2019-3824 ldb
description:
A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.10. An authenticated user, having read permissions on the LDAP server, could use this flaw to cause denial of service.


definition_id: oval:org.debian:def:267259410615423495544180213106282083611
title: CVE-2019-3825 gdm3
description:
A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to expire, at which time they would gain access to the logged-in user's session.


definition_id: oval:org.debian:def:221589475446554508368403377085550420417
title: CVE-2019-3826 prometheus
description:
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.


definition_id: oval:org.debian:def:81394365664324478212271598027377407083
title: CVE-2019-3827 gvfs
description:
An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration.


definition_id: oval:org.debian:def:260055021943241870720363173249333064066
title: CVE-2019-3828 ansible
description:
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.


definition_id: oval:org.debian:def:323567011603224956892090060771453163143
title: CVE-2019-3829 gnutls28
description:
A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.


definition_id: oval:org.debian:def:299519990864695946400569371813746010989
title: CVE-2019-3830 ceilometer
description:
A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.


definition_id: oval:org.debian:def:6712007701341115642217041102511338655
title: CVE-2019-3832 libsndfile
description:
It was discovered the fix for CVE-2018-19758 (libsndfile) was not complete and still allows a read beyond the limits of a buffer in wav_write_header() function in wav.c. A local attacker may use this flaw to make the application crash.


definition_id: oval:org.debian:def:45970568361285516980014485607979610991
title: CVE-2019-3835 ghostscript
description:
It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.


definition_id: oval:org.debian:def:98005903299409085058430163761503036541
title: CVE-2019-3836 gnutls28
description:
It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages.


definition_id: oval:org.debian:def:11794489129410443179319211472534719630
title: CVE-2019-3837 linux
description:
It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.


definition_id: oval:org.debian:def:150267364832122188976381851497320023939
title: CVE-2019-3838 ghostscript
description:
It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.


definition_id: oval:org.debian:def:55000818434293170307042158098156250263
title: CVE-2019-3839 ghostscript
description:
It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.27 are vulnerable.


definition_id: oval:org.debian:def:290411976887757181309773799624910887747
title: CVE-2019-3840 libvirt
description:
A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service.


definition_id: oval:org.debian:def:21278644218404185133129352465317857050
title: CVE-2019-3842 systemd
description:
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".


definition_id: oval:org.debian:def:312300230878244499652411507552415990445
title: CVE-2019-3846 linux
description:
A flaw was found in the Linux kernel's Marvell wifi chip driver. A heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c allows remote attackers to cause a denial of service(system crash) or execute arbitrary code.


definition_id: oval:org.debian:def:314852957467327706114502683133742978029
title: CVE-2019-3855 libssh2
description:
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.


definition_id: oval:org.debian:def:152110990704340965907082317095855109126
title: CVE-2019-3856 libssh2
description:
An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.


definition_id: oval:org.debian:def:322838468321464388413742088767801485818
title: CVE-2019-3857 libssh2
description:
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.


definition_id: oval:org.debian:def:169842830249096021715476566924436411383
title: CVE-2019-3858 libssh2
description:
An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.


definition_id: oval:org.debian:def:90239534277259767973668532914874983195
title: CVE-2019-3859 libssh2
description:
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.


definition_id: oval:org.debian:def:15896144653546631077886733121303922915
title: CVE-2019-3860 libssh2
description:
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.


definition_id: oval:org.debian:def:261746065687418050039664361057296628134
title: CVE-2019-3861 libssh2
description:
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.


definition_id: oval:org.debian:def:180243518977053067539055688318969513987
title: CVE-2019-3862 libssh2
description:
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.


definition_id: oval:org.debian:def:197788508659874545063644785205790377060
title: CVE-2019-3863 libssh2
description:
A flaw was found in libssh2 before 1.8.1. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used as an index to copy memory causing in an out of bounds memory write error.


definition_id: oval:org.debian:def:182017062030870454542317025051072542428
title: CVE-2019-3866 mistral
description:
An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information.


definition_id: oval:org.debian:def:272959961837065873922571296655345892881
title: CVE-2019-3870 samba
description:
A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.


definition_id: oval:org.debian:def:107793745521683406376742091565358849371
title: CVE-2019-3871 pdns
description:
A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response


definition_id: oval:org.debian:def:66707599602965108503381413974278409493
title: CVE-2019-3874 linux
description:
The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack.


definition_id: oval:org.debian:def:216139786401396045371562430129023993081
title: CVE-2019-3877 libapache2-mod-auth-mellon
description:
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.


definition_id: oval:org.debian:def:65212534827208796676664612287111811
title: CVE-2019-3878 libapache2-mod-auth-mellon
description:
A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.


definition_id: oval:org.debian:def:165629314703234534213180033439974903147
title: CVE-2019-3880 samba
description:
A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable.


definition_id: oval:org.debian:def:142830902873243360496417415662280084728
title: CVE-2019-3881 bundler
description:
Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.


definition_id: oval:org.debian:def:42243232664890665589945147454163044411
title: CVE-2019-3885 pacemaker
description:
A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system logs.


definition_id: oval:org.debian:def:306116178684176193029210195659237359161
title: CVE-2019-3886 libvirt
description:
An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block.


definition_id: oval:org.debian:def:102678366776770633325332626471526395128
title: CVE-2019-3887 linux
description:
A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Register (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue.


definition_id: oval:org.debian:def:252510831999285412137176210853853958672
title: CVE-2019-3896 linux
description:
A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel. An unprivileged local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service (DoS).


definition_id: oval:org.debian:def:188221254340662587870225023315526572804
title: CVE-2019-3901 linux
description:
A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls.


definition_id: oval:org.debian:def:123297740113041650548987612330430647797
title: CVE-2019-3902 mercurial
description:
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.


definition_id: oval:org.debian:def:179074103906530640720397994562587706223
title: CVE-2019-5008 qemu
description:
hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a NULL pointer dereference, which allows the attacker to cause a denial of service via a device driver.


definition_id: oval:org.debian:def:132444477894037174559415979178808269589
title: CVE-2019-5010 python2.7
description:
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.


definition_id: oval:org.debian:def:58594491466884655871100359390581030586
title: CVE-2019-5018 sqlite3
description:
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.


definition_id: oval:org.debian:def:31348673408992202431615861749096209310
title: CVE-2019-5020 yara
description:
An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially crafted binary file can cause a negative value to be read to satisfy an assert, resulting in Denial of Service. An attacker can create a malicious binary to trigger this vulnerability.


definition_id: oval:org.debian:def:249608399215611095035172557943327508155
title: CVE-2019-5051 libsdl2-image
description:
An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.


definition_id: oval:org.debian:def:210113278526838424155676179915789530282
title: CVE-2019-5052 libsdl2-image
description:
An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an integer overflow, resulting in too little memory being allocated, which can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.


definition_id: oval:org.debian:def:306954497017250232942695046953120098174
title: CVE-2019-5057 libsdl2-image
description:
An exploitable code execution vulnerability exists in the PCX image-rendering functionality of SDL2_image 2.0.4. A specially crafted PCX image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.


definition_id: oval:org.debian:def:324883573335833101657397209755274868919
title: CVE-2019-5058 libsdl2-image
description:
An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.


definition_id: oval:org.debian:def:319304061190038464900265982569445607741
title: CVE-2019-5068 mesa
description:
An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker can access the shared memory without any specific permissions to trigger this vulnerability.


definition_id: oval:org.debian:def:200205322074824787005475459560525189239
title: CVE-2019-5086 xcftools
description:
An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools, version 1.0.7. An integer overflow can occur while walking through tiles that could be exploited to corrupt memory and execute arbitrary code. In order to trigger this vulnerability, a victim would need to open a specially crafted XCF file.


definition_id: oval:org.debian:def:120344776490946354086739592967449688670
title: CVE-2019-5087 xcftools
description:
An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools 1.0.7. An integer overflow can occur while calculating the row's allocation size, that could be exploited to corrupt memory and eventually execute arbitrary code. In order to trigger this vulnerability, a victim would need to open a specially crafted XCF file.


definition_id: oval:org.debian:def:271742381724267582694962318228956366490
title: CVE-2019-5108 linux
description:
An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.


definition_id: oval:org.debian:def:11592195816275577760478333996666603199
title: CVE-2019-5188 e2fsprogs
description:
A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.


definition_id: oval:org.debian:def:208928150657597935154814602879983451419
title: CVE-2019-5418 rails
description:
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.


definition_id: oval:org.debian:def:215563182679594743310742738752607360517
title: CVE-2019-5419 rails
description:
There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.


definition_id: oval:org.debian:def:210220305297756876165408816053105575877
title: CVE-2019-5420 rails
description:
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.


definition_id: oval:org.debian:def:81574517543175223409592634288423338421
title: CVE-2019-5421 ruby-devise
description:
Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method. File location: lib/devise/models/lockable.rb that can result in Multiple concurrent requests can prevent an attacker from being blocked on brute force attacks. This attack appear to be exploitable via Network connectivity - brute force attacks. This vulnerability appears to have been fixed in 4.6.0 and later.


definition_id: oval:org.debian:def:278086026395235435860908514467160315062
title: CVE-2019-5429 filezilla
description:
Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's home directory.


definition_id: oval:org.debian:def:299774861626565068284503158583702545845
title: CVE-2019-5432 node-mqtt-packet
description:
A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding.


definition_id: oval:org.debian:def:271453158831097711116275410879376154857
title: CVE-2019-5435 curl
description:
An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.


definition_id: oval:org.debian:def:335124693562068060854705318825102914034
title: CVE-2019-5439 vlc
description:
A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.


definition_id: oval:org.debian:def:212392486806034915935587852547330503402
title: CVE-2019-5448 node-yarnpkg
description:
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.


definition_id: oval:org.debian:def:133182349694080261689403165242769105767
title: CVE-2019-5477 rexical
description:
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.


definition_id: oval:org.debian:def:268392673748219179429491476608733060590
title: CVE-2019-5489 linux
description:
The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server.


definition_id: oval:org.debian:def:51391302515165977596896642485604025879
title: CVE-2019-5716 wireshark
description:
In Wireshark 2.6.0 to 2.6.5, the 6LoWPAN dissector could crash. This was addressed in epan/dissectors/packet-6lowpan.c by avoiding use of a TVB before its creation.


definition_id: oval:org.debian:def:283156199988004709509939197771987051163
title: CVE-2019-5717 wireshark
description:
In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the P_MUL dissector could crash. This was addressed in epan/dissectors/packet-p_mul.c by rejecting the invalid sequence number of zero.


definition_id: oval:org.debian:def:79787361205642181104069860413893358325
title: CVE-2019-5718 wireshark
description:
In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the RTSE dissector and other ASN.1 dissectors could crash. This was addressed in epan/charsets.c by adding a get_t61_string length check.


definition_id: oval:org.debian:def:197153624344680918591855994562075877550
title: CVE-2019-5719 wireshark
description:
In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the ISAKMP dissector could crash. This was addressed in epan/dissectors/packet-isakmp.c by properly handling the case of a missing decryption data block.


definition_id: oval:org.debian:def:136523119046050743959962688281561807134
title: CVE-2019-5721 wireshark
description:
In Wireshark 2.4.0 to 2.4.11, the ENIP dissector could crash. This was addressed in epan/dissectors/packet-enip.c by changing the memory-management approach so that a use-after-free is avoided.


definition_id: oval:org.debian:def:246096052063763591527778888837518068235
title: CVE-2019-5736 lxc
description:
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.


definition_id: oval:org.debian:def:83268653523532739021072068609985068328
title: CVE-2019-5737 nodejs
description:
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.


definition_id: oval:org.debian:def:294208063149999861361350033191945767179
title: CVE-2019-5739 nodejs
description:
Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.


definition_id: oval:org.debian:def:124339585593434525004913507142134612588
title: CVE-2019-5754 chromium
description:
Implementation error in QUIC Networking in Google Chrome prior to 72.0.3626.81 allowed an attacker running or able to cause use of a proxy server to obtain cleartext of transport encryption via malicious network proxy.


definition_id: oval:org.debian:def:180395269616989690455640372183436079310
title: CVE-2019-5755 chromium
description:
Incorrect handling of negative zero in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.


definition_id: oval:org.debian:def:170401475758410961472601316576788513549
title: CVE-2019-5756 chromium
description:
Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.


definition_id: oval:org.debian:def:154609145281185237641522545967633372973
title: CVE-2019-5757 chromium
description:
An incorrect object type assumption in SVG in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.


definition_id: oval:org.debian:def:16628819939091384294432094938669463072
title: CVE-2019-5758 chromium
description:
Incorrect object lifecycle management in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:81182254223354183642877276415441762954
title: CVE-2019-5759 chromium
description:
Incorrect lifetime handling in HTML select elements in Google Chrome on Android and Mac prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.


definition_id: oval:org.debian:def:19156619774679581509094750649041052887
title: CVE-2019-5760 chromium
description:
Insufficient checks of pointer validity in WebRTC in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:143473316405127181384998983575117547840
title: CVE-2019-5763 chromium
description:
Failure to check error conditions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:117109063831719850333966410364936280589
title: CVE-2019-5764 chromium
description:
Incorrect pointer management in WebRTC in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:44609606252451244936126594273348865331
title: CVE-2019-5765 chromium
description:
An exposed debugging endpoint in the browser in Google Chrome on Android prior to 72.0.3626.81 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted Intent.


definition_id: oval:org.debian:def:163984488486785536857523166329858656691
title: CVE-2019-5766 chromium
description:
Incorrect handling of origin taint checking in Canvas in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page.


definition_id: oval:org.debian:def:124144343794186798437906531321496936988
title: CVE-2019-5767 chromium
description:
Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a malicious application to access privacy/security sensitive web APIs via a crafted APK.


definition_id: oval:org.debian:def:96889483923895711732357756393920895653
title: CVE-2019-5768 chromium
description:
DevTools API not correctly gating on extension capability in DevTools in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to read local files via a crafted Chrome Extension.


definition_id: oval:org.debian:def:156434390734961298081987788779948423422
title: CVE-2019-5769 chromium
description:
Incorrect handling of invalid end character position when front rendering in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:63796742597887824808608177827588718282
title: CVE-2019-5770 chromium
description:
Insufficient input validation in WebGL in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


definition_id: oval:org.debian:def:164406971316550955683491756151134418679
title: CVE-2019-5772 chromium
description:
Sharing of objects over calls into JavaScript runtime in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.


definition_id: oval:org.debian:def:180211729175057666617321780942111028854
title: CVE-2019-5773 chromium
description:
Insufficient origin validation in IndexedDB in Google Chrome prior to 72.0.3626.81 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.


definition_id: oval:org.debian:def:85075260238310846727141502797323190548
title: CVE-2019-5774 chromium
description:
Omission of the .desktop filetype from the Safe Browsing checklist in SafeBrowsing in Google Chrome on Linux prior to 72.0.3626.81 allowed an attacker who convinced a user to download a .desktop file to execute arbitrary code via a downloaded .desktop file.


definition_id: oval:org.debian:def:87383675367867905816906427434719586723
title: CVE-2019-5775 chromium
description:
Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.


definition_id: oval:org.debian:def:56810735751414245473581436916742990112
title: CVE-2019-5778 chromium
description:
A missing case for handling special schemes in permission request checks in Extensions in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to bypass extension permission checks for privileged pages via a crafted Chrome Extension.


definition_id: oval:org.debian:def:295117147046181322192794197730639434630
title: CVE-2019-5779 chromium
description:
Insufficient policy validation in ServiceWorker in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.


definition_id: oval:org.debian:def:256823893778707621646059861038098994064
title: CVE-2019-5780 chromium
description:
Insufficient restrictions on what can be done with Apple Events in Google Chrome on macOS prior to 72.0.3626.81 allowed a local attacker to execute JavaScript via Apple Events.


definition_id: oval:org.debian:def:244912106922894108800629312483042244714
title: CVE-2019-5782 chromium
description:
Incorrect optimization assumptions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


definition_id: oval:org.debian:def:134880365496103149007628177305444291492
title: CVE-2019-5783 chromium
description:
Missing URI encoding of untrusted input in DevTools in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform a Dangling Markup Injection attack via a crafted HTML page.


definition_id: oval:org.debian:def:105662287856629914464450548365903569883
title: CVE-2019-5784 chromium
description:
Incorrect handling of deferred code in V8 in Google Chrome prior to 72.0.3626.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:76605341049089538158387148501276071379
title: CVE-2019-5785 firefox-esr
description:
Incorrect convexity calculations in Skia in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.


definition_id: oval:org.debian:def:183058170348210377601982067055726253040
title: CVE-2019-5786 chromium
description:
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.


definition_id: oval:org.debian:def:328130353656548893110526140607012312627
title: CVE-2019-5787 chromium
description:
Use-after-garbage-collection in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:139619023112848796099411462431099663913
title: CVE-2019-5788 chromium
description:
An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.


definition_id: oval:org.debian:def:143866642773300462910127385968875496741
title: CVE-2019-5789 chromium
description:
An integer overflow that leads to a use-after-free in WebMIDI in Google Chrome on Windows prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.


definition_id: oval:org.debian:def:111514938333741824146613001791517148898
title: CVE-2019-5790 chromium
description:
An integer overflow leading to an incorrect capacity of a buffer in JavaScript in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


definition_id: oval:org.debian:def:310018858480702826676687682244401319144
title: CVE-2019-5791 chromium
description:
Inappropriate optimization in V8 in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


definition_id: oval:org.debian:def:197081078130744283654497760338836513221
title: CVE-2019-5792 chromium
description:
Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file.


definition_id: oval:org.debian:def:44739546060357637297044624973729022228
title: CVE-2019-5793 chromium
description:
Insufficient policy enforcement in extensions in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to initiate the extensions installation user interface via a crafted HTML page.


definition_id: oval:org.debian:def:219457341301980789551247558358352319604
title: CVE-2019-5794 chromium
description:
Incorrect handling of cancelled requests in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.


definition_id: oval:org.debian:def:268956172088297665783913081153639557094
title: CVE-2019-5796 chromium
description:
Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:77481175337708587289137375544937084178
title: CVE-2019-5797 chromium
description:
Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:6003143811643529618227651572236438087
title: CVE-2019-5798 chromium
description:
Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


definition_id: oval:org.debian:def:329739213051005143362197086240957043465
title: CVE-2019-5799 chromium
description:
Incorrect inheritance of a new document's policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.


definition_id: oval:org.debian:def:192492194367869620703059151314902186705
title: CVE-2019-5800 chromium
description:
Insufficient policy enforcement in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.


definition_id: oval:org.debian:def:288325283995309084536020709535817833994
title: CVE-2019-5802 chromium
description:
Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.


definition_id: oval:org.debian:def:163200593325940218187583736562269205039
title: CVE-2019-5803 chromium
description:
Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.


definition_id: oval:org.debian:def:173793983886024411480454974633904572712
title: CVE-2019-5815 libxslt
description:
Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.


definition_id: oval:org.debian:def:11950894088051846162586901738304500748
title: CVE-2019-5827 sqlite3
description:
Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:131761111592698241906402406480933108546
title: CVE-2019-5835 chromium
description:
Object lifecycle issue in SwiftShader in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.


definition_id: oval:org.debian:def:230528595347813473089146276326957252278
title: CVE-2019-5841 chromium
description:
Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:62725832181886493897405890995740355063
title: CVE-2019-5843 chromium
description:
Out of bounds memory access in JavaScript in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:131129555490875336171791971688408236793
title: CVE-2019-5844 chromium
description:
Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:222417455138774234618161199156457157635
title: CVE-2019-5866 chromium
description:
Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:24159984701228546149719363111623089154
title: CVE-2019-5881 chromium
description:
Out of bounds read in SwiftShader in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


definition_id: oval:org.debian:def:284493933111438798207112413546661608964
title: CVE-2019-5953 wget
description:
Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:216616314789179258405776434442323817373
title: CVE-2019-6109 openssh
description:
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.


definition_id: oval:org.debian:def:192414024434052232121490920722536913877
title: CVE-2019-6111 openssh
description:
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).


definition_id: oval:org.debian:def:5106454543551211346232112427784221278
title: CVE-2019-6116 ghostscript
description:
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.


definition_id: oval:org.debian:def:102199683848899376031217074625718363415
title: CVE-2019-6128 tiff
description:
The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.


definition_id: oval:org.debian:def:160413273563362720165305670498856183014
title: CVE-2019-6130 mupdf
description:
Artifex MuPDF 1.14.0 has a SEGV in the function fz_load_page of the fitz/document.c file, as demonstrated by mutool. This is related to page-number mishandling in cbz/mucbz.c, cbz/muimg.c, and svg/svg-doc.c.


definition_id: oval:org.debian:def:194832975049566477085297372351712658009
title: CVE-2019-6131 mupdf
description:
svg-run.c in Artifex MuPDF 1.14.0 has infinite recursion with stack consumption in svg_run_use_symbol, svg_run_element, and svg_run_use, as demonstrated by mutool.


definition_id: oval:org.debian:def:208787159461361422039037542329843377984
title: CVE-2019-6133 linux
description:
In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.


definition_id: oval:org.debian:def:40216777334018453741006313743362021722
title: CVE-2019-6201 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:46675772867552408400414462546391505867
title: CVE-2019-6212 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:70892061128914447936742386271663803252
title: CVE-2019-6215 webkit2gtk
description:
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:182574783620402853270119416769843240519
title: CVE-2019-6216 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, watchOS 5.1.3, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:233287042423474372967628462858134367465
title: CVE-2019-6227 webkit2gtk
description:
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, watchOS 5.1.3, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:179561149651787620644859876913538040751
title: CVE-2019-6229 webkit2gtk
description:
A logic issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to universal cross site scripting.


definition_id: oval:org.debian:def:67168290094079136649596283749815287601
title: CVE-2019-6233 webkit2gtk
description:
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:288257900584617628958006403619392859187
title: CVE-2019-6237 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:26850012442084899035679074422569167698
title: CVE-2019-6245 agg
description:
An issue was discovered in Anti-Grain Geometry (AGG) 2.4 as used in SVG++ (aka svgpp) 1.2.3. In the function agg::cell_aa::not_equal, dx is assigned to (x2 - x1). If dx >= dx_limit, which is (16384 << poly_subpixel_shift), this function will call itself recursively. There can be a situation where (x2 - x1) is always bigger than dx_limit during the recursion, leading to continual stack consumption.


definition_id: oval:org.debian:def:294239951746702821217578609390565978022
title: CVE-2019-6246 svgpp
description:
An issue was discovered in SVG++ (aka svgpp) 1.2.3. After calling the gil::get_color function in Generic Image Library in Boost, the return code is used as an address, leading to an Access Violation because of an out-of-bounds read.


definition_id: oval:org.debian:def:193158463014781170459694277407157856191
title: CVE-2019-6250 zeromq3
description:
A pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.1. A v2_decoder.cpp zmq::v2_decoder_t::size_ready integer overflow allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer, which can be leveraged to run arbitrary code on the target system. The memory layout allows the attacker to inject OS commands into a data structure located immediately after the problematic buffer (i.e., it is not necessary to use a typical buffer-overflow exploitation technique that changes the flow of control).


definition_id: oval:org.debian:def:172355346651225504305519654552163452179
title: CVE-2019-6251 webkit2gtk
description:
WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge.


definition_id: oval:org.debian:def:216921730568083466074207054630615805692
title: CVE-2019-6256 liblivemedia
description:
A Denial of Service issue was discovered in the LIVE555 Streaming Media libraries as used in Live555 Media Server 0.93. It can cause an RTSPServer crash in handleHTTPCmd_TunnelingPOST, when RTSP-over-HTTP tunneling is supported, via x-sessioncookie HTTP headers in a GET request and a POST request within the same TCP session. This occurs because of a call to an incorrect virtual function pointer in the readSocket function in GroupsockHelper.cpp.


definition_id: oval:org.debian:def:244335473508306682141407062542909452754
title: CVE-2019-6283 libsass
description:
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp.


definition_id: oval:org.debian:def:302496830175533106177934689445390012743
title: CVE-2019-6284 libsass
description:
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp.


definition_id: oval:org.debian:def:46850678155009034106209385695116726363
title: CVE-2019-6286 libsass
description:
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::skip_over_scopes in prelexer.hpp when called from Sass::Parser::parse_import(), a similar issue to CVE-2018-11693.


definition_id: oval:org.debian:def:10199389736867414436888022188207070921
title: CVE-2019-6442 ntpsec
description:
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a malformed config request, related to config_remotely in ntp_config.c, yyparse in ntp_parser.tab.c, and yyerror in ntp_parser.y.


definition_id: oval:org.debian:def:33975663208834967160187404087281935724
title: CVE-2019-6443 ntpsec
description:
An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.


definition_id: oval:org.debian:def:323091307719477412150478329887869401261
title: CVE-2019-6444 ntpsec
description:
An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read because attacker-controlled data is dereferenced by ntohl() in ntpd.


definition_id: oval:org.debian:def:165177659452903067081507630447173991873
title: CVE-2019-6445 ntpsec
description:
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd crash in ntp_control.c, related to ctl_getitem.


definition_id: oval:org.debian:def:261819533615424031990016205070276657660
title: CVE-2019-6446 python-numpy
description:
** DISPUTED **   An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is  a behavior that might have legitimate applications in (for example)  loading serialized Python object arrays from trusted and authenticated  sources.


definition_id: oval:org.debian:def:73894608389662356191837475293715664597
title: CVE-2019-6454 systemd
description:
An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).


definition_id: oval:org.debian:def:270644012861490496119580986685793710636
title: CVE-2019-6465 bind9
description:
Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465.


definition_id: oval:org.debian:def:152276125704305192157852795096461938458
title: CVE-2019-6470 isc-dhcp
description:
There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All releases of dhcpd from ISC contain copies of this, and other, BIND libraries in combinations that have been tested prior to release and are known to not present issues like this. Some third-party packagers of ISC software have modified the dhcpd source, BIND source, or version matchup in ways that create the crash potential. Based on reports available to ISC, the crash probability is large and no analysis has been done on how, or even if, the probability can be manipulated by an attacker. Affects: Builds of dhcpd versions prior to version 4.4.1 when using BIND versions 9.11.2 or later, or BIND versions with specific bug fixes backported to them. ISC does not have access to comprehensive version lists for all repackagings of dhcpd that are vulnerable. In particular, builds from other vendors may also be affected. Operators are advised to consult their vendor documentation.


definition_id: oval:org.debian:def:267929738578108253414505178401328627216
title: CVE-2019-6471 bind9
description:
A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1, 9.14.0 -> 9.14.2. Also all releases of the BIND 9.13 development branch and version 9.15.0 of the BIND 9.15 development branch and BIND Supported Preview Edition versions 9.11.3-S1 -> 9.11.7-S1.


definition_id: oval:org.debian:def:293108607386639615115243068044043308862
title: CVE-2019-6486 golang-1.11
description:
Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.


definition_id: oval:org.debian:def:291495045720536727469363989148585519100
title: CVE-2019-6488 glibc
description:
The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32 architecture, incorrectly attempts to use a 64-bit register for size_t in assembly codes, which can lead to a segmentation fault or possibly unspecified other impact, as demonstrated by a crash in __memmove_avx_unaligned_erms in sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S during a memcpy.


definition_id: oval:org.debian:def:265363316504193811362531206157900462072
title: CVE-2019-6501 qemu
description:
In QEMU 3.1, scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c allows out-of-bounds write and read operations.


definition_id: oval:org.debian:def:278130146955236621197135451456183252908
title: CVE-2019-6690 python-gnupg
description:
python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.


definition_id: oval:org.debian:def:3292477836743694839932632385729147526
title: CVE-2019-6974 linux
description:
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.


definition_id: oval:org.debian:def:239655602054707757137022459983240015664
title: CVE-2019-6975 python-django
description:
Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.


definition_id: oval:org.debian:def:303216430732487360084414723655521561493
title: CVE-2019-6976 vips
description:
libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.


definition_id: oval:org.debian:def:93011307219880680938644462312465108642
title: CVE-2019-6977 libgd2
description:
gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.


definition_id: oval:org.debian:def:321603665771672274723794831189758604339
title: CVE-2019-6978 libgd2
description:
The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.


definition_id: oval:org.debian:def:1330526767749406764350267824068119031
title: CVE-2019-7146 elfutils
description:
In elfutils 0.175, there is a buffer over-read in the ebl_object_note function in eblobjnote.c in libebl. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted elf file, as demonstrated by eu-readelf.


definition_id: oval:org.debian:def:78557089712124318356891658808237542083
title: CVE-2019-7148 elfutils
description:
An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils 0.174. Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted elf input, which leads to an out-of-memory exception. NOTE: The maintainers believe this is not a real issue, but instead a "warning caused by ASAN because the allocation is big. By setting ASAN_OPTIONS=allocator_may_return_null=1 and running the reproducer, nothing happens."


definition_id: oval:org.debian:def:90972746549247429026474685232056618962
title: CVE-2019-7149 elfutils
description:
A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.


definition_id: oval:org.debian:def:263357278912872556702366383533539430623
title: CVE-2019-7150 elfutils
description:
An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.


definition_id: oval:org.debian:def:127734422044318000208463637581928505147
title: CVE-2019-7151 binaryen
description:
A NULL pointer dereference was discovered in wasm::Module::getFunctionOrNull in wasm/wasm.cpp in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.


definition_id: oval:org.debian:def:58977531144697038980792316466753330342
title: CVE-2019-7152 binaryen
description:
A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.


definition_id: oval:org.debian:def:186878007339851700519227667500204556106
title: CVE-2019-7153 binaryen
description:
A NULL pointer dereference was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.


definition_id: oval:org.debian:def:71652207415899656803154680010627930856
title: CVE-2019-7154 binaryen
description:
The main function in tools/wasm2js.cpp in Binaryen 1.38.22 has a heap-based buffer overflow because Emscripten is misused, triggering an error in cashew::JSPrinter::printAst() in emscripten-optimizer/simple_ast.h. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.


definition_id: oval:org.debian:def:170110767325819383633374612328775410460
title: CVE-2019-7164 sqlalchemy
description:
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.


definition_id: oval:org.debian:def:205649756284196956626296114792420050930
title: CVE-2019-7251 asterisk
description:
An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via a specially crafted SDP protocol violation.


definition_id: oval:org.debian:def:64460783651686312827652768513981438238
title: CVE-2019-7282 netkit-rsh
description:
In NetKit through 0.17, rcp.c in the rcp client allows remote rsh servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. This is similar to CVE-2018-20685.


definition_id: oval:org.debian:def:283154488168488123885718560077518173023
title: CVE-2019-7283 netkit-rsh
description:
An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned. A malicious rsh server (or Man-in-The-Middle attacker) can overwrite arbitrary files in a directory on the rcp client machine. This is similar to CVE-2019-6111.


definition_id: oval:org.debian:def:276943601756635805289402604668055385462
title: CVE-2019-7285 webkit2gtk
description:
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:46852031026618960671198618948719224841
title: CVE-2019-7292 webkit2gtk
description:
A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may result in the disclosure of process memory.


definition_id: oval:org.debian:def:100923736848938467905934781579892424733
title: CVE-2019-7303 snapd
description:
A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine which ioctl(2) commands to run. This issue affects: Canonical snapd versions prior to 2.37.4.


definition_id: oval:org.debian:def:155880956466953988747407741377726932117
title: CVE-2019-7304 snapd
description:
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.


definition_id: oval:org.debian:def:210240381948935929775415586142735560935
title: CVE-2019-7308 linux
description:
kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks.


definition_id: oval:org.debian:def:15595830920307783830371940988598986523
title: CVE-2019-7309 glibc
description:
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.


definition_id: oval:org.debian:def:290264172496735500296874964632097572158
title: CVE-2019-7310 poppler
description:
In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.


definition_id: oval:org.debian:def:267228080153756952368278630366951013854
title: CVE-2019-7313 buildbot
description:
www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain.


definition_id: oval:org.debian:def:303986056186554489434546842968353050872
title: CVE-2019-7314 liblivemedia
description:
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:217436340760991300803609880313817167336
title: CVE-2019-7317 firefox-esr
description:
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.


definition_id: oval:org.debian:def:207931187485657136357101007035144916111
title: CVE-2019-7397 graphicsmagick
description:
In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.


definition_id: oval:org.debian:def:75420119905110627690590318819290672305
title: CVE-2019-7443 kauth
description:
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.


definition_id: oval:org.debian:def:288301458245640099837412976507367971351
title: CVE-2019-7524 dovecot
description:
In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components.


definition_id: oval:org.debian:def:64085670301492321850829512311167835151
title: CVE-2019-7572 libsdl1.2
description:
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.


definition_id: oval:org.debian:def:116735213350874444298348846386630419931
title: CVE-2019-7573 libsdl1.2
description:
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop).


definition_id: oval:org.debian:def:336800898745638649959882450914441181428
title: CVE-2019-7574 libsdl1.2
description:
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c.


definition_id: oval:org.debian:def:3632235698840227030901776475071897520
title: CVE-2019-7575 libsdl1.2
description:
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.


definition_id: oval:org.debian:def:208264967324218902165912932542554249562
title: CVE-2019-7576 libsdl1.2
description:
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop).


definition_id: oval:org.debian:def:129433999965261947887687290522130703885
title: CVE-2019-7577 libsdl1.2
description:
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c.


definition_id: oval:org.debian:def:268514719033251440447738000419874516043
title: CVE-2019-7578 libsdl1.2
description:
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.


definition_id: oval:org.debian:def:64880475280185093931658950051515645413
title: CVE-2019-7629 tintin++
description:
Stack-based buffer overflow in the strip_vt102_codes function in TinTin++ 2.01.6 and WinTin++ 2.01.6 allows remote attackers to execute arbitrary code by sending a long message to the client.


definition_id: oval:org.debian:def:148887170635003847568202115192227048709
title: CVE-2019-7635 libsdl1.2
description:
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.


definition_id: oval:org.debian:def:320763131518914066024584664463203837234
title: CVE-2019-7636 libsdl1.2
description:
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c.


definition_id: oval:org.debian:def:258469166868752557258465125361923283764
title: CVE-2019-7637 libsdl1.2
description:
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in SDL_FillRect in video/SDL_surface.c.


definition_id: oval:org.debian:def:254680991945288558217817342861173670818
title: CVE-2019-7638 libsdl1.2
description:
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Map1toN in video/SDL_pixels.c.


definition_id: oval:org.debian:def:169367003735757724724808352364627233197
title: CVE-2019-7653 rdflib
description:
The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code injection, because "python -m" looks in this directory, as demonstrated by rdf2dot. This issue is specific to use of the debian/scripts directory.


definition_id: oval:org.debian:def:233263183175258785099385572064797770120
title: CVE-2019-7659 gsoap
description:
Genivia gSOAP 2.7.x and 2.8.x before 2.8.75 allows attackers to cause a denial of service (application abort) or possibly have unspecified other impact if a server application is built with the -DWITH_COOKIES flag. This affects the C/C++ libgsoapck/libgsoapck++ and libgsoapssl/libgsoapssl++ libraries, as these are built with that flag.


definition_id: oval:org.debian:def:106914641707234899777525576410538171980
title: CVE-2019-7662 binaryen
description:
An assertion failure was discovered in wasm::WasmBinaryBuilder::getType() in wasm-binary.cpp in Binaryen 1.38.22. This allows remote attackers to cause a denial of service (failed assertion and crash) via a crafted wasm file.


definition_id: oval:org.debian:def:197143457652928192618258203648044471402
title: CVE-2019-7663 tiff
description:
An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.


definition_id: oval:org.debian:def:169755093201344129522666753859096741304
title: CVE-2019-7664 elfutils
description:
In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).


definition_id: oval:org.debian:def:300855136013676530400228621309260636725
title: CVE-2019-7665 elfutils
description:
In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.


definition_id: oval:org.debian:def:215814734527246513892187311921842292101
title: CVE-2019-7700 binaryen
description:
A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-merge.


definition_id: oval:org.debian:def:74808291989777068994933712107027375658
title: CVE-2019-7701 binaryen
description:
A heap-based buffer over-read was discovered in wasm::SExpressionParser::skipWhitespace() in wasm-s-parser.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm2js.


definition_id: oval:org.debian:def:10174140795535111180204030421473178605
title: CVE-2019-7702 binaryen
description:
A NULL pointer dereference was discovered in wasm::SExpressionWasmBuilder::parseExpression in wasm-s-parser.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as.


definition_id: oval:org.debian:def:235957936702218374522000304531231964331
title: CVE-2019-7703 binaryen
description:
In Binaryen 1.38.22, there is a use-after-free problem in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp. Remote attackers could leverage this vulnerability to cause a denial-of-service via a wasm file, as demonstrated by wasm-merge.


definition_id: oval:org.debian:def:39437408355756773412748268873612796087
title: CVE-2019-7704 binaryen
description:
wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory allocation, as demonstrated by wasm-merge and wasm-opt.


definition_id: oval:org.debian:def:42636529529369350347934662412865905643
title: CVE-2019-8287 tightvnc
description:
TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.


definition_id: oval:org.debian:def:299794108101150185016037636530524248716
title: CVE-2019-8308 flatpak
description:
Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.


definition_id: oval:org.debian:def:207125246470451649758687707570489725652
title: CVE-2019-8320 jruby
description:
A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.


definition_id: oval:org.debian:def:299966122310726754457532876168666044071
title: CVE-2019-8321 jruby
description:
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.


definition_id: oval:org.debian:def:233186898914366120127195070685355907146
title: CVE-2019-8322 jruby
description:
An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.


definition_id: oval:org.debian:def:339987893967983723452325519543744754344
title: CVE-2019-8323 jruby
description:
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.


definition_id: oval:org.debian:def:282732298289915092878144896115900107648
title: CVE-2019-8324 jruby
description:
An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.


definition_id: oval:org.debian:def:24630509416884956275129509300244642601
title: CVE-2019-8325 jruby
description:
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)


definition_id: oval:org.debian:def:158934980719631588204808982434060992519
title: CVE-2019-8331 twitter-bootstrap3
description:
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.


definition_id: oval:org.debian:def:11369787096140111323998458986891696186
title: CVE-2019-8337 mpop
description:
In msmtp 1.8.2 and mpop 1.4.3, when tls_trust_file has its default configuration, certificate-verification results are not properly checked.


definition_id: oval:org.debian:def:44432546138704948627933583948692308633
title: CVE-2019-8354 sox
description:
An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c has an integer overflow on the result of multiplication fed into malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow.


definition_id: oval:org.debian:def:23897383930067945612962450557588975411
title: CVE-2019-8355 sox
description:
An issue was discovered in SoX 14.4.2. In xmalloc.h, there is an integer overflow on the result of multiplication fed into the lsx_valloc macro that wraps malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow in channels_start in remix.c.


definition_id: oval:org.debian:def:134319905059419723388359427942213356445
title: CVE-2019-8356 sox
description:
An issue was discovered in SoX 14.4.2. One of the arguments to bitrv2 in fft4g.c is not guarded, such that it can lead to write access outside of the statically declared array, aka a stack-based buffer overflow.


definition_id: oval:org.debian:def:27384227164952014680741095782169988545
title: CVE-2019-8357 sox
description:
An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c allows a NULL pointer dereference.


definition_id: oval:org.debian:def:20070019875008069303639636573162333908
title: CVE-2019-8375 webkit2gtk
description:
The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp, UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany).


definition_id: oval:org.debian:def:92100986893200589601639406946908097279
title: CVE-2019-8379 advancecomp
description:
An issue was discovered in AdvanceCOMP through 2.1. A NULL pointer dereference exists in the function be_uint32_read() located in endianrw.h. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.


definition_id: oval:org.debian:def:75179377950475176814727670418093204971
title: CVE-2019-8383 advancecomp
description:
An issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function adv_png_unfilter_8 in lib/png.c. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.


definition_id: oval:org.debian:def:5521841779932861869110520691485559432
title: CVE-2019-8457 sqlite3
description:
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.


definition_id: oval:org.debian:def:331961997689464112372405616853624892459
title: CVE-2019-8503 webkit2gtk
description:
A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. A malicious website may be able to execute scripts in the context of another website.


definition_id: oval:org.debian:def:225562009165574989684160510607405229774
title: CVE-2019-8506 webkit2gtk
description:
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:231762767824442533827762956104759929740
title: CVE-2019-8515 webkit2gtk
description:
A cross-origin issue existed with the fetch API. This was addressed with improved input validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may disclose sensitive user information.


definition_id: oval:org.debian:def:128636246188587212791345334727872218712
title: CVE-2019-8518 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:46590248704527907242510854022847847834
title: CVE-2019-8535 webkit2gtk
description:
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:256293146825032588975483647414771457219
title: CVE-2019-8536 webkit2gtk
description:
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:79617680783472300503650443054256054047
title: CVE-2019-8551 webkit2gtk
description:
A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to universal cross site scripting.


definition_id: oval:org.debian:def:152545252745211333914694149659986378609
title: CVE-2019-8583 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:219266779087307682568132736777015360069
title: CVE-2019-8607 webkit2gtk
description:
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may result in the disclosure of process memory.


definition_id: oval:org.debian:def:141632958536572045928952379608378535717
title: CVE-2019-8674 webkit2gtk
description:
A logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13. Processing maliciously crafted web content may lead to universal cross site scripting.


definition_id: oval:org.debian:def:250062054517891609959299514086635946491
title: CVE-2019-8675 cups
description:
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. An attacker in a privileged network position may be able to execute arbitrary code.


definition_id: oval:org.debian:def:220258992429171741467807036729724407189
title: CVE-2019-8707 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:258066718634749666460420533655305228225
title: CVE-2019-8710 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:206804675797984937408642695303900576532
title: CVE-2019-8719 webkit2gtk
description:
A logic issue was addressed with improved state management. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to universal cross site scripting.


definition_id: oval:org.debian:def:256036077100268588251566580626668079044
title: CVE-2019-8743 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:208293248500871426045141394034941185377
title: CVE-2019-8763 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.1 and iPadOS 13.1, tvOS 13, Safari 13.0.1, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:300589829574583203787985384064114648536
title: CVE-2019-8764 webkit2gtk
description:
A logic issue was addressed with improved state management. This issue is fixed in watchOS 6.1. Processing maliciously crafted web content may lead to universal cross site scripting.


definition_id: oval:org.debian:def:135969623062050418897579237706456831262
title: CVE-2019-8766 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:160440074650335455876890562071691213905
title: CVE-2019-8768 webkit2gtk
description:
"Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue is fixed in macOS Catalina 10.15. A user may be unable to delete browsing history items.


definition_id: oval:org.debian:def:313307809800192862274636614239614922158
title: CVE-2019-8782 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:34987607255828708281013528318940863664
title: CVE-2019-8783 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:4335936899504324444928346642747747353
title: CVE-2019-8808 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:19927351812035050695437852143012832520
title: CVE-2019-8811 webkit2gtk
description:
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.


definition_id: oval:org.debian:def:93612777864903015369532269877100040212
title: CVE-2019-8813 webkit2gtk
description:
A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to universal cross site scripting.


definition_id: oval:org.debian:def:157839223340779521682545480042878222993
title: CVE-2019-8842 cups
description:
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra. In certain configurations, a remote attacker may be able to submit arbitrary print jobs.


definition_id: oval:org.debian:def:236570171575916477609746908379283711875
title: CVE-2019-8904 file
description:
do_bid_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printf and file_vprintf.


definition_id: oval:org.debian:def:25074882463271703640630893970774255321
title: CVE-2019-8905 file
description:
do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360.


definition_id: oval:org.debian:def:35985162838052398544215144706615314546
title: CVE-2019-8906 file
description:
do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.


definition_id: oval:org.debian:def:53364489484473732716808654956716962853
title: CVE-2019-8907 file
description:
do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:138873404784945336500402679693558390265
title: CVE-2019-8912 linux
description:
In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr.


definition_id: oval:org.debian:def:28735493389566150595558253941078310976
title: CVE-2019-8921 bluez
description:
An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.


definition_id: oval:org.debian:def:182645475254997341970924687718886100207
title: CVE-2019-8922 bluez
description:
A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in the destination buffer. The function simply appends all data passed to it. The values of all attributes that are requested are appended to the output buffer. There are no size checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by process_request (in sdpd-request.c), which also allocates the response buffer.


definition_id: oval:org.debian:def:2480025847837179936001526380538966276
title: CVE-2019-8937 hoteldruid
description:
HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizza_tabelle.php.


definition_id: oval:org.debian:def:237245901309819720790675155840832353351
title: CVE-2019-8942 wordpress
description:
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.


definition_id: oval:org.debian:def:114905609777281750186036947558510468960
title: CVE-2019-8955 tor
description:
In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relays can occur via memory exhaustion in the KIST cell scheduler.


definition_id: oval:org.debian:def:42529135363605784579176703852064593670
title: CVE-2019-8956 linux
description:
In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctp_sendmsg()" function (net/sctp/socket.c) when handling SCTP_SENDALL flag can be exploited to corrupt memory.


definition_id: oval:org.debian:def:40985815536680602874561790696752661787
title: CVE-2019-8980 linux
description:
A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.


definition_id: oval:org.debian:def:214378669602666227074815861014940485490
title: CVE-2019-9003 linux
description:
In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a "service ipmievd restart" loop.


definition_id: oval:org.debian:def:269098977694543392198260080818417529093
title: CVE-2019-9020 php7.3
description:
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.


definition_id: oval:org.debian:def:228559150528677722721018575380423481054
title: CVE-2019-9021 php7.3
description:
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.


definition_id: oval:org.debian:def:236762825874887742262671530288068382060
title: CVE-2019-9022 php7.3
description:
An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries.


definition_id: oval:org.debian:def:289030765285476296414815178437634878852
title: CVE-2019-9023 php7.3
description:
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.


definition_id: oval:org.debian:def:208256175229148402159929770806743875609
title: CVE-2019-9024 php7.3
description:
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.


definition_id: oval:org.debian:def:36925994606346051866389411121597195294
title: CVE-2019-9025 php7.3
description:
An issue was discovered in PHP 7.3.x before 7.3.1. An invalid multibyte string supplied as an argument to the mb_split() function in ext/mbstring/php_mbregex.c can cause PHP to execute memcpy() with a negative argument, which could read and write past buffers allocated for the data.


definition_id: oval:org.debian:def:311969413715596294734364521780331412083
title: CVE-2019-9026 libmatio
description:
An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a heap-based buffer overflow in the function InflateVarName() in inflate.c when called from ReadNextCell in mat5.c.


definition_id: oval:org.debian:def:226805866079797387426357969024390909433
title: CVE-2019-9027 libmatio
description:
An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a heap-based buffer overflow problem in the function ReadNextCell() in mat5.c.


definition_id: oval:org.debian:def:280061575738338130808733442505805931413
title: CVE-2019-9028 libmatio
description:
An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read in the function InflateDimensions() in inflate.c when called from ReadNextCell in mat5.c.


definition_id: oval:org.debian:def:258267671375942802530107492369948018943
title: CVE-2019-9029 libmatio
description:
An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is an out-of-bounds read with a SEGV in the function Mat_VarReadNextInfo5() in mat5.c.


definition_id: oval:org.debian:def:329819884019645500503998763311680823022
title: CVE-2019-9030 libmatio
description:
An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read in Mat_VarReadNextInfo5() in mat5.c.


definition_id: oval:org.debian:def:213411817359986634426937649618321926947
title: CVE-2019-9031 libmatio
description:
An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a NULL pointer dereference in the function Mat_VarFree() in mat.c.


definition_id: oval:org.debian:def:25712942131668525424038859237659114908
title: CVE-2019-9032 libmatio
description:
An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is an out-of-bounds write problem causing a SEGV in the function Mat_VarFree() in mat.c.


definition_id: oval:org.debian:def:58976723084829006008619135189043960591
title: CVE-2019-9033 libmatio
description:
An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read for the "Rank and Dimension" feature in the function ReadNextCell() in mat5.c.


definition_id: oval:org.debian:def:62422410600841539566658292395373481317
title: CVE-2019-9034 libmatio
description:
An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read for a memcpy in the function ReadNextCell() in mat5.c.


definition_id: oval:org.debian:def:127375129268430697648900508199169363516
title: CVE-2019-9035 libmatio
description:
An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read in the function ReadNextStructField() in mat5.c.


definition_id: oval:org.debian:def:64622000630714206890751408410191403192
title: CVE-2019-9036 libmatio
description:
An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a heap-based buffer overflow in the function ReadNextFunctionHandle() in mat5.c.


definition_id: oval:org.debian:def:142730800576655376979381901291871156521
title: CVE-2019-9037 libmatio
description:
An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a buffer over-read in the function Mat_VarPrint() in mat.c.


definition_id: oval:org.debian:def:209848289392381865233528829860738745120
title: CVE-2019-9038 libmatio
description:
An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is an out-of-bounds read problem with a SEGV in the function ReadNextCell() in mat5.c.


definition_id: oval:org.debian:def:201736866663800241509398605864646860437
title: CVE-2019-9084 hoteldruid
description:
In Hoteldruid before 2.3.1, a division by zero was discovered in $num_tabelle in tab_tariffe.php (aka the numtariffa1 parameter) due to the mishandling of non-numeric values, as demonstrated by the /tab_tariffe.php?anno=[YEAR]&numtariffa1=1a URI. It could allow an administrator to conduct remote denial of service (disrupting certain business functions of the product).


definition_id: oval:org.debian:def:118253789908425951540174225366847189977
title: CVE-2019-9085 hoteldruid
description:
Hoteldruid before v2.3.1 allows remote authenticated users to cause a denial of service (invoice-creation outage) via the n_file parameter to visualizza_contratto.php with invalid arguments (any non-numeric value), as demonstrated by the anno=2019&id_transazione=1&numero_contratto=1&n_file=a query string to visualizza_contratto.php.


definition_id: oval:org.debian:def:214931638428663763667115154922870658897
title: CVE-2019-9162 linux
description:
In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has insufficient ASN.1 length checks (aka an array index error), making out-of-bounds read and write operations possible, leading to an OOPS or local privilege escalation. This affects snmp_version and snmp_helper.


definition_id: oval:org.debian:def:193499632183101928222154728142595427041
title: CVE-2019-9169 glibc
description:
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.


definition_id: oval:org.debian:def:103984265097073473805738431751015286051
title: CVE-2019-9187 ikiwiki
description:
ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs.


definition_id: oval:org.debian:def:61132134866477626963124351018389958151
title: CVE-2019-9199 libpodofo
description:
PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:264913242735695102748393815471252189707
title: CVE-2019-9200 poppler
description:
A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:197344405269163317239648635688511462827
title: CVE-2019-9208 wireshark
description:
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the TCAP dissector could crash. This was addressed in epan/dissectors/asn1/tcap/tcap.cnf by avoiding NULL pointer dereferences.


definition_id: oval:org.debian:def:3840173440621736904597026813805006455
title: CVE-2019-9209 wireshark
description:
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. This was addressed in epan/dissectors/packet-ber.c by preventing a buffer overflow associated with excessive digits in time values.


definition_id: oval:org.debian:def:99810447425595322841667505757653148830
title: CVE-2019-9210 advancecomp
description:
In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)


definition_id: oval:org.debian:def:176619167099742912533470498661580059076
title: CVE-2019-9213 linux
description:
In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.


definition_id: oval:org.debian:def:88678486457732870810487937233820140912
title: CVE-2019-9214 wireshark
description:
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation.


definition_id: oval:org.debian:def:339364808399248463558779865821704953298
title: CVE-2019-9215 liblivemedia
description:
In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function.


definition_id: oval:org.debian:def:124409629470264530564011204298309935166
title: CVE-2019-9245 linux
description:
In the Android kernel in the f2fs driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.


definition_id: oval:org.debian:def:328897370495544329224581158001965677259
title: CVE-2019-9444 linux
description:
In the Android kernel in sync debug fs driver there is a kernel pointer leak due to the usage of printf with %p. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.


definition_id: oval:org.debian:def:190874924602205075991766026027178489780
title: CVE-2019-9445 linux
description:
In the Android kernel in F2FS driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.


definition_id: oval:org.debian:def:276080636409774261045520145678886271481
title: CVE-2019-9453 linux
description:
In the Android kernel in F2FS touch driver there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.


definition_id: oval:org.debian:def:82024362374582459794956127302552965875
title: CVE-2019-9454 linux
description:
In the Android kernel in i2c driver there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.


definition_id: oval:org.debian:def:8005152597752693887451219047554741812
title: CVE-2019-9455 linux
description:
In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.


definition_id: oval:org.debian:def:323417953102279166602396287718112626025
title: CVE-2019-9456 linux
description:
In the Android kernel in Pixel C USB monitor driver there is a possible OOB write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.


definition_id: oval:org.debian:def:217779999481322113897727352337769538448
title: CVE-2019-9458 linux
description:
In the Android kernel in the video driver there is a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.


definition_id: oval:org.debian:def:166933115520114248057585863195847984898
title: CVE-2019-9494 wpa
description:
The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.


definition_id: oval:org.debian:def:103238282840916248092458073779887053660
title: CVE-2019-9495 wpa
description:
The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.


definition_id: oval:org.debian:def:321293051226850107554136906850028848682
title: CVE-2019-9496 wpa
description:
An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.


definition_id: oval:org.debian:def:292029702132799703868419892084239715962
title: CVE-2019-9497 wpa
description:
The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not implement additional checks for the EC point, the attacker will not be able to derive the session key or complete the key exchange. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.


definition_id: oval:org.debian:def:95191816183138225689085404219741216115
title: CVE-2019-9498 wpa
description:
The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication, gaining session key and network access without needing or learning the password. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.


definition_id: oval:org.debian:def:1648691067627159201884539758093755545
title: CVE-2019-9499 wpa
description:
The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection with a client. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.


definition_id: oval:org.debian:def:239029090231082764533038761333079920855
title: CVE-2019-9500 linux
description:
The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets to compromise the host, or when used in combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.


definition_id: oval:org.debian:def:9620582079003069701623153819535557074
title: CVE-2019-9503 linux
description:
The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver receives the firmware event frame from the host, the appropriate handler is called. This frame validation can be bypassed if the bus used is USB (for instance by a wifi dongle). This can allow firmware event frames from a remote source to be processed. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.


definition_id: oval:org.debian:def:52937101010354548240772204245687699783
title: CVE-2019-9506 linux
description:
The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.


definition_id: oval:org.debian:def:205225532971598426682425912144492352425
title: CVE-2019-9578 libu2f-host
description:
In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.


definition_id: oval:org.debian:def:111071813511787997007293320857876644380
title: CVE-2019-9628 xmltooling
description:
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.


definition_id: oval:org.debian:def:218514344630695057393494915164259747225
title: CVE-2019-9631 poppler
description:
Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.


definition_id: oval:org.debian:def:95018460694912519393564327390723104680
title: CVE-2019-9636 python2.7
description:
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.


definition_id: oval:org.debian:def:213751089123337953844546399833950026122
title: CVE-2019-9637 php7.3
description:
An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.


definition_id: oval:org.debian:def:295871073657033724560621182182620955376
title: CVE-2019-9638 php7.3
description:
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len.


definition_id: oval:org.debian:def:216179462324942032587864882568437201710
title: CVE-2019-9639 php7.3
description:
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable.


definition_id: oval:org.debian:def:186457731133641646998473937803445696723
title: CVE-2019-9640 php7.3
description:
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn.


definition_id: oval:org.debian:def:312634160151684789648897745593853736027
title: CVE-2019-9641 php7.3
description:
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.


definition_id: oval:org.debian:def:54027625617199158391798618769121098153
title: CVE-2019-9644 jupyter-notebook
description:
An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered.


definition_id: oval:org.debian:def:107557114895526831055800484472335518741
title: CVE-2019-9656 libofx
description:
An issue was discovered in LibOFX 0.9.14. There is a NULL pointer dereference in the function OFXApplication::startElement in the file lib/ofx_sgml.cpp, as demonstrated by ofxdump.


definition_id: oval:org.debian:def:66054196760177514186559808073241206917
title: CVE-2019-9675 php7.3
description:
** DISPUTED ** An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible."


definition_id: oval:org.debian:def:328955563739142542534106333932307794155
title: CVE-2019-9687 libpodofo
description:
PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in base/PdfString.cpp.


definition_id: oval:org.debian:def:125754379034016764631132978661251091910
title: CVE-2019-9704 cron
description:
Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked.


definition_id: oval:org.debian:def:314558006842623221588215967765767967655
title: CVE-2019-9705 cron
description:
Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (memory consumption) via a large crontab file because an unlimited number of lines is accepted.


definition_id: oval:org.debian:def:305280781685917955252215405843539486509
title: CVE-2019-9706 cron
description:
Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_user error.


definition_id: oval:org.debian:def:63730734478108229428239297526655177597
title: CVE-2019-9718 ffmpeg
description:
In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.


definition_id: oval:org.debian:def:192035227703088081318644832928311788953
title: CVE-2019-9721 ffmpeg
description:
A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.


definition_id: oval:org.debian:def:108669446865124684663291704069493335391
title: CVE-2019-9735 neutron
description:
An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)


definition_id: oval:org.debian:def:211420373310899016878698683869793762754
title: CVE-2019-9740 python2.7
description:
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.


definition_id: oval:org.debian:def:28762909589022838949251508950188018450
title: CVE-2019-9741 golang-1.11
description:
An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.


definition_id: oval:org.debian:def:205383568951024171282435536048723465003
title: CVE-2019-9751 otrs2
description:
An issue was discovered in Open Ticket Request System (OTRS) 6.x before 6.0.17 and 7.x before 7.0.5. An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS. This is related to Kernel/Output/Template/Document.pm.


definition_id: oval:org.debian:def:307483918443404754771291667877756749746
title: CVE-2019-9752 otrs2
description:
An issue was discovered in Open Ticket Request System (OTRS) 5.x before 5.0.34, 6.x before 6.0.16, and 7.x before 7.0.4. An attacker who is logged into OTRS as an agent or a customer user may upload a carefully crafted resource in order to cause execution of JavaScript in the context of OTRS. This is related to Content-type mishandling in Kernel/Modules/PictureUpload.pm.


definition_id: oval:org.debian:def:148488248137536945603315172150479852992
title: CVE-2019-9755 ntfs-3g
description:
An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.


definition_id: oval:org.debian:def:130305390987701298813185539093656840315
title: CVE-2019-9788 firefox-esr
description:
Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.


definition_id: oval:org.debian:def:335284832537983329660461692823143862493
title: CVE-2019-9790 firefox-esr
description:
A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.


definition_id: oval:org.debian:def:299249545421610720214164872012251402797
title: CVE-2019-9791 firefox-esr
description:
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR). This allows for possible arbitrary reading and writing of objects during an exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.


definition_id: oval:org.debian:def:119527258830993688448719736899589496010
title: CVE-2019-9792 firefox-esr
description:
The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout. This magic value can then be used by JavaScript to achieve memory corruption, which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.


definition_id: oval:org.debian:def:172765317925903919252428820529204310583
title: CVE-2019-9793 firefox-esr
description:
A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circumstances where users have explicitly disabled Spectre mitigations. *Note: Spectre mitigations are currently enabled for all users by default settings.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.


definition_id: oval:org.debian:def:124923882336819669298594943763987848320
title: CVE-2019-9795 firefox-esr
description:
A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.


definition_id: oval:org.debian:def:58462350479458362935195749692995741405
title: CVE-2019-9796 firefox-esr
description:
A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration is expected. When a registration is later freed with the removal of the animation controller element, the refresh driver incorrectly leaves a dangling pointer to the driver's observer array. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.


definition_id: oval:org.debian:def:111056269361827301520599776097328104316
title: CVE-2019-9797 firefox-esr
description:
Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox < 66.


definition_id: oval:org.debian:def:67419604861254337233710243134156882737
title: CVE-2019-9800 firefox-esr
description:
Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.


definition_id: oval:org.debian:def:159232980446034900085247393743267622225
title: CVE-2019-9810 firefox-esr
description:
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.


definition_id: oval:org.debian:def:141020498730429460506808886990076103396
title: CVE-2019-9813 firefox-esr
description:
Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.


definition_id: oval:org.debian:def:193022216395160738839949221883585931370
title: CVE-2019-9816 firefox-esr
description:
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.


definition_id: oval:org.debian:def:16479554528492596443967460522830618990
title: CVE-2019-9817 firefox-esr
description:
Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.


definition_id: oval:org.debian:def:61944404464143538353464396736704339410
title: CVE-2019-9819 firefox-esr
description:
A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.


definition_id: oval:org.debian:def:152309133088417309984327366026893362373
title: CVE-2019-9820 firefox-esr
description:
A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.


definition_id: oval:org.debian:def:96344390385568621985582775620167023430
title: CVE-2019-9824 qemu
description:
tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure.


definition_id: oval:org.debian:def:110830273854524252755635553363305987980
title: CVE-2019-9853 libreoffice
description:
LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the document were processed and categorized, resulting in the possibility to construct a document where macro execution bypassed the security settings. The documents were correctly detected as containing macros, and prompted the user to their existence within the documents, but macros within the document were subsequently not controlled by the security settings allowing arbitrary macro execution This issue affects: LibreOffice 6.2 series versions prior to 6.2.7; LibreOffice 6.3 series versions prior to 6.3.1.


definition_id: oval:org.debian:def:116581617768411746811384865676589945774
title: CVE-2019-9857 linux
description:
In the Linux kernel through 5.0.2, the function inotify_update_existing_watch() in fs/notify/inotify/inotify_user.c neglects to call fsnotify_put_mark() with IN_MASK_CREATE after fsnotify_find_mark(), which will cause a memory leak (aka refcount leak). Finally, this will cause a denial of service.


definition_id: oval:org.debian:def:5972894240827572946500873744447447681
title: CVE-2019-9858 php-horde-form
description:
Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulnerable class that handles image upload in forms. When the Horde_Form_Type_image method onSubmit() is called on uploads, it invokes the functions getImage() and _getUpload(), which uses unsanitized user input as a path to save the image. The unsanitized POST parameter object[photo][img][file] is saved in the $upload[img][file] PHP variable, allowing an attacker to manipulate the $tmp_file passed to move_uploaded_file() to save the uploaded file. By setting the parameter to (for example) ../usr/share/horde/static/bd.php, one can write a PHP backdoor inside the web root. The static/ destination folder is a good candidate to drop the backdoor because it is always writable in Horde installations. (The unsanitized POST parameter went probably unnoticed because it's never submitted by the forms, which default to securely using a random path.)


definition_id: oval:org.debian:def:83296148680054284697474944019214613693
title: CVE-2019-9892 otrs2
description:
An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of arbitrary files on the OTRS filesystem.


definition_id: oval:org.debian:def:37695347106996075718697333372691826932
title: CVE-2019-9894 putty
description:
A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.


definition_id: oval:org.debian:def:57394006508078961207776919724828658903
title: CVE-2019-9895 putty
description:
In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding.


definition_id: oval:org.debian:def:10337406214185306830169443861387233965
title: CVE-2019-9897 putty
description:
Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.


definition_id: oval:org.debian:def:166681089438768261129722420771738147892
title: CVE-2019-9903 poppler
description:
PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.


definition_id: oval:org.debian:def:7389868388000507550674519879944050509
title: CVE-2019-9917 znc
description:
ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.


definition_id: oval:org.debian:def:59660616478713886489766168396582364833
title: CVE-2019-9924 bash
description:
rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.


definition_id: oval:org.debian:def:336230907299573428817909885068853229927
title: CVE-2019-9928 gst-plugins-base1.0
description:
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.


definition_id: oval:org.debian:def:72703108216129724560115974330446243377
title: CVE-2019-9936 sqlite3
description:
In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.


definition_id: oval:org.debian:def:90750021397661177954167974014368187949
title: CVE-2019-9937 sqlite3
description:
In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.


definition_id: oval:org.debian:def:63913035125584545500980653213488447738
title: CVE-2019-9942 twig
description:
A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.


definition_id: oval:org.debian:def:333699906445307243020862278512295638102
title: CVE-2019-9947 python2.7
description:
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.


definition_id: oval:org.debian:def:154769356573446655964070159253746328654
title: CVE-2019-9948 python2.7
description:
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.


definition_id: oval:org.debian:def:126424943089264598759665573490894250482
title: CVE-2019-9956 imagemagick
description:
In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.


definition_id: oval:org.debian:def:169154173625339971794613672675322004871
title: CVE-2019-9959 poppler
description:
The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.


definition_id: oval:org.debian:def:304704403288554497063685601443810378405
title: CVE-2020-0009 linux
description:
In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-142938932


definition_id: oval:org.debian:def:55273527979055230102137698216998240003
title: CVE-2020-0030 linux
description:
In binder_thread_release of binder.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145286050References: Upstream kernel


definition_id: oval:org.debian:def:284535187507192417194388488060819444218
title: CVE-2020-0034 libvpx
description:
In vp8_decode_frame of decodeframe.c, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure if error correction were turned on, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1Android ID: A-62458770


definition_id: oval:org.debian:def:219200734214822760619946296765867308058
title: CVE-2020-0066 linux
description:
In the netlink driver, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-65025077


definition_id: oval:org.debian:def:330417389710118695455995360681312546039
title: CVE-2020-0067 linux
description:
In f2fs_xattr_generic_list of xattr.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not required for exploitation.Product: Android. Versions: Android kernel. Android ID: A-120551147.


definition_id: oval:org.debian:def:222368088462840181788843984820733565647
title: CVE-2020-0093 libexif
description:
In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-148705132


definition_id: oval:org.debian:def:250536698471107790012046318667765324865
title: CVE-2020-0181 libexif
description:
In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076


definition_id: oval:org.debian:def:41652019782908120726474429712085087324
title: CVE-2020-0182 libexif
description:
In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147140917


definition_id: oval:org.debian:def:179121930237306461665631847426608229917
title: CVE-2020-0198 libexif
description:
In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941


definition_id: oval:org.debian:def:308416090488377374573820833514292205165
title: CVE-2020-0305 linux
description:
In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-153467744


definition_id: oval:org.debian:def:65868562811124901365771996934778131441
title: CVE-2020-0404 linux
description:
In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-111893654References: Upstream kernel


definition_id: oval:org.debian:def:221712409278084682266809716476092187325
title: CVE-2020-0423 linux
description:
In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-161151868References: N/A


definition_id: oval:org.debian:def:100559716987811085188386562759227931179
title: CVE-2020-0427 linux
description:
In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171


definition_id: oval:org.debian:def:300049359270131569530755098963243141531
title: CVE-2020-0429 linux
description:
In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-152735806


definition_id: oval:org.debian:def:19964093794755526325676709441946742784
title: CVE-2020-0430 linux
description:
In skb_headlen of /include/linux/skbuff.h, there is a possible out of bounds read due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-153881554


definition_id: oval:org.debian:def:119585064682235616527072519545023629507
title: CVE-2020-0431 linux
description:
In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-144161459


definition_id: oval:org.debian:def:244539313439868764379646738751104227908
title: CVE-2020-0432 linux
description:
In skb_to_mamac of networking.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-143560807


definition_id: oval:org.debian:def:248829625482659684875780211335030525887
title: CVE-2020-0433 linux
description:
In blk_mq_queue_tag_busy_iter of blk-mq-tag.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-151939299


definition_id: oval:org.debian:def:219603162430680288612021717931568232901
title: CVE-2020-0444 linux
description:
In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-150693166References: Upstream kernel


definition_id: oval:org.debian:def:258572197075920344324636437621170928175
title: CVE-2020-0465 linux
description:
In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-162844689References: Upstream kernel


definition_id: oval:org.debian:def:269109709277312434295574784163443895288
title: CVE-2020-0466 linux
description:
In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147802478References: Upstream kernel


definition_id: oval:org.debian:def:204431073702243095559993664715901336023
title: CVE-2020-0499 flac
description:
In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156076070


definition_id: oval:org.debian:def:20196178853577574590147466951858901087
title: CVE-2020-10001 cups
description:
An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to read restricted memory.


definition_id: oval:org.debian:def:337739125887559030537810928135101095963
title: CVE-2020-10029 glibc
description:
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.


definition_id: oval:org.debian:def:81447895602085280866441813345736479745
title: CVE-2020-10108 twisted
description:
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.


definition_id: oval:org.debian:def:262741866060388285445019479969176172132
title: CVE-2020-10109 twisted
description:
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.


definition_id: oval:org.debian:def:139042126586478268173359031585468655808
title: CVE-2020-10174 timeshift
description:
init_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03 unsafely reuses a preexisting temporary directory in the predictable location /tmp/timeshift. It follows symlinks in this location or uses directories owned by unprivileged users. Because Timeshift also executes scripts under this location, an attacker can attempt to win a race condition to replace scripts created by Timeshift with attacker-controlled scripts. Upon success, an attacker-controlled script is executed with full root privileges. This logic is practically always triggered when Timeshift runs regardless of the command-line arguments used.


definition_id: oval:org.debian:def:307302103881550854131323327046942744230
title: CVE-2020-10188 inetutils
description:
utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions.


definition_id: oval:org.debian:def:51785235062656665209121782199504293779
title: CVE-2020-10232 sleuthkit
description:
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file timestamp parsing logic in yaffsfs_istat() in fs/yaffs.c.


definition_id: oval:org.debian:def:314963673133221247760564930858594979802
title: CVE-2020-10289 ros-actionlib
description:
Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib, an attacker with local or remote access can make the ROS Master, execute arbitrary code in Python form. Consider yaml.safe_load() instead. Located first in actionlib/tools/library.py:132. See links for more info on the bug.


definition_id: oval:org.debian:def:255202805116008620002000282337691696474
title: CVE-2020-10378 pillow
description:
In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.


definition_id: oval:org.debian:def:3836668585229030794409962493500579309
title: CVE-2020-10543 perl
description:
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.


definition_id: oval:org.debian:def:319516482310566924901149050790439890311
title: CVE-2020-10663 ruby-json
description:
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.


definition_id: oval:org.debian:def:240810694322996767778193199245765335151
title: CVE-2020-10672 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).


definition_id: oval:org.debian:def:21944739249528854017033264412949087697
title: CVE-2020-10673 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).


definition_id: oval:org.debian:def:272371881083297559255661679974790036524
title: CVE-2020-10690 linux
description:
There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed, it can cause an exploitable condition as the process wakes up to terminate and clean all attached files. The system crashes due to the cdev structure being invalid (as already freed) which is pointed to by the inode.


definition_id: oval:org.debian:def:318398492732343971913656930681636006134
title: CVE-2020-10720 linux
description:
A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. This flaw allows an attacker with local access to crash the system.


definition_id: oval:org.debian:def:172868815213237110819027335852593763164
title: CVE-2020-10742 linux
description:
A flaw was found in the Linux kernel. An index buffer overflow during Direct IO write leading to the NFS client to crash. In some cases, a reach out of the index after one memory allocation by kmalloc will cause a kernel panic. The highest threat from this vulnerability is to data confidentiality and system availability.


definition_id: oval:org.debian:def:108123171402889439088869596894801392275
title: CVE-2020-10759 fwupd
description:
A PGP signature bypass flaw was found in fwupd, which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because the Linux Vendor Firmware Service (LVFS) is either not implemented or enabled in versions of fwupd shipped with Red Hat Enterprise Linux 7 and 8. The highest threat from this vulnerability is to confidentiality and integrity.


definition_id: oval:org.debian:def:40793347636714324920817635747379511947
title: CVE-2020-10766 linux
description:
A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality.


definition_id: oval:org.debian:def:222160042753310359845598221819521199433
title: CVE-2020-10767 linux
description:
A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local attacker to perform a Spectre V2 style attack when this configuration is active. The highest threat from this vulnerability is to confidentiality.


definition_id: oval:org.debian:def:141529543744727656390744849114621515078
title: CVE-2020-10768 linux
description:
A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.


definition_id: oval:org.debian:def:194806955436600773842168960580025835728
title: CVE-2020-10769 linux
description:
A buffer over-read flaw was found in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of service.


definition_id: oval:org.debian:def:28111838770956473584607733190253637385
title: CVE-2020-10773 linux
description:
A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it incorrectly writes to the /proc/sys/vm/cmm_timeout file. This flaw allows a local user to see the kernel data.


definition_id: oval:org.debian:def:102212930020605390876912004448344661740
title: CVE-2020-10781 linux
description:
A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable.


definition_id: oval:org.debian:def:148518658495846147201116590740649573426
title: CVE-2020-10878 perl
description:
Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.


definition_id: oval:org.debian:def:113511349876814311615230920907989922828
title: CVE-2020-10932 mbedtls
description:
An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough side-channel measurements can recover the long-term ECDSA private key by (1) reconstructing the projective coordinate of the result of scalar multiplication by exploiting side channels in the conversion to affine coordinates; (2) using an attack described by Naccache, Smart, and Stern in 2003 to recover a few bits of the ephemeral scalar from those projective coordinates via several measurements; and (3) using a lattice attack to get from there to the long-term ECDSA private key used for the signatures. Typically an attacker would have sufficient access when attacking an SGX enclave and controlling the untrusted OS.


definition_id: oval:org.debian:def:9524741182118981374220906866130827377
title: CVE-2020-10941 mbedtls
description:
Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import.


definition_id: oval:org.debian:def:27498995309113652851266700826738684409
title: CVE-2020-10968 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).


definition_id: oval:org.debian:def:57507890121553904746432516588327638694
title: CVE-2020-10969 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.


definition_id: oval:org.debian:def:216263963795476357804161612114073469175
title: CVE-2020-11022 jquery
description:
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.


definition_id: oval:org.debian:def:101692036883016694010447131396380328937
title: CVE-2020-11023 jquery
description:
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.


definition_id: oval:org.debian:def:109966598081967992082388056324971527801
title: CVE-2020-11061 bacula
description:
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in Bareos versions 19.2.8, 18.2.9 and 17.2.10.


definition_id: oval:org.debian:def:61712859833985153191236638397064138838
title: CVE-2020-11076 puma
description:
In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.


definition_id: oval:org.debian:def:225693679887091021653771590536463172027
title: CVE-2020-11077 puma
description:
In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This is a similar but different vulnerability from CVE-2020-11076. The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.


definition_id: oval:org.debian:def:114798518450362224215683991019535047136
title: CVE-2020-11111 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).


definition_id: oval:org.debian:def:201607086039758307821173427020939828697
title: CVE-2020-11112 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).


definition_id: oval:org.debian:def:261641040397869593161140147037384431744
title: CVE-2020-11113 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).


definition_id: oval:org.debian:def:226174029267057077588910568941136092514
title: CVE-2020-11494 linux
description:
An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL, aka CID-b9258a2cece4.


definition_id: oval:org.debian:def:215965156376182106448576002066610715911
title: CVE-2020-11524 freerdp2
description:
libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.


definition_id: oval:org.debian:def:23491157492389373959446629614199716463
title: CVE-2020-11538 pillow
description:
In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.


definition_id: oval:org.debian:def:337733223123451825449410141036287210196
title: CVE-2020-11608 linux
description:
An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints, aka CID-998912346c0d.


definition_id: oval:org.debian:def:281681806302348553423097022556657360977
title: CVE-2020-11609 linux
description:
An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c mishandle invalid descriptors, as demonstrated by a NULL pointer dereference, aka CID-485b06aadb93.


definition_id: oval:org.debian:def:167940993689984726033715234766971755249
title: CVE-2020-11619 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).


definition_id: oval:org.debian:def:241529352640765083619962464307982470014
title: CVE-2020-11620 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).


definition_id: oval:org.debian:def:296593184544617597263245762626355584249
title: CVE-2020-11647 wireshark
description:
In Wireshark 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15, the BACapp dissector could crash. This was addressed in epan/dissectors/packet-bacapp.c by limiting the amount of recursion.


definition_id: oval:org.debian:def:240375438954491189355137294309723303026
title: CVE-2020-11653 varnish
description:
An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.


definition_id: oval:org.debian:def:91003970554609857592703815600006832133
title: CVE-2020-11668 linux
description:
In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770.


definition_id: oval:org.debian:def:176308088757858947155162203322113900453
title: CVE-2020-11669 linux
description:
An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR, aka CID-53a712bae5dd.


definition_id: oval:org.debian:def:186642786380462812875439531977453312210
title: CVE-2020-11736 file-roller
description:
fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.


definition_id: oval:org.debian:def:302302722382827692387165798414466699477
title: CVE-2020-11800 zabbix
description:
Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:81738570038315887966221199961840566846
title: CVE-2020-11810 openvpn
description:
An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim's peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim's connection will be dropped. This requires careful timing due to the small time window (usually within a few seconds) between the victim client connection starting and the server PUSH_REPLY response back to the client. This attack will only work if Negotiable Cipher Parameters (NCP) is in use.


definition_id: oval:org.debian:def:66504588443928522890518375587133381659
title: CVE-2020-11888 python-markdown2
description:
python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.


definition_id: oval:org.debian:def:216193047335878714485641564342845417829
title: CVE-2020-11947 qemu
description:
iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker.


definition_id: oval:org.debian:def:41229993163855918107074731932144783853
title: CVE-2020-11985 apache2
description:
IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.


definition_id: oval:org.debian:def:339985215183511920754777765700711356016
title: CVE-2020-11988 xmlgraphics-commons
description:
Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.


definition_id: oval:org.debian:def:320321549614889724586467349244660614917
title: CVE-2020-11989 shiro
description:
Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.


definition_id: oval:org.debian:def:314231139373202590134033250100479584129
title: CVE-2020-12049 dbus
description:
An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.


definition_id: oval:org.debian:def:205944244847870910574941559144698158414
title: CVE-2020-12268 jbig2dec
description:
jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow.


definition_id: oval:org.debian:def:254816713058775448284367046198929239987
title: CVE-2020-12460 opendmarc
description:
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '\0' byte overwrites the heap metadata of the next chunk and its PREV_INUSE flag.


definition_id: oval:org.debian:def:320622877970807610945020704658240988899
title: CVE-2020-12465 linux
description:
An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel before 5.5.10, aka CID-b102f0c522cf. An oversized packet with too many rx fragments can corrupt memory of adjacent pages.


definition_id: oval:org.debian:def:112764112564385532992776753160069356629
title: CVE-2020-12640 roundcube
description:
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.


definition_id: oval:org.debian:def:200162974988499660066957977221693664461
title: CVE-2020-12641 roundcube
description:
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.


definition_id: oval:org.debian:def:18460551909467226587760589417354212272
title: CVE-2020-12652 linux
description:
The __mptctl_ioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to hold an incorrect lock during the ioctl operation and trigger a race condition, i.e., a "double fetch" vulnerability, aka CID-28d76df18f0a. NOTE: the vendor states "The security impact of this bug is not as bad as it could have been because these operations are all privileged and root already has enormous destructive power."


definition_id: oval:org.debian:def:273265243673047334869299164065342457060
title: CVE-2020-12653 linux
description:
An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of an incorrect memcpy and buffer overflow, aka CID-b70261a288ea.


definition_id: oval:org.debian:def:67616355321389569687726346488446862542
title: CVE-2020-12654 linux
description:
An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591.


definition_id: oval:org.debian:def:209590035412341394102134079186427329192
title: CVE-2020-12655 linux
description:
An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10. Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka CID-d0c7feaf8767.


definition_id: oval:org.debian:def:223581034857349060119097998610191387790
title: CVE-2020-12656 linux
description:
** DISPUTED ** gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 implementation in the Linux kernel through 5.6.10 lacks certain domain_release calls, leading to a memory leak. Note: This was disputed with the assertion that the issue does not grant any access not already available. It is a problem that on unloading a specific kernel module some memory is leaked, but loading kernel modules is a privileged operation. A user could also write a kernel module to consume any amount of memory they like and load that replicating the effect of this bug.


definition_id: oval:org.debian:def:269322770504701956433218474968564543795
title: CVE-2020-12657 linux
description:
An issue was discovered in the Linux kernel before 5.6.5. There is a use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body.


definition_id: oval:org.debian:def:110707449061689025920051242749977260207
title: CVE-2020-12659 linux
description:
An issue was discovered in the Linux kernel before 5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write (by a user with the CAP_NET_ADMIN capability) because of a lack of headroom validation.


definition_id: oval:org.debian:def:337116610302117350778944429614531437410
title: CVE-2020-12689 keystone
description:
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.


definition_id: oval:org.debian:def:238582117265750028479007585405490403910
title: CVE-2020-12690 keystone
description:
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.


definition_id: oval:org.debian:def:310235790134877878775292081741377190150
title: CVE-2020-12691 keystone
description:
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.


definition_id: oval:org.debian:def:117212268053976111564677784608837796973
title: CVE-2020-12692 keystone
description:
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.


definition_id: oval:org.debian:def:93777748955652198876949876032027439249
title: CVE-2020-12695 gupnp
description:
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.


definition_id: oval:org.debian:def:77183915482645230426900829050400395545
title: CVE-2020-12723 perl
description:
regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.


definition_id: oval:org.debian:def:156139770782043353106364297125225674364
title: CVE-2020-12769 linux
description:
An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one, aka CID-19b61392c5a8.


definition_id: oval:org.debian:def:181238781673561449797686641912627180023
title: CVE-2020-12771 linux
description:
An issue was discovered in the Linux kernel through 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c has a deadlock if a coalescing operation fails.


definition_id: oval:org.debian:def:270413442020249784754176048842086504220
title: CVE-2020-12826 linux
description:
A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. Because exec_id in include/linux/sched.h is only 32 bits, an integer overflow can interfere with a do_notify_parent protection mechanism. A child process can send an arbitrary signal to a parent process in a different security domain. Exploitation limitations include the amount of elapsed time before an integer overflow occurs, and the lack of scenarios where signals to a parent process present a substantial operational threat.


definition_id: oval:org.debian:def:168811026490536348104401576468291598418
title: CVE-2020-12872 erlang
description:
yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with a version less than 21.0.


definition_id: oval:org.debian:def:3604024622763837270290220995053347549
title: CVE-2020-12888 linux
description:
The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space.


definition_id: oval:org.debian:def:268738731686341095707008465261713899822
title: CVE-2020-13112 libexif
description:
An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This is different from CVE-2020-0093.


definition_id: oval:org.debian:def:25972694636643084334875766812805914688
title: CVE-2020-13113 libexif
description:
An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.


definition_id: oval:org.debian:def:221301282685541543568479434463994124626
title: CVE-2020-13114 libexif
description:
An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data.


definition_id: oval:org.debian:def:253253406470077150119646030978492803725
title: CVE-2020-13124 sabnzbdplus
description:
SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to execute arbitrary Python commands on the underlying operating system.


definition_id: oval:org.debian:def:80766632983898985003962176874655467537
title: CVE-2020-13164 wireshark
description:
In Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS dissector could crash. This was addressed in epan/dissectors/packet-nfs.c by preventing excessive recursion, such as for a cycle in the directory graph on a filesystem.


definition_id: oval:org.debian:def:294948316048011588300820443837670709814
title: CVE-2020-13230 cacti
description:
In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).


definition_id: oval:org.debian:def:326316261570464691631080598712108165024
title: CVE-2020-13249 mariadb-10.3
description:
libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.


definition_id: oval:org.debian:def:315376690247768536386881082529491002706
title: CVE-2020-13253 qemu
description:
sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.


definition_id: oval:org.debian:def:174535487424401270506951403936092977903
title: CVE-2020-13543 webkit2gtk
description:
A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A specially crafted web page can trigger a use-after-free vulnerability which can lead to remote code execution. An attacker can get a user to visit a webpage to trigger this vulnerability.


definition_id: oval:org.debian:def:13015575379992881264331261607108905820
title: CVE-2020-13630 sqlite3
description:
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.


definition_id: oval:org.debian:def:255729888451994784610145803138074005183
title: CVE-2020-13632 sqlite3
description:
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.


definition_id: oval:org.debian:def:32316396813719937491257559051097029500
title: CVE-2020-13645 glib-networking
description:
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.


definition_id: oval:org.debian:def:141422426544029768983869092551073983321
title: CVE-2020-13765 qemu
description:
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.


definition_id: oval:org.debian:def:72429543014028199233926709694166871827
title: CVE-2020-13790 libjpeg-turbo
description:
libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.


definition_id: oval:org.debian:def:251392858613948002729709930337219243037
title: CVE-2020-13822 node-elliptic
description:
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.


definition_id: oval:org.debian:def:35694036463514282231862921212973403450
title: CVE-2020-13881 libpam-tacplus
description:
In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.


definition_id: oval:org.debian:def:21237315197752587186874946522213911566
title: CVE-2020-13933 shiro
description:
Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.


definition_id: oval:org.debian:def:192234652708387414493560154283815200318
title: CVE-2020-13936 velocity
description:
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.


definition_id: oval:org.debian:def:126612277234385379190655514959038230419
title: CVE-2020-13974 linux
description:
An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in the community argue that the integer overflow does not lead to a security issue in this case.


definition_id: oval:org.debian:def:250212694111074501309261409939562291920
title: CVE-2020-14004 icinga2
description:
An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrary files can be changed to mode 2750 by the unprivileged icinga2 user.


definition_id: oval:org.debian:def:224789266290286571877046277318286225193
title: CVE-2020-14060 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).


definition_id: oval:org.debian:def:40911095620707348931210617870423403703
title: CVE-2020-14061 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).


definition_id: oval:org.debian:def:201737291674560930873670258183657108072
title: CVE-2020-14062 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).


definition_id: oval:org.debian:def:171748453432466786734597434485008502217
title: CVE-2020-14152 libjpeg-turbo
description:
In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.


definition_id: oval:org.debian:def:70825274668931170496071021209223895142
title: CVE-2020-14154 mutt
description:
Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.


definition_id: oval:org.debian:def:99317912285023833093192898835659265169
title: CVE-2020-14195 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).


definition_id: oval:org.debian:def:289494255190167683262862853996015946074
title: CVE-2020-14305 linux
description:
An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


definition_id: oval:org.debian:def:335430663643324180568418039437842951060
title: CVE-2020-14312 dnsmasq
description:
A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.


definition_id: oval:org.debian:def:212432955345110368883257234986610717070
title: CVE-2020-14314 linux
description:
A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability.


definition_id: oval:org.debian:def:166371895276660341656944635784869957145
title: CVE-2020-14331 linux
description:
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


definition_id: oval:org.debian:def:80267709309682585323739955570090396413
title: CVE-2020-14344 libx11
description:
An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.


definition_id: oval:org.debian:def:176026375428162828354893753151316089797
title: CVE-2020-14349 postgresql-11
description:
It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.


definition_id: oval:org.debian:def:325269755580789440366020241906993668067
title: CVE-2020-14350 postgresql-11
description:
It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.


definition_id: oval:org.debian:def:11420615937892490809781302848882592186
title: CVE-2020-14351 linux
description:
A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


definition_id: oval:org.debian:def:84984541802085221884799195820781586072
title: CVE-2020-14356 linux
description:
A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system.


definition_id: oval:org.debian:def:26327019717972873420517196741381578055
title: CVE-2020-14363 libx11
description:
An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to cause an application compiled with libX11 to crash, or in some cases, result in arbitrary code execution. The highest threat from this flaw is to confidentiality, integrity as well as system availability.


definition_id: oval:org.debian:def:65792368884835662138634233911312491528
title: CVE-2020-14367 chrony
description:
A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while still running as the root user, and when it's opened for writing, chronyd does not check for an existing symbolic link with the same file name. This flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing to any destination file in the system, resulting in data loss and a denial of service due to the path traversal.


definition_id: oval:org.debian:def:140807850346416501299288712044716869756
title: CVE-2020-14373 ghostscript
description:
A use after free was found in igc_reloc_struct_ptr() of psi/igc.c of ghostscript-9.25. A local attacker could supply a specially crafted PDF file to cause a denial of service.


definition_id: oval:org.debian:def:83337377087852357737243103125003667673
title: CVE-2020-14374 dpdk
description:
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_data function leads to a buffer overflow allowing an attacker in a virtual machine to write arbitrary data to any address in the vhost_crypto application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


definition_id: oval:org.debian:def:334158918630074357863281449604879556270
title: CVE-2020-14375 dpdk
description:
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


definition_id: oval:org.debian:def:97696127776055506571579718885676393924
title: CVE-2020-14376 dpdk
description:
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copying iv_data from the VM guest memory into host memory can lead to a large buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


definition_id: oval:org.debian:def:140480834432891775724927943435822393536
title: CVE-2020-14377 dpdk
description:
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer over read. The results of the over read are then written back to the guest virtual machine memory. This vulnerability can be used by an attacker in a virtual machine to read significant amounts of host memory. The highest threat from this vulnerability is to data confidentiality and system availability.


definition_id: oval:org.debian:def:293904212329921083155955414022282450254
title: CVE-2020-14378 dpdk
description:
An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large amounts of CPU cycles being eaten up in a long running loop. An attacker could cause `move_desc` to get stuck in a 4,294,967,295-count iteration loop. Depending on how `vhost_crypto` is being used this could prevent other VMs or network tasks from being serviced by the busy DPDK lcore for an extended period.


definition_id: oval:org.debian:def:316510763861024227232028399567609514937
title: CVE-2020-14381 linux
description:
A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is about to be unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


definition_id: oval:org.debian:def:219715370633894724664650211235185893266
title: CVE-2020-14385 linux
description:
A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. The highest threat from this vulnerability is to system availability.


definition_id: oval:org.debian:def:84783496984382873760931380396789434766
title: CVE-2020-14386 linux
description:
A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity.


definition_id: oval:org.debian:def:55829113298426176044425465868061023564
title: CVE-2020-14390 linux
description:
A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.


definition_id: oval:org.debian:def:47818708760616085028233603427613786923
title: CVE-2020-14392 libdbi-perl
description:
An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's availability.


definition_id: oval:org.debian:def:243434634554490752012281118471145679702
title: CVE-2020-14393 libdbi-perl
description:
A buffer overflow was found in perl-DBI < 1.643 in DBI.xs. A local attacker who is able to supply a string longer than 300 characters could cause an out-of-bounds write, affecting the availability of the service or integrity of data.


definition_id: oval:org.debian:def:269788588617754245456034688556832034514
title: CVE-2020-14397 libvncserver
description:
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.


definition_id: oval:org.debian:def:66328478877823540293823820298868853818
title: CVE-2020-14399 libvncserver
description:
** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly "no trust boundary crossed."


definition_id: oval:org.debian:def:255129739099248603675591714675963755014
title: CVE-2020-14400 libvncserver
description:
** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary.


definition_id: oval:org.debian:def:170878603921193288722454547768088478604
title: CVE-2020-14401 libvncserver
description:
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.


definition_id: oval:org.debian:def:304449122697412540912893278350067024837
title: CVE-2020-14402 libvncserver
description:
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.


definition_id: oval:org.debian:def:307379003242960828414409837486998684890
title: CVE-2020-14403 libvncserver
description:
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.


definition_id: oval:org.debian:def:106401750685114034073788030301925865322
title: CVE-2020-14404 libvncserver
description:
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.


definition_id: oval:org.debian:def:64074936351592242385567037461151047186
title: CVE-2020-14405 libvncserver
description:
An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.


definition_id: oval:org.debian:def:186493385392439385826516444613569917774
title: CVE-2020-14409 libsdl2
description:
SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c via a crafted .BMP file.


definition_id: oval:org.debian:def:103380181530856531894606106150655537273
title: CVE-2020-14410 libsdl2
description:
SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP file.


definition_id: oval:org.debian:def:301794416267637372792284310288948621795
title: CVE-2020-14416 linux
description:
In the Linux kernel before 5.4.16, a race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-after-free, aka CID-0ace17d56824. This affects drivers/net/slip/slip.c and drivers/net/can/slcan.c.


definition_id: oval:org.debian:def:261053041394697396387037966541845957100
title: CVE-2020-14422 python3.7
description:
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.


definition_id: oval:org.debian:def:71026414052289785669040984847170918151
title: CVE-2020-14664 openjfx
description:
Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX). The supported version that is affected is Java SE: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).


definition_id: oval:org.debian:def:153935112761566626566490764634897196399
title: CVE-2020-14765 mariadb-10.3
description:
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).


definition_id: oval:org.debian:def:5780998422446132581233701474771464088
title: CVE-2020-14776 mariadb-10.3
description:
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


definition_id: oval:org.debian:def:143545144062507024927469003945222859560
title: CVE-2020-14789 mariadb-10.3
description:
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


definition_id: oval:org.debian:def:311343976248524031746397353796992972246
title: CVE-2020-14812 mariadb-10.3
description:
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


definition_id: oval:org.debian:def:91573671164115328820242269189276134172
title: CVE-2020-14954 neomutt
description:
Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."


definition_id: oval:org.debian:def:89832361739079931062967643648013576984
title: CVE-2020-14983 chocolate-doom
description:
The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack.


definition_id: oval:org.debian:def:229548552839048233705398738585201878693
title: CVE-2020-15078 openvpn
description:
OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.


definition_id: oval:org.debian:def:60916360143782538343484121817652267915
title: CVE-2020-15095 npm
description:
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.


definition_id: oval:org.debian:def:200991754010688754116965220185481714576
title: CVE-2020-15256 node-object-path
description:
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.


definition_id: oval:org.debian:def:50509524149683789399649291040831815040
title: CVE-2020-15358 sqlite3
description:
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.


definition_id: oval:org.debian:def:327798374798419850390259315795313567981
title: CVE-2020-15393 linux
description:
In the Linux kernel 4.4 through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770.


definition_id: oval:org.debian:def:280421400901921442945411210815760582946
title: CVE-2020-15436 linux
description:
Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.


definition_id: oval:org.debian:def:272004878960519697069035880371093122377
title: CVE-2020-15437 linux
description:
The Linux kernel before version 5.8 is vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allows local users to cause a denial of service by using the p->serial_in pointer which uninitialized.


definition_id: oval:org.debian:def:83019736721461984204105777347151151242
title: CVE-2020-15466 wireshark
description:
In Wireshark 3.2.0 to 3.2.4, the GVCP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gvcp.c by ensuring that an offset increases in all situations.


definition_id: oval:org.debian:def:201316661748412806783618065770027719099
title: CVE-2020-15469 qemu
description:
In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.


definition_id: oval:org.debian:def:178875015220526723517001423735724557525
title: CVE-2020-15472 ndpi
description:
In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short.


definition_id: oval:org.debian:def:209539651048639049767394841450033449988
title: CVE-2020-15476 ndpi
description:
In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.


definition_id: oval:org.debian:def:159668755169730861176666295807360842947
title: CVE-2020-15503 libraw
description:
LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example, malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength.


definition_id: oval:org.debian:def:19271793478779315519681791149119942941
title: CVE-2020-15569 milkytracker
description:
PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor.


definition_id: oval:org.debian:def:69248012646607556827719151022978569802
title: CVE-2020-15591 fex
description:
fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).


definition_id: oval:org.debian:def:28820709656285963635425518922585674573
title: CVE-2020-15646 thunderbird
description:
If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanism, and the attacker sends a crafted response, then Thunderbird sends username and password over https to a server controlled by the attacker. This vulnerability affects Thunderbird < 68.10.0.


definition_id: oval:org.debian:def:239259823104325988914907847542047133933
title: CVE-2020-15780 linux
description:
An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30.


definition_id: oval:org.debian:def:322960809661534320211676107303570106972
title: CVE-2020-15859 qemu
description:
QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.


definition_id: oval:org.debian:def:13713060867613488860993251447410036572
title: CVE-2020-15953 libetpan
description:
LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."


definition_id: oval:org.debian:def:23100573941172852750536377581244699184
title: CVE-2020-16093 lemonldap-ng
description:
In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used.


definition_id: oval:org.debian:def:209913952812688122959757982534100373818
title: CVE-2020-16117 evolution-data-server
description:
In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.


definition_id: oval:org.debian:def:88686896734812327985860306705107751562
title: CVE-2020-16119 linux
description:
Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196.


definition_id: oval:org.debian:def:191011847027384235365831681179620598168
title: CVE-2020-16124 ros-ros-comm
description:
Integer Overflow or Wraparound vulnerability in the XML RPC library of OpenRobotics ros_comm communications packages allows unauthenticated network traffic to cause unexpected behavior. This issue affects: OpenRobotics ros_comm communications packages Noetic and prior versions. Fixed in https://github.com/ros/ros_comm/pull/2065.


definition_id: oval:org.debian:def:38805444802623920286688752548056898257
title: CVE-2020-16150 mbedtls
description:
A Lucky 13 timing side channel in mbedtls_ssl_decrypt_buf in library/ssl_msg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret key information. This affects CBC mode because of a computed time difference based on a padding length.


definition_id: oval:org.debian:def:313157273049421347375386989555708492992
title: CVE-2020-16166 linux
description:
The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c.


definition_id: oval:org.debian:def:277810821682387641259369456486158942111
title: CVE-2020-16587 openexr
description:
A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that can cause a denial of service via a crafted EXR file.


definition_id: oval:org.debian:def:53005442819138508338161967386341112520
title: CVE-2020-16588 openexr
description:
A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.


definition_id: oval:org.debian:def:289044015431123234729610461836576252941
title: CVE-2020-16589 openexr
description:
A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.cpp that can cause a denial of service via a crafted EXR file.


definition_id: oval:org.debian:def:73292640797762317329793634435054803281
title: CVE-2020-16600 mupdf
description:
A Use After Free vulnerability exists in Artifex Software, Inc. MuPDF library 1.17.0-rc1 and earlier when a valid page was followed by a page with invalid pixmap dimensions, causing bander - a static - to point to previously freed memory instead of a newband_writer.


definition_id: oval:org.debian:def:225217690372962658674527193494224126664
title: CVE-2020-1712 systemd
description:
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.


definition_id: oval:org.debian:def:242353554760908695808695481403652420423
title: CVE-2020-1730 libssh
description:
A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.


definition_id: oval:org.debian:def:300814506830858145463504264662074648726
title: CVE-2020-17367 mediawiki
description:
Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection.


definition_id: oval:org.debian:def:183251432222214162139259551160130532880
title: CVE-2020-17368 mediawiki
description:
Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection.


definition_id: oval:org.debian:def:185272477709796779635551640223523532055
title: CVE-2020-17482 pdns
description:
An issue has been found in PowerDNS Authoritative Server before 4.3.1 where an authorized user with the ability to insert crafted records into a zone might be able to leak the content of uninitialized memory.


definition_id: oval:org.debian:def:218215534082951839864269230434630047966
title: CVE-2020-17489 gnome-shell
description:
An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog reappears with the password still visible. If the user had decided to have the password shown in cleartext at login time, it is then visible for a brief moment upon a logout. (If the password were never shown in cleartext, only the password length is revealed.)


definition_id: oval:org.debian:def:187229394888033532881863228758328741385
title: CVE-2020-1749 linux
description:
A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.


definition_id: oval:org.debian:def:85882546340673048726574395071466255143
title: CVE-2020-17507 qt4-x11
description:
An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read.


definition_id: oval:org.debian:def:54866744601946019870174131674114489951
title: CVE-2020-17510 shiro
description:
Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.


definition_id: oval:org.debian:def:186311516106524848857026644973825087660
title: CVE-2020-1752 glibc
description:
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.


definition_id: oval:org.debian:def:44743881508489122500730722603784949046
title: CVE-2020-18442 zziplib
description:
Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file".


definition_id: oval:org.debian:def:282734208698655719923665741694107553709
title: CVE-2020-18670 roundcube
description:
Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.


definition_id: oval:org.debian:def:86957571110612322017665037177894867965
title: CVE-2020-18671 roundcube
description:
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.


definition_id: oval:org.debian:def:263151204623120592562926039001695849890
title: CVE-2020-18771 exiv2
description:
Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak.


definition_id: oval:org.debian:def:79981110486026848981785438134967272923
title: CVE-2020-18897 libpff
description:
An use-after-free vulnerability in the libpff_item_tree_create_node function of libyal Libpff before 20180623 allows attackers to cause a denial of service (DOS) or execute arbitrary code via a crafted pff file.


definition_id: oval:org.debian:def:141517257942692683419319052074178528454
title: CVE-2020-19131 tiff
description:
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".


definition_id: oval:org.debian:def:234675185486797785678177484814095860016
title: CVE-2020-19144 tiff
description:
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'.


definition_id: oval:org.debian:def:69065996633726158136370465188337396865
title: CVE-2020-1953 commons-configuration2
description:
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.


definition_id: oval:org.debian:def:78954966203603008593143315223359561496
title: CVE-2020-1957 shiro
description:
Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.


definition_id: oval:org.debian:def:45998444980672124442146105925522531979
title: CVE-2020-1968 openssl
description:
The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).


definition_id: oval:org.debian:def:146520084362807139969082148111072679209
title: CVE-2020-19716 exiv2
description:
A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 v0.27.1 leads to a denial of service (DOS).


definition_id: oval:org.debian:def:18589376664085069065585110019884344660
title: CVE-2020-20448 ffmpeg
description:
FFmpeg 4.1.3 is affected by a Divide By Zero issue via libavcodec/ratecontrol.c, which allows a remote malicious user to cause a Denial of Service.


definition_id: oval:org.debian:def:208418265753147547753565546466613701286
title: CVE-2020-20739 vips
description:
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.


definition_id: oval:org.debian:def:202430768337694385209490202390425529573
title: CVE-2020-20891 ffmpeg
description:
Buffer Overflow vulnerability in function config_input in libavfilter/vf_gblur.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.


definition_id: oval:org.debian:def:66262286727403638450690100524841016200
title: CVE-2020-20892 ffmpeg
description:
An issue was discovered in function filter_frame in libavfilter/vf_lenscorrection.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts due to a division by zero.


definition_id: oval:org.debian:def:185560163634019079155913384118182565019
title: CVE-2020-20896 ffmpeg
description:
An issue was discovered in function latm_write_packet in libavformat/latmenc.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts due to a Null pointer dereference.


definition_id: oval:org.debian:def:235210969674631366123674301766599050178
title: CVE-2020-20902 ffmpeg
description:
A CWE-125: Out-of-bounds read vulnerability exists in long_term_filter function in g729postfilter.c in FFmpeg 4.2.1 during computation of the denominator of pseudo-normalized correlation R'(0), that could result in disclosure of information.


definition_id: oval:org.debian:def:163197616622022590074382089000572914529
title: CVE-2020-21365 wkhtmltopdf
description:
Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations.


definition_id: oval:org.debian:def:105299559694225339465727217428412842861
title: CVE-2020-21594 libde265
description:
libde265 v1.0.4 contains a heap buffer overflow in the put_epel_hv_fallback function, which can be exploited via a crafted a file.


definition_id: oval:org.debian:def:279630477686193472005630671155538792943
title: CVE-2020-21595 libde265
description:
libde265 v1.0.4 contains a heap buffer overflow in the mc_luma function, which can be exploited via a crafted a file.


definition_id: oval:org.debian:def:78739744274631223557915026667074346416
title: CVE-2020-21596 libde265
description:
libde265 v1.0.4 contains a global buffer overflow in the decode_CABAC_bit function, which can be exploited via a crafted a file.


definition_id: oval:org.debian:def:96138239944749617831448664739713205948
title: CVE-2020-21597 libde265
description:
libde265 v1.0.4 contains a heap buffer overflow in the mc_chroma function, which can be exploited via a crafted a file.


definition_id: oval:org.debian:def:171444585661196582647654261389356822477
title: CVE-2020-21598 libde265
description:
libde265 v1.0.4 contains a heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function, which can be exploited via a crafted a file.


definition_id: oval:org.debian:def:191815429245328839896900550179875978627
title: CVE-2020-21599 libde265
description:
libde265 v1.0.4 contains a heap buffer overflow in the de265_image::available_zscan function, which can be exploited via a crafted a file.


definition_id: oval:org.debian:def:328456762970369001036940138305334531048
title: CVE-2020-21600 libde265
description:
libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_pred_avg_16_fallback function, which can be exploited via a crafted a file.


definition_id: oval:org.debian:def:181289273494333076682035648721703320220
title: CVE-2020-21601 libde265
description:
libde265 v1.0.4 contains a stack buffer overflow in the put_qpel_fallback function, which can be exploited via a crafted a file.


definition_id: oval:org.debian:def:252299340888597557087831494755844929557
title: CVE-2020-21602 libde265
description:
libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_bipred_16_fallback function, which can be exploited via a crafted a file.


definition_id: oval:org.debian:def:96136236196249293430023786446613480343
title: CVE-2020-21603 libde265
description:
libde265 v1.0.4 contains a heap buffer overflow in the put_qpel_0_0_fallback_16 function, which can be exploited via a crafted a file.


definition_id: oval:org.debian:def:218826983546243064363430450304336415550
title: CVE-2020-21604 libde265
description:
libde265 v1.0.4 contains a heap buffer overflow fault in the _mm_loadl_epi64 function, which can be exploited via a crafted a file.


definition_id: oval:org.debian:def:284416778730195970420440325438340242717
title: CVE-2020-21605 libde265
description:
libde265 v1.0.4 contains a segmentation fault in the apply_sao_internal function, which can be exploited via a crafted a file.


definition_id: oval:org.debian:def:296935213530282795191915240706997302290
title: CVE-2020-21606 libde265
description:
libde265 v1.0.4 contains a heap buffer overflow fault in the put_epel_16_fallback function, which can be exploited via a crafted a file.


definition_id: oval:org.debian:def:170584786683560993748625995979896169655
title: CVE-2020-21675 fig2dev
description:
A stack-based buffer overflow in the genptk_text component in genptk.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into ptk format.


definition_id: oval:org.debian:def:76333038144062246423366407637834293287
title: CVE-2020-21676 fig2dev
description:
A stack-based buffer overflow in the genpstrx_text() component in genpstricks.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into pstricks format.


definition_id: oval:org.debian:def:61753737557495876141617771792622558471
title: CVE-2020-21688 ffmpeg
description:
A heap-use-after-free in the av_freep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code.


definition_id: oval:org.debian:def:140473769674027178081099927684920918498
title: CVE-2020-21697 ffmpeg
description:
A heap-use-after-free in the mpeg_mux_write_packet function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service (DOS) via a crafted avi file.


definition_id: oval:org.debian:def:80556774829792961773398299800873985591
title: CVE-2020-22669 modsecurity-crs
description:
Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.


definition_id: oval:org.debian:def:82428980106615284860521591376543902228
title: CVE-2020-23226 cacti
description:
Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.php, (3) data_input.php, (4) graph_templates.php, (5) graphs.php, (6) reports_admin.php, and (7) data_input.php.


definition_id: oval:org.debian:def:82102103913393260452342156991009128598
title: CVE-2020-24394 linux
description:
In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.


definition_id: oval:org.debian:def:228469493364504195289267692522828370079
title: CVE-2020-24490 linux
description:
Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adjacent access. This affects all Linux kernel versions that support BlueZ.


definition_id: oval:org.debian:def:153235215130540849728513499770427974480
title: CVE-2020-24583 python-django
description:
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command.


definition_id: oval:org.debian:def:249630172091827277398247382921403765813
title: CVE-2020-24584 python-django
description:
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.


definition_id: oval:org.debian:def:251472219881376173259667831360555280982
title: CVE-2020-24586 linux
description:
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.


definition_id: oval:org.debian:def:221950850288658685428820414091870217664
title: CVE-2020-24587 linux
description:
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.


definition_id: oval:org.debian:def:33181860732232063416707118648522290693
title: CVE-2020-24588 linux
description:
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.


definition_id: oval:org.debian:def:147738263567205441514464644572527799862
title: CVE-2020-24616 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).


definition_id: oval:org.debian:def:77800104383399032691100701268520402287
title: CVE-2020-24659 gnutls28
description:
An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.


definition_id: oval:org.debian:def:168117914364216735948902111815012806143
title: CVE-2020-24660 lemonldap-ng
description:
An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.


definition_id: oval:org.debian:def:167113798595798874254931775377628878792
title: CVE-2020-24742 qtbase-opensource-src
description:
An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.


definition_id: oval:org.debian:def:308589860162017545388721651947886013348
title: CVE-2020-24750 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.


definition_id: oval:org.debian:def:228827476749019108156533724002660061395
title: CVE-2020-24977 libxml2
description:
GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.


definition_id: oval:org.debian:def:773246554782719231742364904568186820
title: CVE-2020-25073 plinth
description:
FreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server-status page of the Apache HTTP Server, because a connection from the Tor onion service (or from PageKite) is considered a local connection. This affects both the freedombox and plinth packages of some Linux distributions, but only if the Apache mod_status module is enabled.


definition_id: oval:org.debian:def:129525434974313532174044497101596118644
title: CVE-2020-25084 qemu
description:
QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.


definition_id: oval:org.debian:def:48764530563960611634130738594931272259
title: CVE-2020-25085 qemu
description:
QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.


definition_id: oval:org.debian:def:42818795176649862369822949326210640971
title: CVE-2020-25212 linux
description:
A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452.


definition_id: oval:org.debian:def:256363254841671253854804442827782663912
title: CVE-2020-25284 linux
description:
The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices, aka CID-f44d04e696fe.


definition_id: oval:org.debian:def:142969923563891329373992230527836344276
title: CVE-2020-25285 linux
description:
A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812.


definition_id: oval:org.debian:def:290426890083344587344639135287999871804
title: CVE-2020-25286 wordpress
description:
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public.


definition_id: oval:org.debian:def:138993197931972175830895424457104133192
title: CVE-2020-25467 lrzip
description:
A null pointer dereference was discovered lzo_decompress_buf in stream.c in Irzip 0.621 which allows an attacker to cause a denial of service (DOS) via a crafted compressed file.


definition_id: oval:org.debian:def:8913280633087558877589537380366938302
title: CVE-2020-25613 ruby2.5
description:
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.


definition_id: oval:org.debian:def:173093386350345414040954117046335918851
title: CVE-2020-25624 qemu
description:
hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.


definition_id: oval:org.debian:def:246791593159785193166145598160859436039
title: CVE-2020-25641 linux
description:
A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability.


definition_id: oval:org.debian:def:142628755160738318476563516504489709645
title: CVE-2020-25649 jackson-databind
description:
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.


definition_id: oval:org.debian:def:179519423715349051548013319358913950864
title: CVE-2020-25656 linux
description:
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.


definition_id: oval:org.debian:def:135784040242594633109610405163925904624
title: CVE-2020-25668 linux
description:
A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op.


definition_id: oval:org.debian:def:274789616952144176481723193320830809845
title: CVE-2020-25669 linux
description:
A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.


definition_id: oval:org.debian:def:220774757321592342198001518896371521283
title: CVE-2020-25670 linux
description:
A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free which might lead to privilege escalations.


definition_id: oval:org.debian:def:320280767844204186899689803842213592103
title: CVE-2020-25671 linux
description:
A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-free which might lead to privilege escalations.


definition_id: oval:org.debian:def:213509665953023747312671890932780065242
title: CVE-2020-25673 linux
description:
A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak and eventually hanging-up the system.


definition_id: oval:org.debian:def:216388913094505680770247361775650939688
title: CVE-2020-25693 cimg
description:
A flaw was found in CImg in versions prior to 2.9.3. Integer overflows leading to heap buffer overflows in load_pnm() can be triggered by a specially crafted input file processed by CImg, which can lead to an impact to application availability or data integrity.


