# definitions

definition_id: oval:org.debian:def:301009384087879713093699201621093172370
title: CVE-2018-1000076 jruby
description:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.


definition_id: oval:org.debian:def:3548748200462887468035468245581722925
title: CVE-2018-1000077 jruby
description:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.


definition_id: oval:org.debian:def:237883078127181370699589225719067424312
title: CVE-2018-1000078 jruby
description:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.


definition_id: oval:org.debian:def:115136555294404180567372593643240313994
title: CVE-2018-1000079 jruby
description:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.


definition_id: oval:org.debian:def:281607803793697098808239072589067734885
title: CVE-2018-1000085 clamav
description:
ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of memory, may help in developing exploit chains.. This attack appear to be exploitable via The victim must scan a crafted XAR file. This vulnerability appears to have been fixed in after commit d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6.


definition_id: oval:org.debian:def:30555910498314739692246057834429112843
title: CVE-2018-1000088 ruby-doorkeeper
description:
Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be exploitable via The victim must be tricked to click an opaque link to the web view that runs the XSS payload. A malicious version virtually indistinguishable from a normal link.. This vulnerability appears to have been fixed in 4.2.6, 4.3.0.


definition_id: oval:org.debian:def:258361247565555409802143283078068914202
title: CVE-2018-1000089 django-anymail
description:
Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your Django error reports, an attacker could discover your ANYMAIL_WEBHOOK setting and use this to post fabricated or malicious Anymail tracking/inbound events to your app. This vulnerability appears to have been fixed in v1.4.


definition_id: oval:org.debian:def:30877652134822478656226946611840933636
title: CVE-2018-1000097 sharutils
description:
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file..


definition_id: oval:org.debian:def:205132113372008349417861042149911849328
title: CVE-2018-10001 ffmpeg
description:
The decode_init function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of array read) via an AVI file.


definition_id: oval:org.debian:def:319892411486782487126965757871203923135
title: CVE-2018-1000115 memcached
description:
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.


definition_id: oval:org.debian:def:20416741486691313022690745937618166046
title: CVE-2018-1000116 net-snmp
description:
NET-SNMP version 5.7.2 contains a heap corruption vulnerability in the UDP protocol handler that can result in command execution.


definition_id: oval:org.debian:def:155366956776818320549899699752789150072
title: CVE-2018-1000120 curl
description:
A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.


definition_id: oval:org.debian:def:321925509764425978804496642935210713426
title: CVE-2018-1000121 curl
description:
A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service


definition_id: oval:org.debian:def:321090275611516637068761864449363000892
title: CVE-2018-1000122 curl
description:
A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage


definition_id: oval:org.debian:def:335172411006156710537263920160895739744
title: CVE-2018-1000127 memcached
description:
memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.


definition_id: oval:org.debian:def:333834113381634254942355619266347759396
title: CVE-2018-1000132 mercurial
description:
Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.


definition_id: oval:org.debian:def:281016562009610241979433812256382887343
title: CVE-2018-1000135 network-manager
description:
GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.


definition_id: oval:org.debian:def:53376040000712688885663681581942027047
title: CVE-2018-1000140 librelp
description:
rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.


definition_id: oval:org.debian:def:60764102074745024635926592940093427247
title: CVE-2018-1000156 patch
description:
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.


definition_id: oval:org.debian:def:206869283667248744152037018677965650477
title: CVE-2018-1000159 tlslite-ng
description:
tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ct_check_cbc_mac_and_pad(); line "end_pos = data_len - 1 - mac.digest_size" that can result in an attacker manipulating the TLS ciphertext which will not be detected by receiving tlslite-ng. This attack appears to be exploitable via man in the middle on a network connection. This vulnerability appears to have been fixed after commit 3674815d1b0f7484454995e2737a352e0a6a93d8.


definition_id: oval:org.debian:def:70163796663070965418657196116432416654
title: CVE-2018-1000161 nmap
description:
nmap version 6.49BETA6 through 7.60, up to and including SVN revision 37147 contains a Directory Traversal vulnerability in NSE script http-fetch that can result in file overwrite as the user is running it. This attack appears to be exploitable via a victim that runs NSE script http-fetch against a malicious web site. This vulnerability appears to have been fixed in 7.7.


definition_id: oval:org.debian:def:253240133192757860626822446237081559814
title: CVE-2018-1000164 gunicorn
description:
gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.


definition_id: oval:org.debian:def:147740162833994343238387857664356805108
title: CVE-2018-1000168 nghttp2
description:
nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.


definition_id: oval:org.debian:def:177582903802314366445208236317802703643
title: CVE-2018-1000178 quassel
description:
A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::processMessage(const QByteArray &msg) datastreampeer.cpp line 62 that allows an attacker to execute code remotely.


definition_id: oval:org.debian:def:337993111605714204906375384877377859084
title: CVE-2018-1000179 quassel
description:
A NULL Pointer Dereference of CWE-476 exists in quassel version 0.12.4 in the quasselcore void CoreAuthHandler::handle(const Login &msg) coreauthhandler.cpp line 235 that allows an attacker to cause a denial of service.


definition_id: oval:org.debian:def:129819207034913944201992645872399239077
title: CVE-2018-1000180 bouncycastle
description:
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.


definition_id: oval:org.debian:def:228612283214332182849777278941651263983
title: CVE-2018-1000199 linux
description:
The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result in crash and possibly memory corruption. This attack appear to be exploitable via local code execution and the ability to use ptrace. This vulnerability appears to have been fixed in git commit f67b15037a7a50c57f72e69a6d59941ad90a0f0f.


definition_id: oval:org.debian:def:327668138554236532865541900244823457665
title: CVE-2018-1000200 linux
description:
The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory (OOM) killing of large mlocked processes. The issue arises from an oom killed process's final thread calling exit_mmap(), which calls munlock_vma_pages_all() for mlocked vmas.This can happen synchronously with the oom reaper's unmap_page_range() since the vma's VM_LOCKED bit is cleared before munlocking (to determine if any other vmas share the memory and are mlocked).


definition_id: oval:org.debian:def:171770787704635771200916854091907488832
title: CVE-2018-1000204 linux
description:
** DISPUTED ** Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties dispute the relevance of this report, noting that the requirement for an attacker to have both the CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it "virtually impossible to exploit."


definition_id: oval:org.debian:def:100701168886627950014992557545076056350
title: CVE-2018-1000211 ruby-doorkeeper
description:
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.


definition_id: oval:org.debian:def:297733989383677400708699247225991401319
title: CVE-2018-1000215 cjson
description:
Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON library that can result in Denial of Service (DoS). This attack appear to be exploitable via If the attacker can force the data to be printed and the system is in low memory it can force a leak of memory. This vulnerability appears to have been fixed in 1.7.7.


definition_id: oval:org.debian:def:202198522242197860918939596454780621494
title: CVE-2018-1000222 libgd2
description:
Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5.


definition_id: oval:org.debian:def:191697083999821867607455909886239414873
title: CVE-2018-1000223 soundtouch
description:
soundtouch version up to and including 2.0.0 contains a Buffer Overflow vulnerability in SoundStretch/WavFile.cpp:WavInFile::readHeaderBlock() that can result in arbitrary code execution. This attack appear to be exploitable via victim must open maliocius file in soundstretch utility.


definition_id: oval:org.debian:def:335125125278277296337665946935481256641
title: CVE-2018-1000300 curl
description:
curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This vulnerability appears to have been fixed in curl < 7.54.1 and curl >= 7.60.0.


definition_id: oval:org.debian:def:97075023966214334590098484957799281101
title: CVE-2018-1000301 curl
description:
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.


definition_id: oval:org.debian:def:90544416483226594877919216160576374500
title: CVE-2018-1000517 busybox
description:
BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.


definition_id: oval:org.debian:def:339947725712644210351689722741621567985
title: CVE-2018-1000528 gosa
description:
GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.


definition_id: oval:org.debian:def:30601659129588742881297561574935768376
title: CVE-2018-1000532 beep
description:
beep version 1.3 and up contains a External Control of File Name or Path vulnerability in --device option that can result in Local unprivileged user can inhibit execution of arbitrary programs by other users, allowing DoS. This attack appear to be exploitable via The system must allow local users to run beep.


definition_id: oval:org.debian:def:185305946821439733175876409483928053767
title: CVE-2018-1000539 ruby-json-jwt
description:
Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.


definition_id: oval:org.debian:def:2021828881673715163533223731489875651
title: CVE-2018-1000544 ruby-zip
description:
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem..


definition_id: oval:org.debian:def:55849599944040187286142135910860866605
title: CVE-2018-1000550 sympa
description:
The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template editing function that can result in Possibility to create or modify files on the server filesystem. This attack appear to be exploitable via HTTP GET/POST request. This vulnerability appears to have been fixed in 6.2.32.


definition_id: oval:org.debian:def:36759008329696527537024245517475839501
title: CVE-2018-1000557 ocsinventory-server
description:
OCS Inventory OCS Inventory NG version ocsreports 2.4 contains a Cross Site Scripting (XSS) vulnerability in login form and search functionality that can result in An attacker is able to execute arbitrary (javascript) code within a victims' browser. This attack appear to be exploitable via Victim must open a crafted link to the application. This vulnerability appears to have been fixed in ocsreports 2.4.1.


definition_id: oval:org.debian:def:194560219443381549375654339562252741228
title: CVE-2018-1000558 ocsinventory-server
description:
OCS Inventory NG ocsreports 2.4 and ocsreports 2.3.1 version 2.4 and 2.3.1 contains a SQL Injection vulnerability in web search that can result in An authenticated attacker is able to gain full access to data stored within database. This attack appear to be exploitable via By sending crafted requests it is possible to gain database access. This vulnerability appears to have been fixed in 2.4.1.


definition_id: oval:org.debian:def:163662157199547586461378284324139397878
title: CVE-2018-1000559 qutebrowser
description:
qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's browsing history. This attack appear to be exploitable via the victim must open a page with a specially crafted <title> attribute, and then open the qute://history site via the :history command. This vulnerability appears to have been fixed in fixed in v1.3.3 (4c9360237f186681b1e3f2a0f30c45161cf405c7, to be released today) and v1.4.0 (5a7869f2feaa346853d2a85413d6527c87ef0d9f, released later this week).


definition_id: oval:org.debian:def:103179471662116360073546683593419626906
title: CVE-2018-1000613 bouncycastle
description:
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.


definition_id: oval:org.debian:def:48276718270476773624914753715583879464
title: CVE-2018-1000622 rustc
description:
The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.


definition_id: oval:org.debian:def:316590863141850679278856181397018679056
title: CVE-2018-1000632 dom4j
description:
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.


definition_id: oval:org.debian:def:306372319254979962913104052411967526805
title: CVE-2018-1000637 zutils
description:
zutils version prior to version 1.8-pre2 contains a Buffer Overflow vulnerability in zcat that can result in Potential denial of service or arbitrary code execution. This attack appear to be exploitable via the victim openning a crafted compressed file. This vulnerability appears to have been fixed in 1.8-pre2.


definition_id: oval:org.debian:def:149459645250491063219138926038820053167
title: CVE-2018-1000652 jabref
description:
JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted MsBib file. This vulnerability appears to have been fixed in after commit 89f855d.


definition_id: oval:org.debian:def:104659166794496249308432755934839156841
title: CVE-2018-1000656 flask
description:
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.


definition_id: oval:org.debian:def:268253095391732338196677923034250735868
title: CVE-2018-1000657 rustc
description:
Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1.3.0 and later contains a Buffer Overflow vulnerability in std::collections::vec_deque::VecDeque::reserve() function that can result in Arbitrary code execution, but no proof-of-concept exploit is currently published.. This vulnerability appears to have been fixed in after commit fdfafb510b1a38f727e920dccbeeb638d39a8e60; stable release 1.22.0 and later.


definition_id: oval:org.debian:def:287236923661808735408098806982135802514
title: CVE-2018-1000665 dojo
description:
Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/_base/i18nExhaustive.js in the DOH that can result in Victim attacked through their browser - deliver malware, steal HTTP cookies, bypass CORS trust. This attack appear to be exploitable via Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. This vulnerability appears to have been fixed in 1.14.


definition_id: oval:org.debian:def:26318311098449876635767155401400876623
title: CVE-2018-1000667 nasm
description:
NASM nasm-2.13.03 nasm- 2.14rc15 version 2.14rc15 and earlier contains a memory corruption (crashed) of nasm when handling a crafted file due to function assemble_file(inname, depend_ptr) at asm/nasm.c:482. vulnerability in function assemble_file(inname, depend_ptr) at asm/nasm.c:482. that can result in aborting/crash nasm program. This attack appear to be exploitable via a specially crafted asm file..


definition_id: oval:org.debian:def:67940609091934854395855623331438727820
title: CVE-2018-1000671 sympa
description:
sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.


definition_id: oval:org.debian:def:117104494034310690989172483816873536599
title: CVE-2018-1000801 okular
description:
okular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" in "core/document.cpp" that can result in Arbitrary file creation on the user workstation. This attack appear to be exploitable via he victim must open a specially crafted Okular archive. This issue appears to have been corrected in version 18.08.1


definition_id: oval:org.debian:def:280092758674726811337971061251753259364
title: CVE-2018-1000802 python2.7
description:
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.


definition_id: oval:org.debian:def:204575989736138393982308401423658021721
title: CVE-2018-1000805 paramiko
description:
Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.


definition_id: oval:org.debian:def:35946416011279588872686550921771705895
title: CVE-2018-1000807 pyopenssl
description:
Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.


definition_id: oval:org.debian:def:148084393252682336789178745971475218032
title: CVE-2018-1000808 pyopenssl
description:
Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.


definition_id: oval:org.debian:def:116358596196895744339922923748379295877
title: CVE-2018-1000810 rustc
description:
The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffer Overflow vulnerability in standard library that can result in buffer overflow. This attack appear to be exploitable via str::repeat, passed a large number, can overflow an internal buffer. This vulnerability appears to have been fixed in 1.29.1.


definition_id: oval:org.debian:def:66356183620574506537072390677171458591
title: CVE-2018-1000825 freecol
description:
FreeCol version <= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in FreeColXMLReader parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Freecol file.


definition_id: oval:org.debian:def:186124441769618778779096559899178125905
title: CVE-2018-1000852 freerdp2
description:
FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in channels/drdynvc/client/drdynvc_main.c, drdynvc_process_capability_request that can result in The RDP server can read the client's memory.. This attack appear to be exploitable via RDPClient must connect the rdp server with echo option. This vulnerability appears to have been fixed in after commit 205c612820dac644d665b5bb1cdf437dc5ca01e3.


definition_id: oval:org.debian:def:162983381618672056941425986333539904918
title: CVE-2018-1000858 gnupg2
description:
GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.


definition_id: oval:org.debian:def:58813869523811186410561174829516773270
title: CVE-2018-1000871 hoteldruid
description:
HotelDruid HotelDruid 2.3.0 version 2.3.0 and earlier contains a SQL Injection vulnerability in "id_utente_mod" parameter in gestione_utenti.php file that can result in An attacker can dump all the database records of backend webserver. This attack appear to be exploitable via the attack can be done by anyone via specially crafted sql query passed to the "id_utente_mod=1" parameter.


definition_id: oval:org.debian:def:113840426597353116264914000910481746601
title: CVE-2018-1000872 python-pykmip
description:
OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262) vulnerability in PyKMIP server that can result in DOS: the server can be made unavailable by one or more clients opening all of the available sockets. This attack appear to be exploitable via A client or clients open sockets with the server and then never close them. This vulnerability appears to have been fixed in 0.8.0.


definition_id: oval:org.debian:def:95702128072916544832435532957483350305
title: CVE-2018-1000877 libarchive
description:
libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar->lzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.


definition_id: oval:org.debian:def:128483393916802502492319774581125071357
title: CVE-2018-1000878 libarchive
description:
libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c that can result in Crash/DoS - it is unknown if RCE is possible. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.


definition_id: oval:org.debian:def:38302723918459474122411268154365616541
title: CVE-2018-1000879 libarchive
description:
libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted archive file.


definition_id: oval:org.debian:def:64783318902042394612497202189534119477
title: CVE-2018-1000880 libarchive
description:
libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.


definition_id: oval:org.debian:def:779896750819699774134582935106968964
title: CVE-2018-1000888 php-pear
description:
PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called without a specific prefix path, we can trigger unserialization by crafting a tar file with `phar://[path_to_malicious_phar_file]` as path. Object injection can be used to trigger destruct in the loaded PHP classes, e.g. the Archive_Tar class itself. With Archive_Tar object injection, arbitrary file deletion can occur because `@unlink($this->_temp_tarname)` is called. If another class with useful gadget is loaded, it may possible to cause remote code execution that can result in files being deleted or possibly modified. This vulnerability appears to have been fixed in 1.4.4.


definition_id: oval:org.debian:def:3073988325693255065329710169583897069
title: CVE-2018-1000998 cvsweb
description:
FreeBSD CVSweb version 2.x contains a Cross Site Scripting (XSS) vulnerability in all pages that can result in limited impact--CVSweb is anonymous & read-only. It might impact other sites on same domain. This attack appears to be exploitable via victim must load specially crafted url. This vulnerability appears to have been fixed in 3.x.


definition_id: oval:org.debian:def:331478801182325140354597140839784277573
title: CVE-2018-10016 nasm
description:
Netwide Assembler (NASM) 2.14rc0 has a division-by-zero vulnerability in the expr5 function in asm/eval.c via a malformed input file.


definition_id: oval:org.debian:def:212974265367066224531549623927875577927
title: CVE-2018-10017 libopenmpt
description:
soundlib/Snd_fx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause a denial of service (out-of-bounds read) via an IT or MO3 file with many nested pattern loops.


definition_id: oval:org.debian:def:133070546700190288960177089343287654315
title: CVE-2018-10021 linux
description:
** DISPUTED ** drivers/scsi/libsas/sas_scsi_host.c in the Linux kernel before 4.16 allows local users to cause a denial of service (ata qc leak) by triggering certain failure conditions. NOTE: a third party disputes the relevance of this report because the failure can only occur for physically proximate attackers who unplug SAS Host Bus Adapter cables.


definition_id: oval:org.debian:def:272035859399402636351419627046990157067
title: CVE-2018-1002200 plexus-archiver
description:
plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.


definition_id: oval:org.debian:def:190258397784564812275023549963527495532
title: CVE-2018-1002208 mono
description:
SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.


definition_id: oval:org.debian:def:53265080255595207164677179638962618870
title: CVE-2018-1002209 libquazip
description:
QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.


definition_id: oval:org.debian:def:42584129699630797327378135130884779825
title: CVE-2018-10059 cacti
description:
Cacti before 1.1.37 has XSS because the get_current_page function in lib/functions.php relies on $_SERVER['PHP_SELF'] instead of $_SERVER['SCRIPT_NAME'] to determine a page name.


definition_id: oval:org.debian:def:56190127614828263501387512608566152042
title: CVE-2018-10060 cacti
description:
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php.


definition_id: oval:org.debian:def:36292720166467420913426204203210831812
title: CVE-2018-10061 cacti
description:
Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENT_QUOTES flag (these calls occur when the html_escape function in lib/html.php is not used).


definition_id: oval:org.debian:def:49582578878097744992830175891579391337
title: CVE-2018-10087 linux
description:
The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value.


definition_id: oval:org.debian:def:263217959851809050197105643591822204081
title: CVE-2018-10100 wordpress
description:
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.


definition_id: oval:org.debian:def:280239473349920329029550148054072349620
title: CVE-2018-10101 wordpress
description:
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.


definition_id: oval:org.debian:def:132559417157566367588406431233691968163
title: CVE-2018-10102 wordpress
description:
Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.


definition_id: oval:org.debian:def:292103122711232727817697380018567033321
title: CVE-2018-10113 gegl
description:
An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm-load.c has unbounded memory allocation, leading to a denial of service (application crash) upon allocation failure.


definition_id: oval:org.debian:def:285916171010119277508755992362945591944
title: CVE-2018-10114 gegl
description:
An issue was discovered in GEGL through 0.3.32. The gegl_buffer_iterate_read_simple function in buffer/gegl-buffer-access.c allows remote attackers to cause a denial of service (write access violation) or possibly have unspecified other impact via a malformed PPM file, related to improper restrictions on memory allocation in the ppm_load_read_header function in operations/external/ppm-load.c.


definition_id: oval:org.debian:def:133754689415141861924990006213864874322
title: CVE-2018-10115 p7zip-rar
description:
Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.


definition_id: oval:org.debian:def:249487215901913564301653847694828432172
title: CVE-2018-10119 libreoffice
description:
sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format.


definition_id: oval:org.debian:def:237059989897659539523524132954417967457
title: CVE-2018-10120 libreoffice
description:
The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record.


definition_id: oval:org.debian:def:83986807881745411175310741920251085536
title: CVE-2018-10124 linux
description:
The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN argument.


definition_id: oval:org.debian:def:139473379273519172659455577379007984748
title: CVE-2018-10177 imagemagick
description:
In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng file.


definition_id: oval:org.debian:def:25057210311482378238503026906054262589
title: CVE-2018-10184 haproxy
description:
An issue was discovered in HAProxy before 1.8.8. The incoming H2 frame length was checked against the max_frame_size setting instead of being checked against the bufsize. The max_frame_size only applies to outgoing traffic and not to incoming, so if a large enough frame size is advertised in the SETTINGS frame, a wrapped frame will be defragmented into a temporary allocated buffer where the second fragment may overflow the heap by up to 16 kB. It is very unlikely that this can be exploited for code execution given that buffers are very short lived and their addresses not realistically predictable in production, but the likelihood of an immediate crash is absolutely certain.


definition_id: oval:org.debian:def:100113359224162714836434168864968872206
title: CVE-2018-10191 mruby
description:
In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.


definition_id: oval:org.debian:def:266352061641280559256911686280222424458
title: CVE-2018-10194 ghostscript
description:
The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.


definition_id: oval:org.debian:def:303862918413649180487340257850879490243
title: CVE-2018-10195 lrzsz
description:
lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.


definition_id: oval:org.debian:def:130733715494416588424825532213319902363
title: CVE-2018-10196 graphviz
description:
NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.


definition_id: oval:org.debian:def:166177646852140250382567812721265705466
title: CVE-2018-10198 otrs2
description:
An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to disclose internal article information of their customer tickets.


definition_id: oval:org.debian:def:232708171989537889567491226941295245629
title: CVE-2018-10199 mruby
description:
In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilialize_copy(). An attacker that can cause Ruby code to be run can possibly use this to execute arbitrary code.


definition_id: oval:org.debian:def:42874819973255338588398881221599880453
title: CVE-2018-10242 suricata
description:
Suricata version 4.0.4 incorrectly handles the parsing of the SSH banner. A malformed SSH banner can cause the parsing code to read beyond the allocated data because SSHParseBanner in app-layer-ssh.c lacks a length check.


definition_id: oval:org.debian:def:117491245115292448540727366039509928958
title: CVE-2018-10243 libhtp
description:
htp_parse_authorization_digest in htp_parsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header.


definition_id: oval:org.debian:def:196171825575682161411035109451823777980
title: CVE-2018-10244 suricata
description:
Suricata version 4.0.4 incorrectly handles the parsing of an EtherNet/IP PDU. A malformed PDU can cause the parsing code to read beyond the allocated data because DecodeENIPPDU in app-layer-enip-commmon.c has an integer overflow during a length check.


definition_id: oval:org.debian:def:175921069964876992526742543921834669621
title: CVE-2018-10254 nasm
description:
Netwide Assembler (NASM) 2.13 has a stack-based buffer over-read in the disasm function of the disasm/disasm.c file. Remote attackers could leverage this vulnerability to cause a denial of service or possibly have unspecified other impact via a crafted ELF file.


definition_id: oval:org.debian:def:63380653022897773248241086691323418728
title: CVE-2018-10289 mupdf
description:
In MuPDF 1.13.0, there is an infinite loop in the fz_skip_space function of the pdf/pdf-xref.c file. A remote adversary could leverage this vulnerability to cause a denial of service via a crafted pdf file.


definition_id: oval:org.debian:def:260602535890211556972728135506574750455
title: CVE-2018-10316 nasm
description:
Netwide Assembler (NASM) 2.14rc0 has an endless while loop in the assemble_file function of asm/nasm.c because of a globallineno integer overflow.


definition_id: oval:org.debian:def:282074544487732620795466885622138150892
title: CVE-2018-10322 linux
description:
The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_ilock_attr_map_shared invalid pointer dereference) via a crafted xfs image.


definition_id: oval:org.debian:def:168861216211727745470440878750101169587
title: CVE-2018-10323 linux
description:
The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted xfs image.


definition_id: oval:org.debian:def:309111155049599111875651625149332712016
title: CVE-2018-10360 file
description:
The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.


definition_id: oval:org.debian:def:83266996766110922498223968215642313400
title: CVE-2018-10361 ktexteditor
description:
An issue was discovered in KTextEditor 5.34.0 through 5.45.0. Insecure handling of temporary files in the KTextEditor's kauth_ktexteditor_helper service (as utilized in the Kate text editor) can allow other unprivileged users on the local system to gain root privileges. The attack occurs when one user (who has an unprivileged account but is also able to authenticate as root) writes a text file using Kate into a directory owned by a another unprivileged user. The latter unprivileged user conducts a symlink attack to achieve privilege escalation.


definition_id: oval:org.debian:def:6836639669832174563416246868019283206
title: CVE-2018-10362 phpliteadmin
description:
An issue was discovered in phpLiteAdmin 1.9.5 through 1.9.7.1. Due to loose comparison with '==' instead of '===' in classes/Authorization.php for the user-provided login password, it is possible to login with a simpler password if the password has the form of a power in scientific notation (like '2e2' for '200' or '0e1234' for '0'). This is possible because, in the loose comparison case, PHP interprets the string as a number in scientific notation, and thus converts it to a number. After that, the comparison with '==' casts the user input (e.g., the string '200' or '0') to a number, too. Hence the attacker can login with just a '0' or a simple number he has to brute force. Strong comparison with '===' prevents the cast into numbers.


definition_id: oval:org.debian:def:273598600212562581251111993081832681205
title: CVE-2018-10372 binutils
description:
process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf.


definition_id: oval:org.debian:def:174681423539265583673673129538991725298
title: CVE-2018-10373 binutils
description:
concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by nm-new.


definition_id: oval:org.debian:def:194120847950124032424880049964287625710
title: CVE-2018-10380 kwallet-pam
description:
kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack.


definition_id: oval:org.debian:def:47229608329061948302481363185399820552
title: CVE-2018-10392 libvorbis
description:
mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:25897858093688505403146608452849641409
title: CVE-2018-1046 pdns
description:
pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow only occurs when the -ecs-stamp option of dnsreplay is used.


definition_id: oval:org.debian:def:20428152134901415011799388917698094697
title: CVE-2018-10471 xen
description:
An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754.


definition_id: oval:org.debian:def:237286093853550246335035308561370957875
title: CVE-2018-10472 xen
description:
An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users (in certain configurations) to read arbitrary dom0 files via QMP live insertion of a CDROM, in conjunction with specifying the target file as the backing file of a snapshot.


definition_id: oval:org.debian:def:82083707092073914485105531020729201016
title: CVE-2018-1049 systemd
description:
In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted.


definition_id: oval:org.debian:def:323962888176851532967508516692746012940
title: CVE-2018-1050 samba
description:
All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash.


definition_id: oval:org.debian:def:164152435094513591065054779876837175553
title: CVE-2018-10528 libraw
description:
An issue was discovered in LibRaw 0.18.9. There is a stack-based buffer overflow in the utf2char function in libraw_cxx.cpp.


definition_id: oval:org.debian:def:60214643429403386464633824705397923542
title: CVE-2018-10529 libraw
description:
An issue was discovered in LibRaw 0.18.9. There is an out-of-bounds read affecting the X3F property table list implementation in libraw_x3f.cpp and libraw_cxx.cpp.


definition_id: oval:org.debian:def:103129354937077314344470371802872456456
title: CVE-2018-10534 binutils
description:
The _bfd_XX_bfd_copy_private_bfd_data_common function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, processes a negative Data Directory size with an unbounded loop that increases the value of (external_IMAGE_DEBUG_DIRECTORY) *edd so that the address exceeds its own memory region, resulting in an out-of-bounds memory write, as demonstrated by objcopy copying private info with _bfd_pex64_bfd_copy_private_bfd_data_common in pex64igen.c.


definition_id: oval:org.debian:def:246909094283470635899278884270850746750
title: CVE-2018-10535 binutils
description:
The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab entry with a "SECTION" type that has a "0" value, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy.


definition_id: oval:org.debian:def:175406468302228893477439545618021963161
title: CVE-2018-10536 wavpack
description:
An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.


definition_id: oval:org.debian:def:309360791639865021035147027963170298878
title: CVE-2018-10537 wavpack
description:
An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.


definition_id: oval:org.debian:def:292384456789787274511612745535640105772
title: CVE-2018-10538 wavpack
description:
An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.


definition_id: oval:org.debian:def:85400885437909566409877780839145429700
title: CVE-2018-10539 wavpack
description:
An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.


definition_id: oval:org.debian:def:211061775399425686677750507333049109020
title: CVE-2018-1054 389-ds-base
description:
An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.


definition_id: oval:org.debian:def:219701631771814309659337388189429044936
title: CVE-2018-10540 wavpack
description:
An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.


definition_id: oval:org.debian:def:23231423464827089447165086825204490322
title: CVE-2018-1056 advancecomp
description:
An out-of-bounds heap buffer read flaw was found in the way advancecomp before 2.1-2018/02 handled processing of ZIP files. An attacker could potentially use this flaw to crash the advzip utility by tricking it into processing crafted ZIP files.


definition_id: oval:org.debian:def:108656567040431297038527413744862358363
title: CVE-2018-1057 samba
description:
On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).


definition_id: oval:org.debian:def:162833793801561523551471202082200269499
title: CVE-2018-1059 dpdk
description:
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.


definition_id: oval:org.debian:def:202073241018616413123816077342761246615
title: CVE-2018-1060 python2.7
description:
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.


definition_id: oval:org.debian:def:65171533940224018576700148784331130060
title: CVE-2018-1061 python2.7
description:
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method.  An attacker could use this flaw to cause denial of service.


definition_id: oval:org.debian:def:53021865838532186851253452139377350654
title: CVE-2018-1063 policycoreutils
description:
Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing).


definition_id: oval:org.debian:def:175717323400830467599259439259360650480
title: CVE-2018-1064 libvirt
description:
libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent.


definition_id: oval:org.debian:def:103153191652204028240578489484237298277
title: CVE-2018-1065 linux
description:
A flaw was found in the netfilter/iptables subsystem. A user with the netfilter modification capabilities could insert a rule which could panic the system.


definition_id: oval:org.debian:def:339927589213264261312302771279137326136
title: CVE-2018-1066 linux
description:
The Linux kernel before version 4.11 is vulnerable to a NULL pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allows an attacker controlling a CIFS server to kernel panic a client that has this server mounted, because an empty TargetInfo field in an NTLMSSP setup negotiation response is mishandled during session recovery.


definition_id: oval:org.debian:def:94529216251277639360685182560494585579
title: CVE-2018-10675 linux
description:
The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.


definition_id: oval:org.debian:def:213136020843672376424399214167964226109
title: CVE-2018-1068 linux
description:
A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory.


definition_id: oval:org.debian:def:53794270774727769018054375403522035163
title: CVE-2018-10685 lrzip
description:
In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the lzma_decompress_buf function of stream.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:20158132155747976119202436027142250170
title: CVE-2018-10689 blktrace
description:
blktrace (aka Block IO Tracing) 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the dev_map_read function in btt/devmap.c because the device and devno arrays are too small, as demonstrated by an invalid free when using the btt program with a crafted file.


definition_id: oval:org.debian:def:82706919578235912046287904450556629907
title: CVE-2018-10733 libgxps
description:
There is a heap-based buffer over-read in the function ft_font_face_hash of gxps-fonts.c in libgxps through 0.3.0. A crafted input will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:105088690122091428970063370008950115815
title: CVE-2018-10753 abcm2ps
description:
Stack-based buffer overflow in the delayed_output function in music.c in abcm2ps through 8.13.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:329098962851906867297229332761349911266
title: CVE-2018-10756 transmission
description:
Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted torrent file.


definition_id: oval:org.debian:def:296308211508874940692866545026460193130
title: CVE-2018-10767 libgxps
description:
There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from a g_input_stream_read call. A crafted input will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:125016694735187126630160252189638258941
title: CVE-2018-10768 poppler
description:
There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5. A crafted input will lead to a remote denial of service attack. Later Ubuntu packages such as for Poppler 0.41.0 are not affected.


definition_id: oval:org.debian:def:156739424326614911431827844445604434360
title: CVE-2018-10771 abcm2ps
description:
Stack-based buffer overflow in the get_key function in parse.c in abcm2ps through 8.13.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:48301657389279205220483491129405083715
title: CVE-2018-10779 tiff
description:
TIFFWriteScanline in tif_write.c in LibTIFF 3.8.2 has a heap-based buffer over-read, as demonstrated by bmp2tiff.


definition_id: oval:org.debian:def:148426526963947789518027388507257687600
title: CVE-2018-1079 pcs
description:
pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process.


definition_id: oval:org.debian:def:289332517745887836966604622595327969998
title: CVE-2018-10811 strongswan
description:
strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable.


definition_id: oval:org.debian:def:215495792007204355903470655598446427829
title: CVE-2018-1083 zsh
description:
Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.


definition_id: oval:org.debian:def:187715660778285083406074706427824784742
title: CVE-2018-10839 qemu
description:
An integer overflow issue was found in the NE200 NIC emulation. It could occur while receiving packets from the network, if the size value was greater than INT_MAX. Such overflow would lead to stack buffer overflow issue. A user inside guest could use this flaw to crash the QEMU process, resulting in DoS scenario.


definition_id: oval:org.debian:def:99784656384243771264347776777817006816
title: CVE-2018-10840 linux
description:
The Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image.


definition_id: oval:org.debian:def:298469635961361251698672182343794459056
title: CVE-2018-10841 glusterfs
description:
A flaw was found in glusterfs which can lead to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.


definition_id: oval:org.debian:def:268251433338456632256019065643104520014
title: CVE-2018-10844 gnutls28
description:
It was found that GnuTLS's implementation of HMAC-SHA-256 was vulnerable to Lucky Thirteen-style attack. A remote attacker could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.


definition_id: oval:org.debian:def:237237204444914968130327399707441366698
title: CVE-2018-10845 gnutls28
description:
It was found that GnuTLS's implementation of HMAC-SHA-384 was vulnerable to a Lucky Thirteen-style attack. A remote attacker could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.


definition_id: oval:org.debian:def:232336672727969423938570328999413006716
title: CVE-2018-10846 gnutls28
description:
A cache-based side channel attack was found in the way GnuTLS implements CBC-mode cipher suites. An attacker could use a combination of "Just in Time" Prime+probe and Lucky-13 attacks to recover plain text in a cross-VM attack scenario.


definition_id: oval:org.debian:def:101067255726526111851785560105444469103
title: CVE-2018-10847 prosody
description:
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same across stream restarts. A user may authenticate to XMPP host A and migrate their authenticated session to XMPP host B of the same Prosody instance.


definition_id: oval:org.debian:def:273750351806184337186058054718372541296
title: CVE-2018-10850 389-ds-base
description:
389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.


definition_id: oval:org.debian:def:47334005509461353414567600772544431768
title: CVE-2018-10851 pdns
description:
PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, are vulnerable to a memory leak while parsing malformed records that can lead to remote denial of service.


definition_id: oval:org.debian:def:271854327743193059682469907220333818013
title: CVE-2018-10852 sssd
description:
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.


definition_id: oval:org.debian:def:16161465078070188131638105479281008370
title: CVE-2018-10853 linux
description:
A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest.


definition_id: oval:org.debian:def:329788741627078500462184838268817143753
title: CVE-2018-10855 ansible
description:
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.


definition_id: oval:org.debian:def:35746940410173208640680125547122882497
title: CVE-2018-10857 git-annex
description:
git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.


definition_id: oval:org.debian:def:122779315722100784670547669382734370209
title: CVE-2018-10858 samba
description:
A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.


definition_id: oval:org.debian:def:109055971823563346942499485541765983649
title: CVE-2018-10859 git-annex
description:
git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data that was never stored in git-annex


definition_id: oval:org.debian:def:42767679166679092123492471778043909955
title: CVE-2018-1086 pcs
description:
pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege.


definition_id: oval:org.debian:def:309808640746908404795058794459152495564
title: CVE-2018-10860 libarchive-zip-perl
description:
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.


definition_id: oval:org.debian:def:263529147824206856299201643418214005378
title: CVE-2018-10861 ceph
description:
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.


definition_id: oval:org.debian:def:310999930737619070829035587753322707322
title: CVE-2018-1087 linux
description:
kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.


definition_id: oval:org.debian:def:257138824370914476443933160245621637094
title: CVE-2018-10871 389-ds-base
description:
389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords.


definition_id: oval:org.debian:def:14818322655517915901069021190049490612
title: CVE-2018-10873 spice
description:
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.


definition_id: oval:org.debian:def:181344291276818348916277674011527068908
title: CVE-2018-10874 ansible
description:
CVE-2018-10874 ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution


definition_id: oval:org.debian:def:331983140627873300569179113831187377064
title: CVE-2018-10875 ansible
description:
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.


definition_id: oval:org.debian:def:280500484345545092297640766206445447540
title: CVE-2018-10876 linux
description:
A flaw was found in the Linux kernel's ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image.


definition_id: oval:org.debian:def:77703790253583187651271786628400507200
title: CVE-2018-10877 linux
description:
A flaw was found in the Linux kernel ext4 filesystem. An out-of-bound access is possible in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image.


definition_id: oval:org.debian:def:135543250274104014669574648166440021300
title: CVE-2018-10878 linux
description:
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image.


definition_id: oval:org.debian:def:57119214756182467675309629700233710263
title: CVE-2018-10879 linux
description:
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image.


definition_id: oval:org.debian:def:73559708277802538567574284962012686879
title: CVE-2018-1088 glusterfs
description:
A privilege escalation flaw was found in gluster snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.


definition_id: oval:org.debian:def:290504538120090886908747122128838736937
title: CVE-2018-10880 linux
description:
A flaw was found in the Linux kernel's ext4 filesystem code. A stack-out-of-bounds write in ext4_update_inline_data() is possible when mounting and writing to a crafted ext4 image. An attacker could use this to cause a system crash and a denial of service.


definition_id: oval:org.debian:def:741056932266080222750448450435776859
title: CVE-2018-10881 linux
description:
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.


definition_id: oval:org.debian:def:339178583181693789608688224794753926228
title: CVE-2018-10882 linux
description:
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in the fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image.


definition_id: oval:org.debian:def:188695987964226316632353462776202148456
title: CVE-2018-10883 linux
description:
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.


definition_id: oval:org.debian:def:122631268892474611336206273545883642851
title: CVE-2018-10886 ant
description:
** REJECT **  DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: this candidate is not about any specific product, protocol, or design, that falls into the scope of the assigning CNA. Notes: None.


definition_id: oval:org.debian:def:15136865749465617781606815576862315899
title: CVE-2018-10887 libgit2
description:
A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.


definition_id: oval:org.debian:def:34183101381695706359667875965331428585
title: CVE-2018-10888 libgit2
description:
A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound read while reading a binary delta file. An attacker may use this flaw to cause a Denial of Service.


definition_id: oval:org.debian:def:42137112589629811186754568608801585026
title: CVE-2018-1089 389-ds-base
description:
389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.


definition_id: oval:org.debian:def:179692117231956419000534460983181326154
title: CVE-2018-10892 docker.io
description:
The default OCI Linux spec in oci/defaults{_linux}.go in Docker/Moby, from 1.11 to current, does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling Bluetooth or turning up/down keyboard brightness.


definition_id: oval:org.debian:def:114732305523655067460323544924540910967
title: CVE-2018-10895 qutebrowser
description:
qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. A malicious website could exploit this to load a 'qute://settings/set' URL, which then sets 'editor.command' to a bash script, resulting in arbitrary code execution.


definition_id: oval:org.debian:def:287753255860244322582469825271573453296
title: CVE-2018-10897 yum-utils
description:
A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files.


definition_id: oval:org.debian:def:97660474768036696630050655354123094371
title: CVE-2018-10900 network-manager-vpnc
description:
Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.


definition_id: oval:org.debian:def:7922619593267970281131728269862159113
title: CVE-2018-10902 linux
description:
It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation.


definition_id: oval:org.debian:def:102371389142490854225235923843641013472
title: CVE-2018-10903 python-cryptography
description:
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.


definition_id: oval:org.debian:def:224291750194405902494331692794618327496
title: CVE-2018-10904 glusterfs
description:
It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator. Attacker can use this flaw to create files and execute arbitrary code. To exploit this attacker would require sufficient access to modify the extended attributes of files on a gluster volume.


definition_id: oval:org.debian:def:6169776069881044201705219630349185278
title: CVE-2018-10906 fuse
description:
In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.


definition_id: oval:org.debian:def:138684491164937831542857495943683521037
title: CVE-2018-10907 glusterfs
description:
It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers using 'alloca(3)'. An authenticated attacker could exploit this by mounting a gluster volume and sending a string longer that the fixed buffer size to cause crash or potential code execution.


definition_id: oval:org.debian:def:40855632633383635088525692367844654365
title: CVE-2018-1091 linux
description:
In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service.


definition_id: oval:org.debian:def:320929009313542553724368779644799811955
title: CVE-2018-10911 glusterfs
description:
A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value.


definition_id: oval:org.debian:def:247471401558523975914789226646715847867
title: CVE-2018-10913 glusterfs
description:
An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to determine the existence of any file.


definition_id: oval:org.debian:def:38755551645392023795027487093819054974
title: CVE-2018-10914 glusterfs
description:
It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a remote denial of service. If gluster multiplexing is enabled this will result in a crash of multiple bricks and gluster volumes.


definition_id: oval:org.debian:def:37203986440623787977069996355405006207
title: CVE-2018-10916 lftp
description:
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.


definition_id: oval:org.debian:def:328392925290899167297122875294221880602
title: CVE-2018-10918 samba
description:
A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker could use this flaw to crash a samba server in an Active Directory Domain Controller configuration. Samba versions before 4.7.9 and 4.8.4 are vulnerable.


definition_id: oval:org.debian:def:247127983405716501086418418073898973243
title: CVE-2018-10919 samba
description:
The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.


definition_id: oval:org.debian:def:266347554626753431762491815187555267011
title: CVE-2018-1092 linux
description:
The Linux kernel is vulnerable to a NULL pointer dereference in the ext4/mballoc.c:ext4_process_freed_data() function. An attacker could trick a legitimate user or a privileged attacker could exploit this by mounting a crafted ext4 image to cause a kernel panic.


definition_id: oval:org.debian:def:127549652872957604662641551092165021122
title: CVE-2018-10920 knot-resolver
description:
Improper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison cache.


definition_id: oval:org.debian:def:76917841466355565054551243848089985638
title: CVE-2018-10923 glusterfs
description:
It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. An authenticated attacker could use this to create an arbitrary device and read data from any device attached to the glusterfs server node.


definition_id: oval:org.debian:def:171046907811934657773518526096154903785
title: CVE-2018-10924 glusterfs
description:
It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service attack by making gluster clients consume memory of the host machine.


definition_id: oval:org.debian:def:224005565563093440155024151139528279744
title: CVE-2018-10926 glusterfs
description:
A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an arbitrary location via path traversal and execute arbitrary code on a glusterfs server node.


definition_id: oval:org.debian:def:212870492417321829719836499673530637018
title: CVE-2018-10927 glusterfs
description:
A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this flaw to leak information and execute remote denial of service by crashing gluster brick process.


definition_id: oval:org.debian:def:186433255942849513392638584191621737502
title: CVE-2018-10928 glusterfs
description:
A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume. An authenticated attacker could use this flaw to create arbitrary symlinks pointing anywhere on the server and execute arbitrary code on glusterfs server nodes.


definition_id: oval:org.debian:def:136119562256064496802090694435289900905
title: CVE-2018-10929 glusterfs
description:
A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw to create arbitrary files and execute arbitrary code on glusterfs server nodes.


definition_id: oval:org.debian:def:94793225657553513668975179984831274286
title: CVE-2018-1093 linux
description:
The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers.


definition_id: oval:org.debian:def:16594115747253083413177202965956260219
title: CVE-2018-10930 glusterfs
description:
A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the gluster volume.


definition_id: oval:org.debian:def:237354203159658432767195819082670585727
title: CVE-2018-10932 lldpad
description:
lldptool can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to inject shell control characters into the buffer and impact the behavior of the terminal.


definition_id: oval:org.debian:def:4744824673049853841706621678532478543
title: CVE-2018-10933 libssh
description:
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.


definition_id: oval:org.debian:def:242812497795433992309285328065288986475
title: CVE-2018-10935 389-ds-base
description:
A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.


definition_id: oval:org.debian:def:334158962304890355298287006487380436156
title: CVE-2018-10936 libpgjava
description:
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.


definition_id: oval:org.debian:def:333312763695786654515328014982599419212
title: CVE-2018-10938 linux
description:
A flaw was found in the Linux kernel present since v4.0-rc1 and through v4.13-rc4. A crafted network packet sent remotely by an attacker may force the kernel to enter an infinite loop in the cipso_v4_optptr() function in net/ipv4/cipso_ipv4.c leading to a denial-of-service. A certain non-default configuration of LSM (Linux Security Module) and NetLabel should be set up on a system before an attacker could leverage this flaw.


definition_id: oval:org.debian:def:86272346217364731033265450897386294139
title: CVE-2018-1094 linux
description:
The Linux kernel is vulnerable to a NULL pointer dereference in the ext4/xattr.c:ext4_xattr_inode_hash() function. An attacker could trick a legitimate user or a privileged attacker could exploit this to cause a NULL pointer dereference with a crafted ext4 image.


definition_id: oval:org.debian:def:278654132793366645018474435892109773623
title: CVE-2018-10940 linux
description:
The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory.


definition_id: oval:org.debian:def:98235993302164563061962560841584785928
title: CVE-2018-10945 smplayer
description:
The mg_handle_cgi function in mongoose.c in Mongoose 6.11 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash, or NULL pointer dereference) via an HTTP request, related to the mbuf_insert function.


definition_id: oval:org.debian:def:9176384265567723283606532506405254157
title: CVE-2018-1095 linux
description:
The Linux kernel is vulnerable to an out-of-bound access bug in the fs/posix_acl.c:get_acl() function. An attacker could trick a legitimate user or a privileged attacker could exploit this to cause a system crash or other unspecified impact with a crafted ext4 image. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.


definition_id: oval:org.debian:def:189139475382413812286120369278962942738
title: CVE-2018-10958 exiv2
description:
In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv2::Internal::PngChunk::zlibUncompress call.


definition_id: oval:org.debian:def:185180939501294006575373796450010123245
title: CVE-2018-10963 tiff
description:
The TIFFWriteDirectorySec() function in tif_dirwrite.c in LibTIFF through 4.0.9 allows remote attackers to cause a denial of service (assertion failure and application crash) via a crafted file, a different vulnerability than CVE-2017-13726.


definition_id: oval:org.debian:def:145757084264952269543984475424709132225
title: CVE-2018-10981 xen
description:
An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (host OS infinite loop) in situations where a QEMU device model attempts to make invalid transitions between states of a request.


definition_id: oval:org.debian:def:257452513156077397034811808449060384524
title: CVE-2018-10982 xen
description:
An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (unexpectedly high interrupt number, array overrun, and hypervisor crash) or possibly gain hypervisor privileges by setting up an HPET timer to deliver interrupts in IO-APIC mode, aka vHPET interrupt injection.


definition_id: oval:org.debian:def:52313593670012440028924286513781739499
title: CVE-2018-10992 lilypond
description:
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument, because the GNU Guile code uses the system Scheme procedure instead of the system* Scheme procedure. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-17523.


definition_id: oval:org.debian:def:267149056330127519273785722525765284964
title: CVE-2018-10995 slurm-llnl
description:
SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names (aka user_name fields) and group ids (aka gid fields).


definition_id: oval:org.debian:def:251088744931740404076439610198809174780
title: CVE-2018-10998 exiv2
description:
An issue was discovered in Exiv2 0.26. readMetadata in jp2image.cpp allows remote attackers to cause a denial of service (SIGABRT) by triggering an incorrect Safe::add call.


definition_id: oval:org.debian:def:206839991080357550175985242401966813172
title: CVE-2018-10999 exiv2
description:
An issue was discovered in Exiv2 0.26. The Exiv2::Internal::PngChunk::parseTXTChunk function has a heap-based buffer over-read.


definition_id: oval:org.debian:def:266765357209291534520896894736205810555
title: CVE-2018-1100 zsh
description:
A buffer overflow flaw was found in the zsh shell check path functionality. A local, unprivileged user can create a specially crafted message file, which, if used to set a custom "you have new mail" message, leads to code execution in the context of the user who receives the message. If the user affected is privileged, this leads to privilege escalation.


definition_id: oval:org.debian:def:59671448232326774272758505283786759766
title: CVE-2018-11039 libspring-java
description:
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.


definition_id: oval:org.debian:def:65903896059877908405216571682155194121
title: CVE-2018-11040 libspring-java
description:
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.


definition_id: oval:org.debian:def:282977708546634787057522082071319591833
title: CVE-2018-1106 packagekit
description:
An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.


definition_id: oval:org.debian:def:309696793981006062563140513213308741738
title: CVE-2018-1108 linux
description:
kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.


definition_id: oval:org.debian:def:184521675219447103542431222431468361315
title: CVE-2018-11099 vcftools
description:
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted vcf file.


definition_id: oval:org.debian:def:99429039183866987685903374620372603671
title: CVE-2018-1110 knot-resolver
description:
A flaw was found in knot-resolver before version 2.3.0. Malformed DNS messages may cause denial of service.


definition_id: oval:org.debian:def:91417160399959261890944223880796417720
title: CVE-2018-11129 vcftools
description:
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.


definition_id: oval:org.debian:def:50036399914124917027359186572652958616
title: CVE-2018-11130 vcftools
description:
The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.


definition_id: oval:org.debian:def:248159528566074464680050917918929929350
title: CVE-2018-1116 policykit-1
description:
A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.


definition_id: oval:org.debian:def:6651183808599581484890515220164606581
title: CVE-2018-1118 linux
description:
The Linux kernel does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.


definition_id: oval:org.debian:def:189609519637735515426357553777411067964
title: CVE-2018-1120 linux
description:
A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).


definition_id: oval:org.debian:def:85032924773636894579040930966549888486
title: CVE-2018-11202 hdf5
description:
A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.


definition_id: oval:org.debian:def:193397268720165969447286114241095543585
title: CVE-2018-11203 hdf5
description:
A division by zero was discovered in H5D__btree_decode_key in H5Dbtree.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.


definition_id: oval:org.debian:def:130852309699556242034194980803601783253
title: CVE-2018-11204 hdf5
description:
A NULL pointer dereference was discovered in H5O__chunk_deserialize in H5Ocache.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.


definition_id: oval:org.debian:def:327858405790366748512414768140460636256
title: CVE-2018-11206 hdf5
description:
An out of bounds read was discovered in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service or information disclosure attack.


definition_id: oval:org.debian:def:78146927984899047148473710206764113415
title: CVE-2018-11207 hdf5
description:
A division by zero was discovered in H5D__chunk_init in H5Dchunk.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.


definition_id: oval:org.debian:def:286703318702270308559006575142799902835
title: CVE-2018-11212 libjpeg-turbo
description:
An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.


definition_id: oval:org.debian:def:158417257048197507494699245698300509562
title: CVE-2018-11213 libjpeg-turbo
description:
An issue was discovered in libjpeg 9a. The get_text_gray_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.


definition_id: oval:org.debian:def:231703208388229831330092673372121453802
title: CVE-2018-11214 libjpeg-turbo
description:
An issue was discovered in libjpeg 9a. The get_text_rgb_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.


definition_id: oval:org.debian:def:192048186119801441623964489751640984077
title: CVE-2018-11218 redis
description:
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.


definition_id: oval:org.debian:def:145433477413139504418946417318784559644
title: CVE-2018-11219 redis
description:
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.


definition_id: oval:org.debian:def:240635709814330874002180378576638358804
title: CVE-2018-1122 procps
description:
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.


definition_id: oval:org.debian:def:147469287232477726985904849836155818686
title: CVE-2018-1123 procps
description:
procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).


definition_id: oval:org.debian:def:5132892383922049185029422366958018419
title: CVE-2018-11233 git
description:
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.


definition_id: oval:org.debian:def:198262365259421391617640847362255717506
title: CVE-2018-11235 git
description:
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.


definition_id: oval:org.debian:def:155676868278321984414570884580632258209
title: CVE-2018-11236 glibc
description:
stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.


definition_id: oval:org.debian:def:139078945701124157680236403527271611376
title: CVE-2018-11237 glibc
description:
An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.


definition_id: oval:org.debian:def:34293435660166088681101068526270230855
title: CVE-2018-1124 procps
description:
procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.


definition_id: oval:org.debian:def:339345160021565770701633047102876100371
title: CVE-2018-11243 upx-ucl
description:
PackLinuxElf64::unpack in p_lx_elf.cpp in UPX 3.95 allows remote attackers to cause a denial of service (double free), limit the ability of a malware scanner to operate on the entire original data, or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:51654244330084618456498704002144593070
title: CVE-2018-1125 procps
description:
procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.


definition_id: oval:org.debian:def:118241936179927553475955018460464234150
title: CVE-2018-11251 imagemagick
description:
In ImageMagick 7.0.7-23 Q16 x86_64 2018-01-24, there is a heap-based buffer over-read in ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service (application crash in SetGrayscaleImage in MagickCore/quantize.c) via a crafted SUN image file.


definition_id: oval:org.debian:def:264168256085582178150095892514295355217
title: CVE-2018-11254 libpodofo
description:
An issue was discovered in PoDoFo 0.9.5. There is an Excessive Recursion in the PdfPagesTree::GetPageNode() function of PdfPagesTree.cpp. Remote attackers could leverage this vulnerability to cause a denial of service through a crafted pdf file, a related issue to CVE-2017-8054.


definition_id: oval:org.debian:def:146217621907428261244574090991229654370
title: CVE-2018-11256 libpodofo
description:
An issue was discovered in PoDoFo 0.9.5. The function PdfDocument::Append() in PdfDocument.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.


definition_id: oval:org.debian:def:28414146773288757000744082388901012349
title: CVE-2018-1126 procps
description:
procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.


definition_id: oval:org.debian:def:180178998821231615276919806167582018944
title: CVE-2018-1128 ceph
description:
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.


definition_id: oval:org.debian:def:162309479498836386798255759889392981314
title: CVE-2018-1129 ceph
description:
A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.


definition_id: oval:org.debian:def:336578531050048141647810733930091249782
title: CVE-2018-1130 linux
description:
Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allows a local user to cause a denial of service by a number of certain crafted system calls.


definition_id: oval:org.debian:def:203022190251428574463838778141796146071
title: CVE-2018-11307 jackson-databind
description:
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.


definition_id: oval:org.debian:def:14284414734737026560085635335166796421
title: CVE-2018-11319 vim-syntastic
description:
Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the current directory up to potentially the root). This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to a directory that is a parent of the base directory of the project being checked. NOTE: exploitation is more difficult after 3.8.0 because filename prediction may be needed.


definition_id: oval:org.debian:def:93226473606788941064330032163109326302
title: CVE-2018-11356 wireshark
description:
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the DNS dissector could crash. This was addressed in epan/dissectors/packet-dns.c by avoiding a NULL pointer dereference for an empty name in an SRV record.


definition_id: oval:org.debian:def:203623387086227783370154877693932910294
title: CVE-2018-11357 wireshark
description:
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. This was addressed in epan/tvbuff.c by rejecting negative lengths.


definition_id: oval:org.debian:def:324310345255193064855914615044546399236
title: CVE-2018-11358 wireshark
description:
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the Q.931 dissector could crash. This was addressed in epan/dissectors/packet-q931.c by avoiding a use-after-free after a malformed packet prevented certain cleanup.


definition_id: oval:org.debian:def:66497295582387050936383231431116544337
title: CVE-2018-11359 wireshark
description:
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the RRC dissector and other dissectors could crash. This was addressed in epan/proto.c by avoiding a NULL pointer dereference.


definition_id: oval:org.debian:def:89305696037242088253394710922157281491
title: CVE-2018-11360 wireshark
description:
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the GSM A DTAP dissector could crash. This was addressed in epan/dissectors/packet-gsm_a_dtap.c by fixing an off-by-one error that caused a buffer overflow.


definition_id: oval:org.debian:def:121021380585803448481896477858304598887
title: CVE-2018-11361 wireshark
description:
In Wireshark 2.6.0, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/dot11decrypt.c by avoiding a buffer overflow during FTE processing in Dot11DecryptTDLSDeriveKey.


definition_id: oval:org.debian:def:208207942711741834975667675700227534068
title: CVE-2018-11362 wireshark
description:
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by avoiding a buffer over-read upon encountering a missing '\0' character.


definition_id: oval:org.debian:def:100650975389275820884790147404948771128
title: CVE-2018-11364 r-cran-haven
description:
sav_parse_machine_integer_info_record in spss/readstat_sav_read.c in libreadstat.a in ReadStat 0.1.1 has a memory leak related to an iconv_open call.


definition_id: oval:org.debian:def:87150892096906490239484878717085479166
title: CVE-2018-11385 symfony
description:
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.


definition_id: oval:org.debian:def:337228486890758451645930534244573844473
title: CVE-2018-11386 symfony
description:
An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.


definition_id: oval:org.debian:def:85521124908343601726422717562206118956
title: CVE-2018-1139 samba
description:
A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.


definition_id: oval:org.debian:def:238697078412493365775144572355769364934
title: CVE-2018-11396 epiphany-browser
description:
ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that triggers access to a NULL URL, as demonstrated by a crafted window.open call.


definition_id: oval:org.debian:def:16088591516320759377761339104265676096
title: CVE-2018-1140 samba
description:
A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker could use this flaw to cause a denial of service against a samba server, used as a Active Directory Domain Controller. All versions of Samba from 4.8.0 onwards are vulnerable


definition_id: oval:org.debian:def:338046987840800422420371943843263427292
title: CVE-2018-11406 symfony
description:
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.


definition_id: oval:org.debian:def:78384007602170073966211459061157845722
title: CVE-2018-11407 symfony
description:
An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind.  NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.


definition_id: oval:org.debian:def:225325491882253272322971735900634387089
title: CVE-2018-11408 symfony
description:
The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container.  NOTE: this issue exists because of an incomplete fix for CVE-2017-16652.


definition_id: oval:org.debian:def:51573042432564906866981451844468998669
title: CVE-2018-11410 liblouis
description:
An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in compileTranslationTable.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:224798376911117795544377161440291972617
title: CVE-2018-11412 linux
description:
In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode.


definition_id: oval:org.debian:def:92012984074686357636697353950549172586
title: CVE-2018-11439 taglib
description:
The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted audio file.


definition_id: oval:org.debian:def:167839621090521038848779455529568096360
title: CVE-2018-11440 liblouis
description:
Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c.


definition_id: oval:org.debian:def:230569792056051962815367879486137981722
title: CVE-2018-11468 discount
description:
The __mkd_trim_line function in mkdio.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html.


definition_id: oval:org.debian:def:141396476331447339436992448250484392675
title: CVE-2018-11469 haproxy
description:
Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for_cacheability function.


definition_id: oval:org.debian:def:134110667215159594966949494970896536415
title: CVE-2018-11489 giflib
description:
The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain CrntCode array index is not checked. This will lead to a denial of service or possibly unspecified other impact.


definition_id: oval:org.debian:def:225263151026275322400710940170280868736
title: CVE-2018-11490 giflib
description:
The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain "Private->RunningCode - 2" array index is not checked. This will lead to a denial of service or possibly unspecified other impact.


definition_id: oval:org.debian:def:126991233732224511615378652681676234027
title: CVE-2018-11496 lrzip
description:
In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in read_stream in stream.c, because decompress_file in lrzip.c lacks certain size validation.


definition_id: oval:org.debian:def:299921947162090462545947016514274542309
title: CVE-2018-11499 libsass
description:
A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service (application crash) or possibly unspecified other impact.


definition_id: oval:org.debian:def:76760650345077792336297318440273707901
title: CVE-2018-11503 discount
description:
The isfootnote function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html.


definition_id: oval:org.debian:def:188908824956220281205055965462308375137
title: CVE-2018-11504 discount
description:
The islist function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html.


definition_id: oval:org.debian:def:82971294860079966762191604745207917539
title: CVE-2018-11506 linux
description:
The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a CDROMREADMODE2 ioctl call.


definition_id: oval:org.debian:def:177863594321717674367671073452021172288
title: CVE-2018-11508 linux
description:
The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensitive information from kernel memory via adjtimex.


definition_id: oval:org.debian:def:93981143150395879683340373457383798997
title: CVE-2018-11516 vlc
description:
The vlc_demux_chained_Delete function in input/demux_chained.c in VideoLAN VLC media player 3.0.1 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted .swf file.


definition_id: oval:org.debian:def:318183364024255141752552142650470809856
title: CVE-2018-1152 libjpeg-turbo
description:
libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image.


definition_id: oval:org.debian:def:182812733683967453038895261395399895757
title: CVE-2018-11529 vlc
description:
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.


definition_id: oval:org.debian:def:216427881962021075728066882160353342348
title: CVE-2018-11563 otrs2
description:
An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7. A carefully constructed email could be used to inject and execute arbitrary stylesheet or JavaScript code in a logged in customer's browser in the context of the OTRS customer panel application.


definition_id: oval:org.debian:def:337349303507361039506132845103089326724
title: CVE-2018-11574 ppp
description:
Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authentication bypass. This implementation is distributed as a patch for PPPD 0.91, and includes the affected eap.c and eap-tls.c files. Configurations that use the `refuse-app` option are unaffected.


definition_id: oval:org.debian:def:272830756068724525145669287440185450109
title: CVE-2018-1160 netatalk
description:
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.


definition_id: oval:org.debian:def:37700905972332716405864544724307824742
title: CVE-2018-11624 imagemagick
description:
In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows attackers to cause a use after free via a crafted file.


definition_id: oval:org.debian:def:273145770281900767251935216021307348088
title: CVE-2018-11625 imagemagick
description:
In ImageMagick 7.0.7-37 Q16, SetGrayscaleImage in the quantize.c file allows attackers to cause a heap-based buffer over-read via a crafted file.


definition_id: oval:org.debian:def:87251006636369744202228749212740136373
title: CVE-2018-11645 ghostscript
description:
psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.


definition_id: oval:org.debian:def:295015450317823155965487401785785368809
title: CVE-2018-11646 webkit2gtk
description:
webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.


definition_id: oval:org.debian:def:39015105027626132580647451419283402621
title: CVE-2018-11652 nikto
description:
CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report.


definition_id: oval:org.debian:def:163079044975120168605595131637349551638
title: CVE-2018-11655 imagemagick
description:
In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function GetImagePixelCache in MagickCore/cache.c, which allows attackers to cause a denial of service via a crafted CALS image file.


definition_id: oval:org.debian:def:70308781770116873767677522389525696115
title: CVE-2018-11656 imagemagick
description:
In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.


definition_id: oval:org.debian:def:205184644599793722658025768326083702989
title: CVE-2018-11683 liblouis
description:
Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.


definition_id: oval:org.debian:def:220567445864589206871421405195020885333
title: CVE-2018-11684 liblouis
description:
Liblouis 3.5.0 has a stack-based Buffer Overflow in the function includeFile in compileTranslationTable.c.


definition_id: oval:org.debian:def:283611546008461642752299755496468364829
title: CVE-2018-11685 liblouis
description:
Liblouis 3.5.0 has a stack-based Buffer Overflow in the function compileHyphenation in compileTranslationTable.c.


definition_id: oval:org.debian:def:37077564102325084974129738369657787478
title: CVE-2018-11693 libsass
description:
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::skip_over_scopes which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.


definition_id: oval:org.debian:def:70326427756246113194643346771179171930
title: CVE-2018-11695 libsass
description:
An issue was discovered in LibSass <3.5.3. A NULL pointer dereference was found in the function Sass::Expand::operator which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:327823928914078813357721862349414004264
title: CVE-2018-11696 libsass
description:
An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Inspect::operator which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:177264630871909919369674922275774036419
title: CVE-2018-11710 libopenmpt
description:
soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted AMS file because of an invalid write near address 0 in an out-of-memory situation.


definition_id: oval:org.debian:def:94802384888954175592898889694194594414
title: CVE-2018-11712 webkit2gtk
description:
WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ versions 2.20.0 and 2.20.1, failed to perform TLS certificate verification for WebSocket connections.


definition_id: oval:org.debian:def:132799193235603775385996024063280178136
title: CVE-2018-11713 webkit2gtk
description:
WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by crafted web sites via a WebSocket connection.


definition_id: oval:org.debian:def:116251165444156110287429458083025984638
title: CVE-2018-1172 squid
description:
This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.


definition_id: oval:org.debian:def:58792783261144271315985298410109435480
title: CVE-2018-11723 libpff
description:
** DISPUTED ** The libpff_name_to_id_map_entry_read function in libpff_name_to_id_map.c in libyal libpff through 2018-04-28 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted pff file. NOTE: the vendor has disputed this as described in libyal/libpff issue 66 on GitHub.


definition_id: oval:org.debian:def:38787215097690201343330078396519724107
title: CVE-2018-11727 libfsntfs
description:
** DISPUTED ** The libfsntfs_attribute_read_from_mft function in libfsntfs_attribute.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub.


definition_id: oval:org.debian:def:272638040538900285746790866240756412300
title: CVE-2018-11728 libfsntfs
description:
** DISPUTED ** The libfsntfs_reparse_point_values_read_data function in libfsntfs_reparse_point_values.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub.


definition_id: oval:org.debian:def:97341660571119829748057927097285862456
title: CVE-2018-11729 libfsntfs
description:
** DISPUTED ** The libfsntfs_mft_entry_read_header function in libfsntfs_mft_entry.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub.


definition_id: oval:org.debian:def:224838587874134390367446528747695924426
title: CVE-2018-11730 libfsntfs
description:
** DISPUTED ** The libfsntfs_security_descriptor_values_free function in libfsntfs_security_descriptor_values.c in libfsntfs through 2018-04-20 allows remote attackers to cause a denial of service (double-free) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub.


definition_id: oval:org.debian:def:158208118338879111946915666870201889986
title: CVE-2018-11731 libfsntfs
description:
** DISPUTED ** The libfsntfs_mft_entry_read_attributes function in libfsntfs_mft_entry.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub.


definition_id: oval:org.debian:def:75782061544732599984797578728215060623
title: CVE-2018-11743 mruby
description:
The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attackers to cause a denial of service (mrb_hash_keys uninitialized pointer and application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:109007830557569271950075399963665778287
title: CVE-2018-11759 libapache-mod-jk
description:
The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.


definition_id: oval:org.debian:def:317502945878553888558855214964440719490
title: CVE-2018-11761 tika
description:
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.


definition_id: oval:org.debian:def:211622052761987383736656996131458786608
title: CVE-2018-11762 tika
description:
In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.


definition_id: oval:org.debian:def:79860372499348547732149206328704359466
title: CVE-2018-11763 apache2
description:
In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.


definition_id: oval:org.debian:def:179576129387796690637840908216451047899
title: CVE-2018-11771 libcommons-compress-java
description:
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.


definition_id: oval:org.debian:def:279711127431545540578241004361226706413
title: CVE-2018-11775 activemq
description:
TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.


definition_id: oval:org.debian:def:60035740592850342571866487965379002953
title: CVE-2018-11780 spamassassin
description:
A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.


definition_id: oval:org.debian:def:323996902081367330394071601061011009345
title: CVE-2018-11783 trafficserver
description:
sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1.


definition_id: oval:org.debian:def:9150854962380272234648610771229448107
title: CVE-2018-11790 libreoffice
description:
When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this case OpenOffice runs into an Arithmetic Overflow at a string length calculation.


definition_id: oval:org.debian:def:292454229883066625035621865394773652763
title: CVE-2018-11797 libpdfbox-java
description:
In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.


definition_id: oval:org.debian:def:241909231488966899107351254253143194943
title: CVE-2018-11798 thrift
description:
The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.


definition_id: oval:org.debian:def:268660070466401797310669864634828064034
title: CVE-2018-11803 subversion
description:
Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if the client omits the root path in a recursive directory listing operation.


definition_id: oval:org.debian:def:105525926616932766246434221809304831076
title: CVE-2018-1199 libspring-java
description:
Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.


definition_id: oval:org.debian:def:180310866100803784450373815833925387333
title: CVE-2018-12015 perl
description:
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.


definition_id: oval:org.debian:def:257317838979495228745650746314940587643
title: CVE-2018-12016 epiphany-browser
description:
libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via certain window.open and document.write calls.


definition_id: oval:org.debian:def:245878643801187080132473203347829048437
title: CVE-2018-12019 enigmail
description:
The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.


definition_id: oval:org.debian:def:49280280296857623941820570219729027795
title: CVE-2018-12020 enigmail
description:
mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.


definition_id: oval:org.debian:def:288399820448664153480496327478563037553
title: CVE-2018-12022 jackson-databind
description:
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.


definition_id: oval:org.debian:def:4903707383934367280264365723483757115
title: CVE-2018-12023 jackson-databind
description:
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.


definition_id: oval:org.debian:def:29406597579513518720649737954575243693
title: CVE-2018-12029 passenger
description:
A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.


definition_id: oval:org.debian:def:88253852220476614936400189402179817182
title: CVE-2018-12034 yara
description:
In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds read vulnerability in yr_execute_code in libyara/exec.c.


definition_id: oval:org.debian:def:88924707555439684675985841728871170132
title: CVE-2018-12035 yara
description:
In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds write vulnerability in yr_execute_code in libyara/exec.c.


definition_id: oval:org.debian:def:265601497340397764777935145084153163479
title: CVE-2018-12040 symfony
description:
** DISPUTED ** Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the "file" parameter, aka an _profiler/open?file= URI.  NOTE: The vendor states "The XSS ... is in the web profiler, a tool that should never be deployed in production (so, we don't handle those issues as security issues)."


definition_id: oval:org.debian:def:206536269670070456016571727926914970535
title: CVE-2018-12066 bird
description:
BIRD Internet Routing Daemon before 1.6.4 allows local users to cause a denial of service (stack consumption and daemon crash) via BGP mask expressions in birdc.


definition_id: oval:org.debian:def:188430323881076566262165193048391197356
title: CVE-2018-12085 liblouis
description:
Liblouis 3.6.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.


definition_id: oval:org.debian:def:336223766085328105142631735448516988417
title: CVE-2018-12086 wireshark
description:
Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests.


definition_id: oval:org.debian:def:197157571113401939993297966316251308840
title: CVE-2018-12088 s3ql
description:
S3QL before 2.27 mishandles checksumming, and consequently allows replay attacks in which an attacker who controls the backend can present old versions of the filesystem metadata database as up-to-date, temporarily inject zero-valued bytes into files, or temporarily hide parts of files. This is related to the checksum_basic_mapping function.


definition_id: oval:org.debian:def:37313243772982730512060958931010983773
title: CVE-2018-12096 liblnk
description:
** DISPUTED ** The liblnk_data_string_get_utf8_string_size function in liblnk_data_string.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted lnk file. NOTE: the vendor has disputed this as described in libyal/liblnk issue 33 on GitHub.


definition_id: oval:org.debian:def:189349107436134544152839857801519881608
title: CVE-2018-12097 liblnk
description:
** DISPUTED ** The liblnk_location_information_read_data function in liblnk_location_information.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted lnk file. NOTE: the vendor has disputed this as described in libyal/liblnk issue 33 on GitHub.


definition_id: oval:org.debian:def:136390166216866596610734339948081270105
title: CVE-2018-12098 liblnk
description:
** DISPUTED ** The liblnk_data_block_read function in liblnk_data_block.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted lnk file. NOTE: the vendor has disputed this as described in libyal/liblnk issue 33 on GitHub.


definition_id: oval:org.debian:def:116694687389718671884397386365576776160
title: CVE-2018-12115 nodejs
description:
In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.


definition_id: oval:org.debian:def:291618354617616325804890245156164689967
title: CVE-2018-12116 nodejs
description:
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.


definition_id: oval:org.debian:def:254044619992232667728118038977024056764
title: CVE-2018-12120 nodejs
description:
Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as `node --debug=localhost`. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.


definition_id: oval:org.debian:def:10376724731791714622274821794776907171
title: CVE-2018-12121 nodejs
description:
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.


definition_id: oval:org.debian:def:302815119544232966538681405886315366699
title: CVE-2018-12122 nodejs
description:
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.


definition_id: oval:org.debian:def:314805527307752454489189014300209283869
title: CVE-2018-12123 nodejs
description:
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.


definition_id: oval:org.debian:def:217867017342811944603197166165596474356
title: CVE-2018-12126 intel-microcode
description:
Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf


definition_id: oval:org.debian:def:63351094955264779798446691037572877080
title: CVE-2018-12127 intel-microcode
description:
Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf


definition_id: oval:org.debian:def:337270729830148418940168237894851127538
title: CVE-2018-12130 intel-microcode
description:
Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf


definition_id: oval:org.debian:def:257194389659921435696833051676020885301
title: CVE-2018-12178 edk2
description:
Buffer overflow in network stack for EDK II may allow unprivileged user to potentially enable escalation of privilege and/or denial of service via network.


definition_id: oval:org.debian:def:194965994450603509881945005098550865637
title: CVE-2018-12180 edk2
description:
Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via network access.


definition_id: oval:org.debian:def:264270996233504938157933771430089562624
title: CVE-2018-12181 edk2
description:
Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege via local access.


definition_id: oval:org.debian:def:274489248406939379922624144874741011433
title: CVE-2018-12183 edk2
description:
Stack overflow in DxeCore for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.


definition_id: oval:org.debian:def:271349481724949046043842061655832022324
title: CVE-2018-12227 asterisk
description:
An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However, if an endpoint is not identified, then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot be bypassed to gain access to the disclosed endpoints.


definition_id: oval:org.debian:def:286505547357855616464945525808208697131
title: CVE-2018-12232 linux
description:
In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions. fchownat does not increment the file descriptor reference count, which allows close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash.


definition_id: oval:org.debian:def:159665528867521812161244241095110436933
title: CVE-2018-12233 linux
description:
In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr.


definition_id: oval:org.debian:def:79193456732964349434113602903032187551
title: CVE-2018-12248 mruby
description:
An issue was discovered in mruby 1.4.1. There is a heap-based buffer over-read associated with OP_ENTER because mrbgems/mruby-fiber/src/fiber.c does not extend the stack in cases of many arguments to fiber.


definition_id: oval:org.debian:def:337658317862060090920117218262643761624
title: CVE-2018-12249 mruby
description:
An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class_real because "class BasicObject" is not properly supported in class.c.


definition_id: oval:org.debian:def:336875389600678223719892437261491914273
title: CVE-2018-12264 exiv2
description:
Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp.


definition_id: oval:org.debian:def:319904779830602517859499011121613786655
title: CVE-2018-12265 exiv2
description:
Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp.


definition_id: oval:org.debian:def:155211932082511772677617207004422807181
title: CVE-2018-12293 webkit2gtk
description:
The getImageData function in the ImageBufferCairo class in WebCore/platform/graphics/cairo/ImageBufferCairo.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.3 and WPE WebKit prior to version 2.20.1, is vulnerable to a heap-based buffer overflow triggered by an integer overflow, which could be abused by crafted HTML content.


definition_id: oval:org.debian:def:245019413679355385638764358908468641800
title: CVE-2018-12294 webkit2gtk
description:
WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object.


definition_id: oval:org.debian:def:321585901475026198162911548342776491726
title: CVE-2018-12326 redis
description:
Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source.


definition_id: oval:org.debian:def:54561066923690256732597242613320039034
title: CVE-2018-12356 password-store
description:
An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extension scripts. Modifying the configuration file allows the attacker to inject additional encryption keys under their control, thereby disclosing passwords to the attacker. Modifying the extension scripts allows the attacker arbitrary code execution.


definition_id: oval:org.debian:def:278148511847404225599687645934432827821
title: CVE-2018-12359 firefox-esr
description:
A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing data to be written outside of the currently computed boundaries. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.


definition_id: oval:org.debian:def:53210722177520197632631928829586530017
title: CVE-2018-12360 firefox-esr
description:
A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.


definition_id: oval:org.debian:def:252868034675534869339429047156930558395
title: CVE-2018-12361 thunderbird
description:
An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics computations when their inputs are not sanitized which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.


definition_id: oval:org.debian:def:122264709787275805483902903317429152508
title: CVE-2018-12362 firefox-esr
description:
An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.


definition_id: oval:org.debian:def:139244693955616163416516556569120892217
title: CVE-2018-12363 firefox-esr
description:
A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the node still having a pointer referencing it. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.


definition_id: oval:org.debian:def:157527852040245559398175626389329538742
title: CVE-2018-12364 firefox-esr
description:
NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site. This allows for a malicious site to engage in cross-site request forgery (CSRF) attacks. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.


definition_id: oval:org.debian:def:296911588693638823390122828952655295157
title: CVE-2018-12365 firefox-esr
description:
A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.


definition_id: oval:org.debian:def:253493607731866026492640407074998244103
title: CVE-2018-12366 firefox-esr
description:
An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.


definition_id: oval:org.debian:def:216067061106995104376505361812921093200
title: CVE-2018-12367 thunderbird
description:
In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure precise time intervals. In that work PerformanceNavigationTiming was not adjusted but it was found that it could be used as a precision timer. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.


definition_id: oval:org.debian:def:186356868865293801564273451820077191378
title: CVE-2018-12371 thunderbird
description:
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.1, Thunderbird < 60, and Firefox < 61.


definition_id: oval:org.debian:def:147223160735692798495888082983926992436
title: CVE-2018-12372 thunderbird
description:
Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 52.9.


definition_id: oval:org.debian:def:46003053299117003582923174897949701145
title: CVE-2018-12373 thunderbird
description:
dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerability affects Thunderbird < 52.9.


definition_id: oval:org.debian:def:156543411259579456801328534326146329597
title: CVE-2018-12374 thunderbird
description:
Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird < 52.9.


definition_id: oval:org.debian:def:272901425376313282469070012751098042416
title: CVE-2018-12376 firefox-esr
description:
Memory safety bugs present in Firefox 61 and Firefox ESR 60.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.


definition_id: oval:org.debian:def:146923019877536295572102719487804092238
title: CVE-2018-12377 firefox-esr
description:
A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is deleted while still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.


definition_id: oval:org.debian:def:313092437647134760199894775604183203070
title: CVE-2018-12378 firefox-esr
description:
A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload values to be stored. This results in a potentially exploitable crash. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.


definition_id: oval:org.debian:def:152850226184662458948792235811980249690
title: CVE-2018-12379 firefox-esr
description:
When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading to a potentially exploitable crash. This requires running the Mozilla Updater manually on the local system with the malicious MAR file in order to occur. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.


definition_id: oval:org.debian:def:145437729644352301501681940832052804382
title: CVE-2018-12383 firefox-esr
description:
If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Firefox < 62, Firefox ESR < 60.2.1, and Thunderbird < 60.2.1.


definition_id: oval:org.debian:def:241445269196297976850814148935689830261
title: CVE-2018-12384 nss
description:
When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.


definition_id: oval:org.debian:def:117037112393522217885999948418951948847
title: CVE-2018-12385 firefox-esr
description:
A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used. This vulnerability affects Thunderbird < 60.2.1, Firefox ESR < 60.2.1, and Firefox < 62.0.2.


definition_id: oval:org.debian:def:65668473704423546904615456630781550018
title: CVE-2018-12386 firefox-esr
description:
A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered. This vulnerability affects Firefox ESR < 60.2.2 and Firefox < 62.0.3.


definition_id: oval:org.debian:def:315638967160303557928771194002577146514
title: CVE-2018-12387 firefox-esr
description:
A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process. This vulnerability affects Firefox ESR < 60.2.2 and Firefox < 62.0.3.


definition_id: oval:org.debian:def:107903694733372276508485439093136176594
title: CVE-2018-12389 firefox-esr
description:
Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.3 and Thunderbird < 60.3.


definition_id: oval:org.debian:def:129882994969401215423413766271788753794
title: CVE-2018-12390 firefox-esr
description:
Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.


definition_id: oval:org.debian:def:80481650292683495627007949887616538505
title: CVE-2018-12392 firefox-esr
description:
When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.


definition_id: oval:org.debian:def:284544226277168547318827943045899938550
title: CVE-2018-12393 firefox-esr
description:
A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion. This leads to a possible out-of-bounds write. *Note: 64-bit builds are not vulnerable to this issue.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.


definition_id: oval:org.debian:def:267976065227568848232123803929664609084
title: CVE-2018-12395 firefox-esr
description:
By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.


definition_id: oval:org.debian:def:986712007437921754622161597665508113
title: CVE-2018-12396 firefox-esr
description:
A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.


definition_id: oval:org.debian:def:108080726305370122153907395482330191035
title: CVE-2018-12397 firefox-esr
description:
A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.


definition_id: oval:org.debian:def:321786896139677890265956990131712360240
title: CVE-2018-12404 nss
description:
A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.


definition_id: oval:org.debian:def:106484586763423529387102106710712682675
title: CVE-2018-12405 firefox-esr
description:
Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.


definition_id: oval:org.debian:def:31558795605536386342257492401386087681
title: CVE-2018-12422 evolution-data-server
description:
** DISPUTED ** addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because "the code had computed the required string length first, and then allocated a large-enough buffer on the heap."


definition_id: oval:org.debian:def:181900096868664900761430719191931672990
title: CVE-2018-12435 botan
description:
Botan 2.5.0 through 2.6.0 before 2.7.0 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP, related to dsa/dsa.cpp, ec_group/ec_group.cpp, and ecdsa/ecdsa.cpp. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.


definition_id: oval:org.debian:def:215056865356800642988214664525436595734
title: CVE-2018-12437 libtomcrypt
description:
LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.


definition_id: oval:org.debian:def:109768916944356338519392872221344881624
title: CVE-2018-12458 ffmpeg
description:
An improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service.


definition_id: oval:org.debian:def:266300424731000394037326996711757454891
title: CVE-2018-12459 ffmpeg
description:
An inconsistent bits-per-sample value in the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c in FFmpeg 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service.


definition_id: oval:org.debian:def:197048179004441894964662331355025269420
title: CVE-2018-12482 ocsinventory-server
description:
OCS Inventory 2.4.1 contains multiple SQL injections in the search engine. Authentication is needed in order to exploit the issues.


definition_id: oval:org.debian:def:57915110616035541115055001837446887958
title: CVE-2018-12483 ocsinventory-server
description:
OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. Specifically, this issue occurs because the content of the ipdiscover_analyser rzo GET parameter is concatenated to a string used in an exec() call in the PHP code. Authentication is needed in order to exploit this vulnerability.


definition_id: oval:org.debian:def:211249011657764645076510008296125912115
title: CVE-2018-12495 discount
description:
The quoteblock function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.


definition_id: oval:org.debian:def:222283660205808375715144478295197102491
title: CVE-2018-12520 ntopng
description:
An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard library in use by the host running the service and the username of the user whose session they're targeting can abuse the deterministic random number generation in order to hijack the user's session, thus escalating their access.


definition_id: oval:org.debian:def:49433662962826901585266297797724378099
title: CVE-2018-12536 jetty9
description:
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.


definition_id: oval:org.debian:def:251712178034043548194727302790996633977
title: CVE-2018-12546 mosquitto
description:
In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients being able cause effects that would otherwise not be allowed.


definition_id: oval:org.debian:def:169858077789860237424722796904411541044
title: CVE-2018-12550 mosquitto
description:
When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines, then Mosquitto will treat this as though no ACL file has been defined and use a default allow policy. The new behaviour is to have an empty ACL file mean that all access is denied, which is not a useful configuration but is not unexpected.


definition_id: oval:org.debian:def:217846229186358814792769585836826745188
title: CVE-2018-12551 mosquitto
description:
When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent authentication and get access to the broker by using the malformed username. In particular, a blank line will be treated as a valid empty username. Other security measures are unaffected. Users who have only used the mosquitto_passwd utility to create and modify their password files are unaffected by this vulnerability.


definition_id: oval:org.debian:def:298770254853338136636721631046952278642
title: CVE-2018-12558 libemail-address-perl
description:
The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial of Service. Prepared special input that caused this problem contained 30 form-field characters ("\f").


definition_id: oval:org.debian:def:219844608363544429241667075274614835985
title: CVE-2018-12559 cantata
description:
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The mount target path check in mounter.cpp `mpOk()` is insufficient. A regular user can consequently mount a CIFS filesystem anywhere (e.g., outside of the /home directory tree) by passing directory traversal sequences such as a home/../usr substring.


definition_id: oval:org.debian:def:91470323771345418825758374027142194922
title: CVE-2018-12560 cantata
description:
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. Arbitrary unmounts can be performed by regular users via directory traversal sequences such as a home/../sys/kernel substring.


definition_id: oval:org.debian:def:40767266485032244987344884527060910202
title: CVE-2018-12561 cantata
description:
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as file_mode= by manipulating (for example) the domain parameter of the samba URL.


definition_id: oval:org.debian:def:184476335416748298768179311504119256195
title: CVE-2018-12562 cantata
description:
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).


definition_id: oval:org.debian:def:53084348532443855968774590015869802050
title: CVE-2018-12563 lava
description:
An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-server-gunicorn to download any file from the filesystem if it's readable by lavaserver and valid yaml.


definition_id: oval:org.debian:def:12970412300650241701275942541328630234
title: CVE-2018-12564 lava
description:
An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for URLs in the submit page, a user can forge an HTTP request that will force lava-server-gunicorn to return any file on the server that is readable by lavaserver and valid yaml.


definition_id: oval:org.debian:def:34540235042321430293007710932086990359
title: CVE-2018-12565 lava
description:
An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load() instead of yaml.safe_load() when parsing user data, remote code execution can occur.


definition_id: oval:org.debian:def:312507582418576644452730166357755617859
title: CVE-2018-1257 libspring-java
description:
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.


definition_id: oval:org.debian:def:290648475994560692778347589540568406552
title: CVE-2018-12599 imagemagick
description:
In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out of bounds write via a crafted file.


definition_id: oval:org.debian:def:167317146816914335501726108253880406228
title: CVE-2018-12600 imagemagick
description:
In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out of bounds write via a crafted file.


definition_id: oval:org.debian:def:239577209644062218401501036273676217099
title: CVE-2018-12608 docker.io
description:
An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA (as opposed to one signed by the configured CA root certificate) to authenticate.


definition_id: oval:org.debian:def:132267527725945485083599977004680629230
title: CVE-2018-12617 qemu
description:
qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.


definition_id: oval:org.debian:def:123751641635802752279093865327691701527
title: CVE-2018-12633 linux
description:
An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice with copy_from_user. The header part of the user data is double-fetched, and a malicious user thread can tamper with the critical variables (hdr.size_in and hdr.size_out) in the header between the two fetches because of a race condition, leading to severe kernel errors, such as buffer over-accesses. This bug can cause a local denial of service and information leakage.


definition_id: oval:org.debian:def:306858494407131961187096412919285170795
title: CVE-2018-12648 exempi
description:
The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.


definition_id: oval:org.debian:def:173822697465296869037519751518323511253
title: CVE-2018-1270 libspring-java
description:
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.


definition_id: oval:org.debian:def:268046722809784617334842351982502537885
title: CVE-2018-1272 libspring-java
description:
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.


definition_id: oval:org.debian:def:34341680183621997139650162029531043101
title: CVE-2018-1283 apache2
description:
In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.


definition_id: oval:org.debian:def:201559505568746445575743871131871318813
title: CVE-2018-12891 xen
description:
An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypasses to be used for an unbounded number of iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host. Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of attacks, due to them lacking preemption checks altogether in the affected code paths. Only x86 systems are affected. ARM systems are not affected. Only multi-vCPU x86 PV guests can leverage the vulnerability. x86 HVM or PVH guests as well as x86 single-vCPU PV ones cannot leverage the vulnerability.


definition_id: oval:org.debian:def:285795578926834594294394988258534756820
title: CVE-2018-12892 xen
description:
An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected). Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless of the nature of the backing storage on the host) are not affected; they are always read only. Only systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host and guest together usually support PVHVM, the issue is exploitable only if the malicious guest administrator has control of the guest kernel or guest kernel command line.


definition_id: oval:org.debian:def:233345874321027586933539100957319458495
title: CVE-2018-12893 xen
description:
An issue was discovered in Xen through 4.10.x. One of the fixes in XSA-260 added some safety checks to help prevent Xen livelocking with debug exceptions. Unfortunately, due to an oversight, at least one of these safety checks can be triggered by a guest. A malicious PV guest can crash Xen, leading to a Denial of Service. All Xen systems which have applied the XSA-260 fix are vulnerable. Only x86 systems are vulnerable. ARM systems are not vulnerable. Only x86 PV guests can exploit the vulnerability. x86 HVM and PVH guests cannot exploit the vulnerability. An attacker needs to be able to control hardware debugging facilities to exploit the vulnerability, but such permissions are typically available to unprivileged users.


definition_id: oval:org.debian:def:234974445025306033623395731528414390547
title: CVE-2018-12895 wordpress
description:
WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author, Editor, and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker's privileges.


definition_id: oval:org.debian:def:33519806159756924585837947744316121404
title: CVE-2018-12896 linux
description:
An issue was discovered in the Linux kernel through 4.17.3. An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically makes the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. For example, a local user can cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls.


definition_id: oval:org.debian:def:121047959261391295164355452001882648962
title: CVE-2018-12900 tiff
description:
Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0beta7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via a crafted TIFF file.


definition_id: oval:org.debian:def:48735382497427682746292590259858806023
title: CVE-2018-12904 linux
description:
In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of service attacks due to lack of checking of CPL.


definition_id: oval:org.debian:def:111648598650480288068774574600308758511
title: CVE-2018-12910 libsoup2.4
description:
The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname.


definition_id: oval:org.debian:def:94362658694651389638840723966620266215
title: CVE-2018-12911 webkit2gtk
description:
WebKitGTK+ 2.20.3 has an off-by-one error, with a resultant out-of-bounds write, in the get_simple_globs functions in ThirdParty/xdgmime/src/xdgmimecache.c and ThirdParty/xdgmime/src/xdgmimeglob.c.


definition_id: oval:org.debian:def:276082987460639347895733653846847660362
title: CVE-2018-12929 linux
description:
ntfs_read_locked_inode in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a use-after-free read and possibly cause a denial of service (kernel oops or panic) via a crafted ntfs filesystem.


definition_id: oval:org.debian:def:174543820922387522712424094286546972426
title: CVE-2018-12930 linux
description:
ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem.


definition_id: oval:org.debian:def:51157749486562555137577770459862776300
title: CVE-2018-12931 linux
description:
ntfs_attr_find in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem.


definition_id: oval:org.debian:def:143494226457995814071425671433148682785
title: CVE-2018-12932 wine
description:
PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by triggering a large pAlphaBlend->cbBitsSrc value.


definition_id: oval:org.debian:def:275578156564643525873157730612297390659
title: CVE-2018-12933 wine
description:
PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact because the attacker controls the pCreatePen->ihPen array index.


definition_id: oval:org.debian:def:258238791021072446211096495058287947566
title: CVE-2018-12982 libpodofo
description:
Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have denial-of-service impact via a crafted file.


definition_id: oval:org.debian:def:275916651718303444768030199484643332584
title: CVE-2018-13005 gpac
description:
An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read.


definition_id: oval:org.debian:def:331125279229417466263671699449755873362
title: CVE-2018-13006 gpac
description:
An issue was discovered in MP4Box in GPAC 0.7.1. There is a heap-based buffer over-read in the isomedia/box_dump.c function hdlr_dump.


definition_id: oval:org.debian:def:263552756883276840281236849104229275565
title: CVE-2018-1301 apache2
description:
A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.


definition_id: oval:org.debian:def:83508065510021526250006385168262826939
title: CVE-2018-1302 apache2
description:
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.


definition_id: oval:org.debian:def:229050637040574567802268886986248738214
title: CVE-2018-1303 apache2
description:
A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.


definition_id: oval:org.debian:def:299164220350972946036328868183495761872
title: CVE-2018-13033 binutils
description:
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file, as demonstrated by _bfd_elf_parse_attributes in elf-attrs.c and bfd_malloc in libbfd.c. This can occur during execution of nm.


definition_id: oval:org.debian:def:135729516413996283967841647425127073279
title: CVE-2018-13043 devscripts
description:
scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing.


definition_id: oval:org.debian:def:90567913377503425801951603232025679316
title: CVE-2018-13053 linux
description:
The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not used.


definition_id: oval:org.debian:def:119179232595692432988193807972164867650
title: CVE-2018-13054 cinnamon
description:
An issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of (for example) other users' icon files in _on_face_browse_menuitem_activated and _on_face_menuitem_activated. These icon files are written to the respective user's $HOME/.face location. If an unprivileged user prepares a symlink pointing to an arbitrary location, then this location will be overwritten with the icon content.


definition_id: oval:org.debian:def:277008323070384468896169236356698668097
title: CVE-2018-1308 lucene-solr
description:
This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.


definition_id: oval:org.debian:def:177510125720588193662934419038506123950
title: CVE-2018-13093 linux
description:
An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image. This occurs because of a lack of proper validation that cached inodes are free during allocation.


definition_id: oval:org.debian:def:194069891225916175576540556957235857684
title: CVE-2018-13094 linux
description:
An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp.


definition_id: oval:org.debian:def:156872563266712032685083037184598595938
title: CVE-2018-13095 linux
description:
An issue was discovered in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.17.3. A denial of service (memory corruption and BUG) can occur for a corrupted xfs image upon encountering an inode that is in extent format, but has more extents than fit in the inode fork.


definition_id: oval:org.debian:def:246531495715012296065561701853507589210
title: CVE-2018-13096 linux
description:
An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.14. A denial of service (out-of-bounds memory access and BUG) can occur upon encountering an abnormal bitmap size when mounting a crafted f2fs image.


definition_id: oval:org.debian:def:323756584177953620376390352909795945322
title: CVE-2018-13097 linux
description:
An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3. There is an out-of-bounds read or a divide-by-zero error for an incorrect user_block_count in a corrupted f2fs image, leading to a denial of service (BUG).


definition_id: oval:org.debian:def:105227640737436282534312453794715205228
title: CVE-2018-13098 linux
description:
An issue was discovered in fs/f2fs/inode.c in the Linux kernel through 4.17.3. A denial of service (slab out-of-bounds read and BUG) can occur for a modified f2fs filesystem image in which FI_EXTRA_ATTR is set in an inode.


definition_id: oval:org.debian:def:73048438932942423815649639342448630277
title: CVE-2018-13099 linux
description:
An issue was discovered in fs/f2fs/inline.c in the Linux kernel through 4.4. A denial of service (out-of-bounds memory access and BUG) can occur for a modified f2fs filesystem image in which an inline inode contains an invalid reserved blkaddr.


definition_id: oval:org.debian:def:98719570500359452713557951512280060490
title: CVE-2018-13100 linux
description:
An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3, which does not properly validate secs_per_zone in a corrupted f2fs image, as demonstrated by a divide-by-zero error.


definition_id: oval:org.debian:def:33536783502119372590678465787167112649
title: CVE-2018-13112 tcpreplay
description:
get_l2len in common/get.c in Tcpreplay 4.3.0 beta1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packets, as demonstrated by tcpprep.


definition_id: oval:org.debian:def:312760865365017940655145584443833064987
title: CVE-2018-1312 apache2
description:
In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.


definition_id: oval:org.debian:def:335610418487526215576242645909788270993
title: CVE-2018-1313 derby
description:
In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.


definition_id: oval:org.debian:def:236514550531879887659991740232620410982
title: CVE-2018-13139 libsndfile
description:
A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file. The vulnerability can be triggered by the executable sndfile-deinterleave.


definition_id: oval:org.debian:def:229703129565111327997851762667366728833
title: CVE-2018-13153 imagemagick
description:
In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.


definition_id: oval:org.debian:def:257383364305117183992363787394567952467
title: CVE-2018-1318 trafficserver
description:
Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS) 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.


definition_id: oval:org.debian:def:93428643837306181125283930510380373456
title: CVE-2018-1324 libcommons-compress-java
description:
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.


definition_id: oval:org.debian:def:58298406266654389976555172005464790691
title: CVE-2018-13259 zsh
description:
An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.


definition_id: oval:org.debian:def:307489065352679104534404037465822001325
title: CVE-2018-13300 ffmpeg
description:
In FFmpeg 3.2 and 4.0.1, an improper argument (AVCodecParameters) passed to the avpriv_request_sample function in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information disclosure.


definition_id: oval:org.debian:def:143055187339202921628929209694496467214
title: CVE-2018-13301 ffmpeg
description:
In FFmpeg 4.0.1, due to a missing check of a profile value before setting it, the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.


definition_id: oval:org.debian:def:224159856666655309193706043941016536618
title: CVE-2018-13302 ffmpeg
description:
In FFmpeg 4.0.1, improper handling of frame types (other than EAC3_FRAME_TYPE_INDEPENDENT) that have multiple independent substreams in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to a denial of service or possibly unspecified other impact.


definition_id: oval:org.debian:def:201287642335560697399164680659320402229
title: CVE-2018-13303 ffmpeg
description:
In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in libavcodec/ac3_parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.


definition_id: oval:org.debian:def:67322023848216395455716479324899471092
title: CVE-2018-13304 ffmpeg
description:
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c.


definition_id: oval:org.debian:def:21990539483907966034903382330643692074
title: CVE-2018-1333 apache2
description:
By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).


definition_id: oval:org.debian:def:199147436271312499856678702773225037112
title: CVE-2018-13346 mercurial
description:
The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.


definition_id: oval:org.debian:def:262266796749710064861075345106822681925
title: CVE-2018-13347 mercurial
description:
mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.


definition_id: oval:org.debian:def:167140647096249742913804241842734107014
title: CVE-2018-13348 mercurial
description:
The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.


definition_id: oval:org.debian:def:101204817146073205870782475702442631047
title: CVE-2018-1335 tika
description:
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.


definition_id: oval:org.debian:def:9037871671164234931246709988271240894
title: CVE-2018-1338 tika
description:
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.


definition_id: oval:org.debian:def:325671983026925699667102014196309030247
title: CVE-2018-1339 tika
description:
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.


definition_id: oval:org.debian:def:315149981893149815354850474493555490909
title: CVE-2018-13405 linux
description:
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.


definition_id: oval:org.debian:def:104307316951105503739613270688792243165
title: CVE-2018-13406 linux
description:
An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel before 4.17.4 could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used.


definition_id: oval:org.debian:def:119476709116883494315107747404700912509
title: CVE-2018-13421 fast-cpp-csv-parser
description:
Fast C++ CSV Parser (aka fast-cpp-csv-parser) before 2018-07-06 has a heap-based buffer over-read in io::trim_chars in csv.h.


definition_id: oval:org.debian:def:93270164874821997471267909904868934224
title: CVE-2018-13440 audiofile
description:
The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.cpp, which allows an attacker to cause a denial of service via a crafted caf file, as demonstrated by sfconvert.


definition_id: oval:org.debian:def:327613206441511098164084036722948624521
title: CVE-2018-13441 nagios4
description:
qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.


definition_id: oval:org.debian:def:326784080846822408637241017185814733668
title: CVE-2018-13457 nagios4
description:
qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.


definition_id: oval:org.debian:def:249011016641932349737550682758599215599
title: CVE-2018-13458 nagios4
description:
qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.


definition_id: oval:org.debian:def:255221947336449215692148529701706044422
title: CVE-2018-13785 libpng1.6
description:
In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.


definition_id: oval:org.debian:def:132934174368518752727909153975156139131
title: CVE-2018-13796 mailman
description:
An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.


definition_id: oval:org.debian:def:329270301279348883666681588112612307030
title: CVE-2018-13797 node-macaddress
description:
The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.


definition_id: oval:org.debian:def:23361744588990318083680684255719164453
title: CVE-2018-13818 twig
description:
** DISPUTED ** Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it.


definition_id: oval:org.debian:def:40512238787258335035732254221746350423
title: CVE-2018-13843 htslib
description:
** DISPUTED ** An issue has been found in HTSlib 1.8. It is a memory leak in bgzf_getline in bgzf.c. NOTE: the software maintainer's position is that the "failure to free memory" can be fixed in applications that use the HTSlib library (such as test/test_bgzf.c in the original report) and is not a library issue.


definition_id: oval:org.debian:def:59930672239171664562633158404466647506
title: CVE-2018-13844 htslib
description:
** DISPUTED ** An issue has been found in HTSlib 1.8. It is a memory leak in fai_read in faidx.c. NOTE: This has been disputed with the assertion that this vulnerability exists in the test harness and HTSlib users would be aware of the need to destruct this object returned by fai_load() in their own code.


definition_id: oval:org.debian:def:252920670601790545243670851351660699887
title: CVE-2018-13863 node-mongodb
description:
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.


definition_id: oval:org.debian:def:140453946266472545024526371291585588124
title: CVE-2018-13982 smarty3
description:
Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.


definition_id: oval:org.debian:def:980177961694104164937476278052913505
title: CVE-2018-13988 poppler
description:
Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrated by pdfunite. This can result in memory corruption and denial of service. This may be exploitable when a victim opens a specially crafted PDF file.


definition_id: oval:org.debian:def:202449462286147519399018074064536684869
title: CVE-2018-14036 accountsservice
description:
Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.


definition_id: oval:org.debian:def:77077860922913753126994710609019505920
title: CVE-2018-14044 soundtouch
description:
The RateTransposer::setChannels function in RateTransposer.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (assertion failure and application exit), as demonstrated by SoundStretch.


definition_id: oval:org.debian:def:30475476532149482312286410187810198478
title: CVE-2018-14045 soundtouch
description:
The FIRFilter::evaluateFilterMulti function in FIRFilter.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (assertion failure and application exit), as demonstrated by SoundStretch.


definition_id: oval:org.debian:def:32204065140541082998937183750954422525
title: CVE-2018-14055 znc
description:
ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf.


definition_id: oval:org.debian:def:217099826828878167654416978900614405079
title: CVE-2018-14056 znc
description:
ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intended skins directories.


definition_id: oval:org.debian:def:231985887394633119840854129124985302076
title: CVE-2018-14072 libsixel
description:
libsixel 1.8.1 has a memory leak in sixel_decoder_decode in decoder.c, image_buffer_resize in fromsixel.c, and sixel_decode_raw in fromsixel.c.


definition_id: oval:org.debian:def:56199578476453155796449845547040982795
title: CVE-2018-14320 libpodofo
description:
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of PoDoFo. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within PdfEncoding::ParseToUnicode. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-5673.


definition_id: oval:org.debian:def:289916713241904092300901046239405815488
title: CVE-2018-14337 mruby
description:
The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds memory access because the mrb_str_resize function in string.c does not check for a negative length.


definition_id: oval:org.debian:def:326312645268135568777625673815288886483
title: CVE-2018-14339 wireshark
description:
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the MMSE dissector could go into an infinite loop. This was addressed in epan/proto.c by adding offset and length validation.


definition_id: oval:org.debian:def:187394245158850751068420401678363848548
title: CVE-2018-14340 wireshark
description:
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, dissectors that support zlib decompression could crash. This was addressed in epan/tvbuff_zlib.c by rejecting negative lengths to avoid a buffer over-read.


definition_id: oval:org.debian:def:110538982890561790262454897047674437318
title: CVE-2018-14341 wireshark
description:
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the DICOM dissector could go into a large or infinite loop. This was addressed in epan/dissectors/packet-dcm.c by preventing an offset overflow.


definition_id: oval:org.debian:def:127131598060084587575165543818307413731
title: CVE-2018-14342 wireshark
description:
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the BGP protocol dissector could go into a large loop. This was addressed in epan/dissectors/packet-bgp.c by validating Path Attribute lengths.


definition_id: oval:org.debian:def:95642245445445308850838873085524664443
title: CVE-2018-14343 wireshark
description:
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ASN.1 BER dissector could crash. This was addressed in epan/dissectors/packet-ber.c by ensuring that length values do not exceed the maximum signed integer.


definition_id: oval:org.debian:def:149416328473372004168428470776868189247
title: CVE-2018-14344 wireshark
description:
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ISMP dissector could crash. This was addressed in epan/dissectors/packet-ismp.c by validating the IPX address length to avoid a buffer over-read.


definition_id: oval:org.debian:def:80421165584278921290250977119613921492
title: CVE-2018-14345 sddm
description:
An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and helper/backend/PamBackend.cpp.


definition_id: oval:org.debian:def:229775599865979321255707176645965155989
title: CVE-2018-14347 libextractor
description:
GNU Libextractor before 1.7 contains an infinite loop vulnerability in EXTRACTOR_mpeg_extract_method (mpeg_extractor.c).


definition_id: oval:org.debian:def:316468343611159836038364770850929806338
title: CVE-2018-14348 libcgroup
description:
libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of information.


definition_id: oval:org.debian:def:54486283366799442137994197555228513828
title: CVE-2018-14349 mutt
description:
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message.


definition_id: oval:org.debian:def:172223210175435601350278016378306023967
title: CVE-2018-14350 mutt
description:
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long INTERNALDATE field.


definition_id: oval:org.debian:def:93508143339926657564311675955090734589
title: CVE-2018-14351 mutt
description:
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size.


definition_id: oval:org.debian:def:119997418721680706666133507658459300541
title: CVE-2018-14352 mutt
description:
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c does not leave room for quote characters, leading to a stack-based buffer overflow.


definition_id: oval:org.debian:def:116732173276413081738978520831494537276
title: CVE-2018-14353 mutt
description:
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c has an integer underflow.


definition_id: oval:org.debian:def:84456285295646619689944118466250731738
title: CVE-2018-14354 mutt
description:
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.


definition_id: oval:org.debian:def:195182034681336010745467928717305482704
title: CVE-2018-14355 mutt
description:
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name.


definition_id: oval:org.debian:def:144478766286048432465827237431287114760
title: CVE-2018-14356 mutt
description:
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c mishandles a zero-length UID.


definition_id: oval:org.debian:def:238085914999423726085506628321428913215
title: CVE-2018-14357 mutt
description:
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription.


definition_id: oval:org.debian:def:120760915093388247952555374220146412986
title: CVE-2018-14358 mutt
description:
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long RFC822.SIZE field.


definition_id: oval:org.debian:def:10450438764928946572562437340267220624
title: CVE-2018-14359 mutt
description:
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They have a buffer overflow via base64 data.


definition_id: oval:org.debian:def:173169163258427078246194573683551650016
title: CVE-2018-14360 mutt
description:
An issue was discovered in NeoMutt before 2018-07-16. nntp_add_group in newsrc.c has a stack-based buffer overflow because of incorrect sscanf usage.


definition_id: oval:org.debian:def:3984161501963353289041238348026129838
title: CVE-2018-14361 mutt
description:
An issue was discovered in NeoMutt before 2018-07-16. nntp.c proceeds even if memory allocation fails for messages data.


definition_id: oval:org.debian:def:31317037094522577680800648188122590680
title: CVE-2018-14362 mutt
description:
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cache pathnames, as demonstrated by a '/' character.


definition_id: oval:org.debian:def:157984978142536035045371916448828176681
title: CVE-2018-14363 mutt
description:
An issue was discovered in NeoMutt before 2018-07-16. newsrc.c does not properly restrict '/' characters that may have unsafe interaction with cache pathnames.


definition_id: oval:org.debian:def:8788292935681490662300194815275102171
title: CVE-2018-14367 wireshark
description:
In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the CoAP protocol dissector could crash. This was addressed in epan/dissectors/packet-coap.c by properly checking for a NULL condition.


definition_id: oval:org.debian:def:43245985148664604822922025973393519206
title: CVE-2018-14368 wireshark
description:
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the Bazaar protocol dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-bzr.c by properly handling items that are too long.


definition_id: oval:org.debian:def:91558378121777212735989252339442852640
title: CVE-2018-14369 wireshark
description:
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the HTTP2 dissector could crash. This was addressed in epan/dissectors/packet-http2.c by verifying that header data was found before proceeding to header decompression.


definition_id: oval:org.debian:def:275384781913804485327835361668857304873
title: CVE-2018-14370 wireshark
description:
In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/airpdcap.c via bounds checking that prevents a buffer over-read.


definition_id: oval:org.debian:def:225856113543206190213668619541745834930
title: CVE-2018-14394 ffmpeg
description:
libavformat/movenc.c in FFmpeg before 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted Waveform audio file.


definition_id: oval:org.debian:def:8298924931168681031939386575525721840
title: CVE-2018-14395 ffmpeg
description:
libavformat/movenc.c in FFmpeg 3.2 and 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted audio file when converting to the MOV audio format.


definition_id: oval:org.debian:def:218446753776600215631843851155284851288
title: CVE-2018-14404 libxml2
description:
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.


definition_id: oval:org.debian:def:218929308342945262774751062871900114748
title: CVE-2018-14423 openjpeg2
description:
Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).


definition_id: oval:org.debian:def:286103995406105571875684032753259206067
title: CVE-2018-14424 gdm3
description:
The daemon in GDM through 3.29.1 does not properly unexport display objects from its D-Bus interface when they are destroyed, which allows a local attacker to trigger a use-after-free via a specially crafted sequence of D-Bus method calls, resulting in a denial of service or potential code execution.


definition_id: oval:org.debian:def:322410347455980161516095745762174033217
title: CVE-2018-14432 keystone
description:
In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.


definition_id: oval:org.debian:def:94637105488232318176749541187495274341
title: CVE-2018-14473 ocsinventory-server
description:
OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be exploited by an attacker sending a crafted HTTP request in order to exfiltrate information or cause a Denial of Service.


definition_id: oval:org.debian:def:58482086279406484666009742146148302988
title: CVE-2018-14498 libjpeg-turbo
description:
get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.


definition_id: oval:org.debian:def:96150008938370559596401863687942542088
title: CVE-2018-14521 aubio
description:
An issue was discovered in aubio 0.4.6. A SEGV signal can occur in aubio_source_avcodec_readframe in io/source_avcodec.c, as demonstrated by aubiomfcc.


definition_id: oval:org.debian:def:184511565047302187543527960201352471621
title: CVE-2018-14522 aubio
description:
An issue was discovered in aubio 0.4.6. A SEGV signal can occur in aubio_pitch_set_unit in pitch/pitch.c, as demonstrated by aubionotes.


definition_id: oval:org.debian:def:198899998426313870762427241277117010674
title: CVE-2018-14523 aubio
description:
An issue was discovered in aubio 0.4.6. A buffer over-read can occur in new_aubio_pitchyinfft in pitch/pitchyinfft.c, as demonstrated by aubionotes.


definition_id: oval:org.debian:def:166505499242266435191003194504222425910
title: CVE-2018-14526 wpa
description:
An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive information.


definition_id: oval:org.debian:def:244258698727125361078194330792431242925
title: CVE-2018-14551 imagemagick
description:
The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption.


definition_id: oval:org.debian:def:69743100998071384334385819407999539230
title: CVE-2018-14567 libxml2
description:
libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.


definition_id: oval:org.debian:def:65707581973486196260358897182566508918
title: CVE-2018-14568 suricata
description:
Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. This allows detection bypass because Windows TCP clients proceed with normal processing of TCP data that arrives shortly after an RST (i.e., they act as if the RST had not yet been received).


definition_id: oval:org.debian:def:259105731231570186293011847619188135577
title: CVE-2018-14574 python-django
description:
django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.


definition_id: oval:org.debian:def:28092785593650592331626722819390573858
title: CVE-2018-14593 otrs2
description:
An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x through 4.0.30. An attacker who is logged into OTRS as an agent may escalate their privileges by accessing a specially crafted URL.


definition_id: oval:org.debian:def:176882510913530012169010681218112179070
title: CVE-2018-14598 libx11
description:
An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault).


definition_id: oval:org.debian:def:283240330750636376907928152290202240112
title: CVE-2018-14599 libx11
description:
An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact.


definition_id: oval:org.debian:def:110503696554548314668993596793440005590
title: CVE-2018-14600 libx11
description:
An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution.


definition_id: oval:org.debian:def:291328578002842160452851818012518601970
title: CVE-2018-14609 linux
description:
An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in __del_reloc_root() in fs/btrfs/relocation.c when mounting a crafted btrfs image, related to removing reloc rb_trees when reloc control has not been initialized.


definition_id: oval:org.debian:def:247817590668781275229822923341250323987
title: CVE-2018-14610 linux
description:
An issue was discovered in the Linux kernel through 4.17.10. There is out-of-bounds access in write_extent_buffer() when mounting and operating a crafted btrfs image, because of a lack of verification that each block group has a corresponding chunk at mount time, within btrfs_read_block_groups in fs/btrfs/extent-tree.c.


definition_id: oval:org.debian:def:8650350929461756630257053211455109137
title: CVE-2018-14611 linux
description:
An issue was discovered in the Linux kernel through 4.17.10. There is a use-after-free in try_merge_free_space() when mounting a crafted btrfs image, because of a lack of chunk type flag checks in btrfs_check_chunk_valid in fs/btrfs/volumes.c.


definition_id: oval:org.debian:def:9890071811722625364140434084733570602
title: CVE-2018-14612 linux
description:
An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in btrfs_root_node() when mounting a crafted btrfs image, because of a lack of chunk block group mapping validation in btrfs_read_block_groups in fs/btrfs/extent-tree.c, and a lack of empty-tree checks in check_leaf in fs/btrfs/tree-checker.c.


definition_id: oval:org.debian:def:227582602134936421800734668084929322555
title: CVE-2018-14613 linux
description:
An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in io_ctl_map_page() when mounting and operating a crafted btrfs image, because of a lack of block group item validation in check_leaf_item in fs/btrfs/tree-checker.c.


definition_id: oval:org.debian:def:313281047969408265750313411120178009014
title: CVE-2018-14614 linux
description:
An issue was discovered in the Linux kernel through 4.17.10. There is an out-of-bounds access in __remove_dirty_segment() in fs/f2fs/segment.c when mounting an f2fs image.


definition_id: oval:org.debian:def:213871134364637217845729890042210481608
title: CVE-2018-14615 linux
description:
An issue was discovered in the Linux kernel through 4.17.10. There is a buffer overflow in truncate_inline_inode() in fs/f2fs/inline.c when umounting an f2fs image, because a length value may be negative.


definition_id: oval:org.debian:def:330921959310147146719053465535634839912
title: CVE-2018-14616 linux
description:
An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference in fscrypt_do_page_crypto() in fs/crypto/crypto.c when operating on a file in a corrupted f2fs image.


definition_id: oval:org.debian:def:57140209622389297453259122058454698205
title: CVE-2018-14617 linux
description:
An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory.


definition_id: oval:org.debian:def:250657894595207926943760107013381857673
title: CVE-2018-14618 curl
description:
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)


definition_id: oval:org.debian:def:110053700321958338964673303537975790409
title: CVE-2018-14619 linux
description:
A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was being dropped when each af_alg_ctx was freed instead of when the aead_tfm was freed. This can cause the null skcipher to be freed while it is still in use leading to a local user being able to crash the system or possibly escalate privileges.


definition_id: oval:org.debian:def:75424977493736071698008520376394162474
title: CVE-2018-14622 libtirpc
description:
A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections.


definition_id: oval:org.debian:def:86456733366308793110025597093339691157
title: CVE-2018-14624 389-ds-base
description:
A vulnerability was discovered in 389-ds-base. The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(). An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash.


definition_id: oval:org.debian:def:153432508609377816948742217027218184068
title: CVE-2018-14625 linux
description:
A flaw was found where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly impersonate AF_VSOCK messages destined to other clients or leak kernel memory.


definition_id: oval:org.debian:def:254068214910217860313757106054115567476
title: CVE-2018-14626 pdns
description:
PowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 inclusive are vulnerable to a packet cache pollution via crafted query that can lead to denial of service.


definition_id: oval:org.debian:def:107954201655459907858181165574812140902
title: CVE-2018-14629 samba
description:
A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead to infinite recursion in the server. An unprivileged local attacker could create such an entry, leading to denial of service.


definition_id: oval:org.debian:def:251127451140856986471587159216979646281
title: CVE-2018-14633 linux
description:
A flaw was found in the ISCSI target code in the Linux kernel. The flaw allows an unauthenticated, remote attacker to cause a stack buffer overflow of 17 bytes of the stack. Depending on how the kernel was compiled (e.g. compiler, compile flags, and hardware architecture), the attack may lead to a system crash or access to data exported by an iSCSI target. Privilege escalation cannot be ruled out. The highest threat from this vulnerability is to system availability.


definition_id: oval:org.debian:def:143682645488134026655830122274074697023
title: CVE-2018-14634 linux
description:
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system.


definition_id: oval:org.debian:def:113344512013530360030441320560446601408
title: CVE-2018-14635 neutron
description:
When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3 and 11.0.5 are vulnerable.


definition_id: oval:org.debian:def:141496782566444570161531141467320971309
title: CVE-2018-14636 neutron
description:
Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due to the Open vSwitch integration bridge being connected to the instance during migration. When connected to the integration bridge, all traffic for instances using the same Open vSwitch instance would potentially be visible to the migrated guest, as the required Open vSwitch VLAN filters are only applied post-migration. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3, 11.0.5 are vulnerable.


definition_id: oval:org.debian:def:97504802905329901461545384248308563557
title: CVE-2018-14638 389-ds-base
description:
A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service.


definition_id: oval:org.debian:def:146083783098868793941147889097893951357
title: CVE-2018-14644 pdns-recursor
description:
An issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote attacker sending a DNS query for a meta-type like OPT can lead to a zone being wrongly cached as failing DNSSEC validation. It only arises if the parent zone is signed, and all the authoritative servers for that parent zone answer with FORMERR to a query for at least one of the meta-types. As a result, subsequent queries from clients requesting DNSSEC validation will be answered with a ServFail.


definition_id: oval:org.debian:def:179392858987893938227170757564097917485
title: CVE-2018-14645 haproxy
description:
A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service.


definition_id: oval:org.debian:def:294864269730698504044348504828155845726
title: CVE-2018-14647 python2.7
description:
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.


definition_id: oval:org.debian:def:244657264418338344412040243831973350449
title: CVE-2018-14648 389-ds-base
description:
A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthenticated attacker could use this flaw to provoke a denial of service.


definition_id: oval:org.debian:def:202188949969139117334581290859962325210
title: CVE-2018-14651 glusterfs
description:
It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete. A remote, authenticated attacker could use one of these flaws to execute arbitrary code, create arbitrary files, or cause denial of service on glusterfs server nodes via symlinks to relative paths.


definition_id: oval:org.debian:def:43122273027817332265293354306422004656
title: CVE-2018-14652 glusterfs
description:
A buffer overflow was found in strncpy of the pl_getxattr() function. An authenticated attacker could remotely overflow the buffer by sending a buffer of larger length than the size of the key resulting in remote denial of service.


definition_id: oval:org.debian:def:299995173769369670895452363703419876730
title: CVE-2018-14653 glusterfs
description:
A buffer overflow on the heap was found in gf_getspec_req RPC request. A remote, authenticated attacker could use this flaw to cause denial of service and read arbitrary files on glusterfs server node.


definition_id: oval:org.debian:def:638308681907662886125987249249989282
title: CVE-2018-14654 glusterfs
description:
A flaw was found in the way glusterfs server handles client requests. A remote, authenticated attacker could set arbitrary values for the GF_XATTROP_ENTRY_IN_KEY and GF_XATTROP_ENTRY_OUT_KEY during xattrop file operation resulting in creation and deletion of arbitrary files on glusterfs server node.


definition_id: oval:org.debian:def:272943326544993291444100576642327253852
title: CVE-2018-14656 linux
description:
A missing address check in the callers of the show_opcodes() in the Linux kernel allows an attacker to dump the kernel memory at an arbitrary kernel address into the dmesg log.


definition_id: oval:org.debian:def:234767881699433367460714463792319714988
title: CVE-2018-14659 glusterfs
description:
A flaw was found in glusterfs server which allowed clients to create io-stats dumps on server node. A remote, authenticated attacker could use this flaw to create io-stats dump on a server without any limitation and utilizing all available inodes resulting in remote denial of service.


definition_id: oval:org.debian:def:30740700257516035467980265620527704242
title: CVE-2018-14660 glusterfs
description:
A flaw was found in glusterfs server which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, authenticated attacker could use this flaw to create multiple locks for single inode by using setxattr repetitively resulting in memory exhaustion of glusterfs server node.


definition_id: oval:org.debian:def:5279215452510732738738424946062093130
title: CVE-2018-14661 glusterfs
description:
It was found that usage of snprintf function in feature/locks translator of glusterfs server was vulnerable to a format string attack. A remote, authenticated attacker could use this flaw to cause remote denial of service.


definition_id: oval:org.debian:def:145368000479036074822019123320391913534
title: CVE-2018-14662 ceph
description:
It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption.


definition_id: oval:org.debian:def:67611100039087409628884098877010740804
title: CVE-2018-14663 dnsdist
description:
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.


definition_id: oval:org.debian:def:82116643767146839094234397358866669322
title: CVE-2018-14665 xorg-server
description:
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.


definition_id: oval:org.debian:def:15464964677293360984883679735333917333
title: CVE-2018-14678 linux
description:
An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges.


definition_id: oval:org.debian:def:95435726178245498755783153500634512162
title: CVE-2018-14679 libmspack
description:
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash).


definition_id: oval:org.debian:def:80718577132335867146089492135190993956
title: CVE-2018-14680 libmspack
description:
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.


definition_id: oval:org.debian:def:104495565202508043490072939648842114169
title: CVE-2018-14681 libmspack
description:
An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.


definition_id: oval:org.debian:def:160587954554285403595274374465533385530
title: CVE-2018-14682 libmspack
description:
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression.


definition_id: oval:org.debian:def:215937250860906298613731727508672058039
title: CVE-2018-14718 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.


definition_id: oval:org.debian:def:196263023938817043748221484366979701995
title: CVE-2018-14719 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.


definition_id: oval:org.debian:def:58887979732699196256447086787593738426
title: CVE-2018-14720 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.


definition_id: oval:org.debian:def:93210263802733473065369764871954589370
title: CVE-2018-14721 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.


definition_id: oval:org.debian:def:176473738664053931822460197817243031059
title: CVE-2018-14722 btrfsmaintenance
description:
An issue was discovered in evaluate_auto_mountpoint in btrfsmaintenance-functions in btrfsmaintenance through 0.4.1. Code execution as root can occur via a specially crafted filesystem label if btrfs-{scrub,balance,trim} are set to auto in /etc/sysconfig/btrfsmaintenance (this is not the default, though).


definition_id: oval:org.debian:def:222900291127968277817226406641071344124
title: CVE-2018-14734 linux
description:
drivers/infiniband/core/ucma.c in the Linux kernel through 4.17.11 allows ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allows attackers to cause a denial of service (use-after-free).


definition_id: oval:org.debian:def:300532479360222882764395886331687788214
title: CVE-2018-14767 kamailio
description:
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag causes a segmentation fault and crash. The reason is missing input validation in the "build_res_buf_from_sip_req" core function. This could result in denial of service and potentially the execution of arbitrary code.


definition_id: oval:org.debian:def:216018343966954333170323791231386312077
title: CVE-2018-14773 symfony
description:
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.


definition_id: oval:org.debian:def:316824682950708232592860134308010723945
title: CVE-2018-14774 symfony
description:
An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. When using HttpCache, the values of the X-Forwarded-Host headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.


definition_id: oval:org.debian:def:134026052531650559993037828056715606185
title: CVE-2018-14912 cgit
description:
cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.


definition_id: oval:org.debian:def:328844259209896035357854236828039256857
title: CVE-2018-14938 tcpflow
description:
An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha. There is an integer overflow in the function handle_prism during caplen processing. If the caplen is less than 144, one can cause an integer overflow in the function handle_80211, which will result in an out-of-bounds read and may allow access to sensitive memory (or a denial of service).


definition_id: oval:org.debian:def:78835686162589603420477973275585236265
title: CVE-2018-15120 pango1.0
description:
libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.


definition_id: oval:org.debian:def:107743507796146089720384304854817157220
title: CVE-2018-15126 libvncserver
description:
LibVNC before commit 73cb96fec028a576a5a24417b57723b55854ad7b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution


definition_id: oval:org.debian:def:257188313856440977468441728409396241375
title: CVE-2018-15127 libvncserver
description:
LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server code of file transfer extension that can result remote code execution


definition_id: oval:org.debian:def:93352493455765879327294590425005415431
title: CVE-2018-15209 tiff
description:
ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf.


definition_id: oval:org.debian:def:169996787007791448569947461534500029932
title: CVE-2018-15378 clamav
description:
A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker to cause a denial of service (DoS) condition. The vulnerability is due to an error related to the MEW unpacker within the "unmew11()" function (libclamav/mew.c), which can be exploited to trigger an invalid read memory access via a specially crafted EXE file.


definition_id: oval:org.debian:def:189028842372866524874914496802310867847
title: CVE-2018-15468 xen
description:
An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests. Unfortunately, in the case that vPMU is disabled, all value checking was skipped, allowing the guest to choose any MSR_DEBUGCTL setting it likes. A malicious or buggy guest administrator (on Intel x86 HVM or PVH) can lock up the entire host, causing a Denial of Service.


definition_id: oval:org.debian:def:151539037856381966999828091445828191928
title: CVE-2018-15469 xen
description:
An issue was discovered in Xen through 4.11.x. ARM never properly implemented grant table v2, either in the hypervisor or in Linux. Unfortunately, an ARM guest can still request v2 grant tables; they will simply not be properly set up, resulting in subsequent grant-related hypercalls hitting BUG() checks. An unprivileged guest can cause a BUG() check in the hypervisor, resulting in a denial-of-service (crash).


definition_id: oval:org.debian:def:209046853711663067516584972700355652678
title: CVE-2018-15470 xen
description:
An issue was discovered in Xen through 4.11.x. The logic in oxenstored for handling writes depended on the order of evaluation of expressions making up a tuple. As indicated in section 7.7.3 "Operations on data structures" of the OCaml manual, the order of evaluation of subexpressions is not specified. In practice, different implementations behave differently. Thus, oxenstored may not enforce the configured quota-maxentity. This allows a malicious or buggy guest to write as many xenstore entries as it wishes, causing unbounded memory usage in oxenstored. This can lead to a system-wide DoS.


definition_id: oval:org.debian:def:40943434812812924054286059054605238696
title: CVE-2018-15471 linux
description:
An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks.


definition_id: oval:org.debian:def:35317030629259448364361911267901449760
title: CVE-2018-15473 openssh
description:
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.


definition_id: oval:org.debian:def:226980732731817178306793634195605910568
title: CVE-2018-15501 libgit2
description:
In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker can send a crafted smart-protocol "ng" packet that lacks a '\0' byte to trigger an out-of-bounds read that leads to DoS.


definition_id: oval:org.debian:def:260282644913454990116025279342847430921
title: CVE-2018-15518 qt4-x11
description:
QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document.


definition_id: oval:org.debian:def:265318932220336969552824946630522518859
title: CVE-2018-15572 linux
description:
The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a context switch, which makes it easier for attackers to conduct userspace-userspace spectreRSB attacks.


definition_id: oval:org.debian:def:168147008689769658242193247176396885424
title: CVE-2018-15586 enigmail
description:
Enigmail before 2.0.6 is prone to to OpenPGP signatures being spoofed for arbitrary messages using a PGP/INLINE signature wrapped within a specially crafted multipart HTML email.


definition_id: oval:org.debian:def:223640996888606940275031999449182015989
title: CVE-2018-15587 evolution
description:
GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment.


definition_id: oval:org.debian:def:329237932938993234297204034481972339868
title: CVE-2018-15594 linux
description:
arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests.


definition_id: oval:org.debian:def:335097707547062119336954969531094984102
title: CVE-2018-15599 dropbear
description:
The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.


definition_id: oval:org.debian:def:47825343654292734270796119951476827391
title: CVE-2018-15664 docker.io
description:
In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).


definition_id: oval:org.debian:def:296345761534529196477506496623203731224
title: CVE-2018-15686 systemd
description:
A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.


definition_id: oval:org.debian:def:234378261886492119761609498629387676717
title: CVE-2018-15687 systemd
description:
A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.


definition_id: oval:org.debian:def:318380088254483211529335817372929283203
title: CVE-2018-15688 network-manager
description:
A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239.


definition_id: oval:org.debian:def:309592182992544877584872820837855288453
title: CVE-2018-15746 qemu
description:
qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread.


definition_id: oval:org.debian:def:194409413584220040469197983977995899104
title: CVE-2018-15750 salt
description:
Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.


definition_id: oval:org.debian:def:44598970586377554338244849120473283417
title: CVE-2018-15751 salt
description:
SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).


definition_id: oval:org.debian:def:32683432700535115725853709252542376053
title: CVE-2018-15756 libspring-java
description:
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.


definition_id: oval:org.debian:def:277471511792591111065452180749721876487
title: CVE-2018-15822 ffmpeg
description:
The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.


definition_id: oval:org.debian:def:334480437359177109067077845455469924683
title: CVE-2018-15853 libxkbcommon
description:
Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation.


definition_id: oval:org.debian:def:273655683319739369352436609205148770331
title: CVE-2018-15854 libxkbcommon
description:
Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly.


definition_id: oval:org.debian:def:200959887025605949036863227091445607092
title: CVE-2018-15855 libxkbcommon
description:
Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled.


definition_id: oval:org.debian:def:246699064392233513062747300794242315781
title: CVE-2018-15856 libxkbcommon
description:
An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted keymap files.


definition_id: oval:org.debian:def:197017860524512861484083950999578135622
title: CVE-2018-15857 libxkbcommon
description:
An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file.


definition_id: oval:org.debian:def:162436496796894955624928470537149612237
title: CVE-2018-15858 libxkbcommon
description:
Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file.


definition_id: oval:org.debian:def:252759787531828478153288353848772072001
title: CVE-2018-15859 libxkbcommon
description:
Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled.


definition_id: oval:org.debian:def:328906387219086505456418329600817835018
title: CVE-2018-15861 libxkbcommon
description:
Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure.


definition_id: oval:org.debian:def:70597678791028330755817397989681759474
title: CVE-2018-15862 libxkbcommon
description:
Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers.


definition_id: oval:org.debian:def:136262307489108979388734290174457213384
title: CVE-2018-15863 libxkbcommon
description:
Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression.


definition_id: oval:org.debian:def:19630698694119897093403297911369567909
title: CVE-2018-15864 libxkbcommon
description:
Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created.


definition_id: oval:org.debian:def:336228538556430737564073272552852200514
title: CVE-2018-15869 packer
description:
An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.


definition_id: oval:org.debian:def:239820814523343416199730930825679102410
title: CVE-2018-15908 ghostscript
description:
In Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply malicious PostScript files to bypass .tempfile restrictions and write files.


definition_id: oval:org.debian:def:165952815455063097244385296024673195229
title: CVE-2018-15909 ghostscript
description:
In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code.


definition_id: oval:org.debian:def:36075184861316535069075857842281927440
title: CVE-2018-15910 ghostscript
description:
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or execute code.


definition_id: oval:org.debian:def:67464217675240246371612135379334425350
title: CVE-2018-15911 ghostscript
description:
In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code.


definition_id: oval:org.debian:def:277605762764597982812700754726832790798
title: CVE-2018-16056 wireshark
description:
In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth Attribute Protocol dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by verifying that a dissector for a specific UUID exists.


definition_id: oval:org.debian:def:123564126589766094715829067489701286171
title: CVE-2018-16057 wireshark
description:
In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Radiotap dissector could crash. This was addressed in epan/dissectors/packet-ieee80211-radiotap-iter.c by validating iterator operations.


definition_id: oval:org.debian:def:72617126826818912578005462889212268525
title: CVE-2018-16058 wireshark
description:
In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth AVDTP dissector could crash. This was addressed in epan/dissectors/packet-btavdtp.c by properly initializing a data structure.


definition_id: oval:org.debian:def:22028881558686988183198610504306811502
title: CVE-2018-16062 elfutils
description:
dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.


definition_id: oval:org.debian:def:21750834770982952955574257247501005912
title: CVE-2018-16140 fig2dev
description:
A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer via a crafted .fig file.


definition_id: oval:org.debian:def:156941770441869943266739313127908053827
title: CVE-2018-16151 strongswan
description:
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data after the encoded algorithm OID during PKCS#1 v1.5 signature verification. Similar to the flaw in the same version of strongSwan regarding digestAlgorithm.parameters, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication.


definition_id: oval:org.debian:def:272277399717865495251144466376651379506
title: CVE-2018-16152 strongswan
description:
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. This is a variant of CVE-2006-4790 and CVE-2014-1568.


definition_id: oval:org.debian:def:270122966132781823988445223887851463370
title: CVE-2018-16276 linux
description:
An issue was discovered in yurex_read in drivers/usb/misc/yurex.c in the Linux kernel before 4.17.7. Local attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to crash the kernel or potentially escalate privileges.


definition_id: oval:org.debian:def:171368436149742960743901600077779280815
title: CVE-2018-16323 imagemagick
description:
ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If the affected code is used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data.


definition_id: oval:org.debian:def:241018246310519931463937889651492992261
title: CVE-2018-16328 imagemagick
description:
In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c.


definition_id: oval:org.debian:def:192486633987228518627269444977259014236
title: CVE-2018-16335 tiff
description:
newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209.


definition_id: oval:org.debian:def:52244671730504029052012221945532056747
title: CVE-2018-16336 exiv2
description:
Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, a different vulnerability than CVE-2018-10999.


definition_id: oval:org.debian:def:199999066793551849459028336202616906756
title: CVE-2018-16384 modsecurity-crs
description:
A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as "if") and b is the SQL statement to be executed.


definition_id: oval:org.debian:def:337167228231191211414993255061926219538
title: CVE-2018-16391 opensc
description:
Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:233052912372108218808138191521552097587
title: CVE-2018-16392 opensc
description:
Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:302576250367177351162104251656504048524
title: CVE-2018-16393 opensc
description:
Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:293705097971994366008579208956620338955
title: CVE-2018-16395 ruby2.5
description:
An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.


definition_id: oval:org.debian:def:155039254708243513215029191234233770940
title: CVE-2018-16396 ruby2.5
description:
An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.


definition_id: oval:org.debian:def:260864407014610909275833297579549084129
title: CVE-2018-16402 elfutils
description:
libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.


definition_id: oval:org.debian:def:178721780323830765194991713270725311442
title: CVE-2018-16403 elfutils
description:
libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.


definition_id: oval:org.debian:def:221099899031679155021905788261991581371
title: CVE-2018-16412 imagemagick
description:
ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the coders/psd.c ParseImageResourceBlocks function.


definition_id: oval:org.debian:def:36091415930722085271882921769147269695
title: CVE-2018-16413 imagemagick
description:
ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the MagickCore/quantum-private.h PushShortPixel function when called from the coders/psd.c ParseImageResourceBlocks function.


definition_id: oval:org.debian:def:320321133006013162726640557587739873163
title: CVE-2018-16418 opensc
description:
A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:299010312102961643524477123269693674226
title: CVE-2018-16419 opensc
description:
Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:332259628074998775234092656625048605928
title: CVE-2018-16420 opensc
description:
Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:271283594486990090363881829678764229604
title: CVE-2018-16421 opensc
description:
Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:144542839992064944275465542302756798329
title: CVE-2018-16422 opensc
description:
A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:336748240273422412581877148439175563577
title: CVE-2018-16423 opensc
description:
A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:177677504007570293378270795238304929755
title: CVE-2018-16424 opensc
description:
A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:67394255793039339358010328800351188736
title: CVE-2018-16425 opensc
description:
A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:67614845698145000268180166866152573537
title: CVE-2018-16426 opensc
description:
Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs.


definition_id: oval:org.debian:def:276166659197413054992518712591942653131
title: CVE-2018-16427 opensc
description:
Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs.


definition_id: oval:org.debian:def:3884562706468914294460424600690334401
title: CVE-2018-16428 glib2.0
description:
In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference.


definition_id: oval:org.debian:def:39128940748236307149308270508631493296
title: CVE-2018-16429 glib2.0
description:
GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf8_str().


definition_id: oval:org.debian:def:74290192027878260588076810469874501638
title: CVE-2018-16430 libextractor
description:
GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR_zip_extract_method() in zip_extractor.c.


definition_id: oval:org.debian:def:178354412470486091907279806060058511661
title: CVE-2018-16435 lcms2
description:
Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile.


definition_id: oval:org.debian:def:166910172767609673488016817675589034220
title: CVE-2018-16468 ruby-loofah
description:
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.


definition_id: oval:org.debian:def:30197523456887037642642029052884716663
title: CVE-2018-16471 ruby-rack
description:
There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.


definition_id: oval:org.debian:def:301959616265790297418249177852880058125
title: CVE-2018-16472 node-cached-path-relative
description:
A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are then inherited by all the JS objects through the prototype chain causing a DoS attack.


definition_id: oval:org.debian:def:5287179452974687507321726710521581477
title: CVE-2018-16476 rails
description:
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.


definition_id: oval:org.debian:def:271072244769909858550768629991603574595
title: CVE-2018-16477 rails
description:
A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path. This vulnerability has been fixed in version 5.2.1.1.


definition_id: oval:org.debian:def:134192438707702142175381887393796898505
title: CVE-2018-16487 node-lodash
description:
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.


definition_id: oval:org.debian:def:263478403596955683939673596512674272815
title: CVE-2018-16491 node-extend
description:
A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.


definition_id: oval:org.debian:def:326528672775063663356962829108641458228
title: CVE-2018-16492 node-extend
description:
A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.


definition_id: oval:org.debian:def:101599911611844277409661842602330575051
title: CVE-2018-16509 ghostscript
description:
An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.


definition_id: oval:org.debian:def:26244881848191731841269396545793816453
title: CVE-2018-16510 ghostscript
description:
An issue was discovered in Artifex Ghostscript before 9.24. Incorrect exec stack handling in the "CS" and "SC" PDF primitives could be used by remote attackers able to supply crafted PDFs to crash the interpreter or possibly have unspecified other impact.


definition_id: oval:org.debian:def:183524947278458197186354664378684827900
title: CVE-2018-16511 ghostscript
description:
An issue was discovered in Artifex Ghostscript before 9.24. A type confusion in "ztype" could be used by remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact.


definition_id: oval:org.debian:def:156673161784713897236693088822505046730
title: CVE-2018-16513 ghostscript
description:
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to crash the interpreter or possibly have unspecified other impact.


definition_id: oval:org.debian:def:108426047586047954153582702171454890399
title: CVE-2018-16517 nasm
description:
asm/labels.c in Netwide Assembler (NASM) is prone to NULL Pointer Dereference, which allows the attacker to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:67619830521481468372390596745319493020
title: CVE-2018-16539 ghostscript
description:
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.


definition_id: oval:org.debian:def:147496382623778521948004121130302367503
title: CVE-2018-16540 ghostscript
description:
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-free in copydevice handling to crash the interpreter or possibly have unspecified other impact.


definition_id: oval:org.debian:def:58196344390727103599600123828543022946
title: CVE-2018-16541 ghostscript
description:
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replacement to crash the interpreter.


definition_id: oval:org.debian:def:68001471505338130632488892797320358940
title: CVE-2018-16542 ghostscript
description:
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use insufficient interpreter stack-size checking during error handling to crash the interpreter.


definition_id: oval:org.debian:def:101995449210021899998543793330714690768
title: CVE-2018-16543 ghostscript
description:
In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact.


definition_id: oval:org.debian:def:48809177638357166144582891283707154234
title: CVE-2018-16548 zziplib
description:
An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_directory in zip.c, which will lead to a denial of service attack.


definition_id: oval:org.debian:def:103783542256645691419316131828407683380
title: CVE-2018-16554 jhead
description:
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because of inconsistency between float and double in a sprintf format string during TAG_GPS_ALT handling.


definition_id: oval:org.debian:def:313669434499120304320966060316121788301
title: CVE-2018-16585 ghostscript
description:
** DISPUTED ** An issue was discovered in Artifex Ghostscript before 9.24. The .setdistillerkeys PostScript command is accepted even though it is not intended for use during document processing (e.g., after the startup phase). This leads to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact. Note: A reputable source believes that the CVE is potentially a duplicate of CVE-2018-15910 as explained in Red Hat bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1626193).


definition_id: oval:org.debian:def:314777864070314473735210164871967464132
title: CVE-2018-16586 otrs2
description:
In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources.


definition_id: oval:org.debian:def:91607374666939973781202852205232916419
title: CVE-2018-16587 otrs2
description:
In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a user with admin permissions opens it, it causes deletions of arbitrary files that the OTRS web server user has write access to.


definition_id: oval:org.debian:def:255903541739276466565587167124521441038
title: CVE-2018-16597 linux
description:
An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem.


definition_id: oval:org.debian:def:126212779507328826648529566821676111334
title: CVE-2018-16640 imagemagick
description:
ImageMagick 7.0.8-5 has a memory leak vulnerability in the function ReadOneJNGImage in coders/png.c.


definition_id: oval:org.debian:def:164312663512173275551291419788235627050
title: CVE-2018-16642 imagemagick
description:
The function InsertRow in coders/cut.c in ImageMagick 7.0.7-37 allows remote attackers to cause a denial of service via a crafted image file due to an out-of-bounds write.


definition_id: oval:org.debian:def:275577195043889985751495479716275802549
title: CVE-2018-16643 imagemagick
description:
The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in coders/pwp.c, ReadCALSImage in coders/cals.c, and ReadPICTImage in coders/pict.c in ImageMagick 7.0.8-4 do not check the return value of the fputc function, which allows remote attackers to cause a denial of service via a crafted image file.


definition_id: oval:org.debian:def:43729248278418464498997136338473055310
title: CVE-2018-16644 imagemagick
description:
There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image.


definition_id: oval:org.debian:def:245071574777781615987075623282908641942
title: CVE-2018-16645 imagemagick
description:
There is an excessive memory allocation issue in the functions ReadBMPImage of coders/bmp.c and ReadDIBImage of coders/dib.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image file.


definition_id: oval:org.debian:def:73825066468805898049258185963012751710
title: CVE-2018-16646 poppler
description:
In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack.


definition_id: oval:org.debian:def:118768766200484617552112455420230479249
title: CVE-2018-16647 mupdf
description:
In Artifex MuPDF 1.13.0, the pdf_get_xref_entry function in pdf/pdf-xref.c allows remote attackers to cause a denial of service (segmentation fault in fz_write_data in fitz/output.c) via a crafted pdf file.


definition_id: oval:org.debian:def:251305231026386665177116772645222978015
title: CVE-2018-16648 mupdf
description:
In Artifex MuPDF 1.13.0, the fz_append_byte function in fitz/buffer.c allows remote attackers to cause a denial of service (segmentation fault) via a crafted pdf file. This is caused by a pdf/pdf-device.c pdf_dev_alpha array-index underflow.


definition_id: oval:org.debian:def:17291434438909073798899890553473395672
title: CVE-2018-16657 kamailio
description:
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with an invalid Via header causes a segmentation fault and crashes Kamailio. The reason is missing input validation in the crcitt_string_array core function for calculating a CRC hash for To tags. (An additional error is present in the check_via_address core function: this function also misses input validation.) This could result in denial of service and potentially the execution of arbitrary code.


definition_id: oval:org.debian:def:248354859838393389209142861792800329911
title: CVE-2018-16658 linux
description:
An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940.


definition_id: oval:org.debian:def:321511910772871818660082732846583683654
title: CVE-2018-16738 tinc
description:
tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1.


definition_id: oval:org.debian:def:297887878350743559910582369056944405592
title: CVE-2018-16741 mgetty
description:
An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent command injection. It is possible to use the ||, &&, or > characters within a file created by the "faxq-helper activate <jobid>" command.


definition_id: oval:org.debian:def:198839925008747568281536834325590118727
title: CVE-2018-16742 mgetty
description:
An issue was discovered in mgetty before 1.2.1. In contrib/scrts.c, a stack-based buffer overflow can be triggered via a command-line parameter.


definition_id: oval:org.debian:def:261594111476862074176873702080222661651
title: CVE-2018-16743 mgetty
description:
An issue was discovered in mgetty before 1.2.1. In contrib/next-login/login.c, the command-line parameter username is passed unsanitized to strcpy(), which can cause a stack-based buffer overflow.


definition_id: oval:org.debian:def:63516309664851016469080822787320204217
title: CVE-2018-16744 mgetty
description:
An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c, the mail_to parameter is not sanitized. It could allow for command injection if untrusted input can reach it, because popen is used.


definition_id: oval:org.debian:def:116623750713096112885953019420820224606
title: CVE-2018-16745 mgetty
description:
An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c, the mail_to parameter is not sanitized. It could allow a buffer overflow if long untrusted input can reach it.


definition_id: oval:org.debian:def:247978512709235511651369526245016395258
title: CVE-2018-16749 imagemagick
description:
In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file.


definition_id: oval:org.debian:def:69099394035654780306619958769601561007
title: CVE-2018-16750 imagemagick
description:
In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c was found.


definition_id: oval:org.debian:def:285436636312399186601979383145059379796
title: CVE-2018-16758 tinc
description:
Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the encryption of VPN packets.


definition_id: oval:org.debian:def:148560356995115768687538202651112144850
title: CVE-2018-16789 shellinabox
description:
libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop, exhausting available CPU resources and taking the service down.


definition_id: oval:org.debian:def:268491365875259238368006444068748738369
title: CVE-2018-16790 mongo-c-driver
description:
_bson_iter_next_internal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer.


definition_id: oval:org.debian:def:183391582794915276499421235379874093352
title: CVE-2018-16802 ghostscript
description:
An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509.


definition_id: oval:org.debian:def:195616078766245429214102394964455938246
title: CVE-2018-16807 bro
description:
In Bro through 2.5.5, there is a memory leak potentially leading to DoS in scripts/base/protocols/krb/main.bro in the Kerberos protocol parser.


definition_id: oval:org.debian:def:12071205400783628416909484299506007550
title: CVE-2018-16831 smarty3
description:
Smarty before 3.1.33-dev-4 allows attackers to bypass the trusted_dir protection mechanism via a file:./../ substring in an include statement.


definition_id: oval:org.debian:def:43921940227707906144430998093888841995
title: CVE-2018-16837 ansible
description:
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.


definition_id: oval:org.debian:def:282706887173152681270924207742728665430
title: CVE-2018-16839 curl
description:
Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.


definition_id: oval:org.debian:def:88637988360999662969641709536541145004
title: CVE-2018-16840 curl
description:
A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.


definition_id: oval:org.debian:def:329260191734643632759894434868294740071
title: CVE-2018-16841 samba
description:
Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process.


definition_id: oval:org.debian:def:330017445253273813590157678631615200875
title: CVE-2018-16842 curl
description:
Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.


definition_id: oval:org.debian:def:107929754620265822615397311710361307327
title: CVE-2018-16843 nginx
description:
nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.


definition_id: oval:org.debian:def:62078222752025133972509869398719151395
title: CVE-2018-16844 nginx
description:
nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.


definition_id: oval:org.debian:def:230349431661203927950730828069342149875
title: CVE-2018-16845 nginx
description:
nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module.


definition_id: oval:org.debian:def:312179261936992781902693536459128621830
title: CVE-2018-16846 ceph
description:
It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices.


definition_id: oval:org.debian:def:154593305130968912369951862258801953804
title: CVE-2018-16847 qemu
description:
An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.


definition_id: oval:org.debian:def:288454092547039669968957938717223958861
title: CVE-2018-16849 mistral
description:
A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.


definition_id: oval:org.debian:def:116019794060338552645219719933404654201
title: CVE-2018-16850 postgresql-11
description:
postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.


definition_id: oval:org.debian:def:305882186469304061788911768500601622586
title: CVE-2018-16851 samba
description:
Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this size is reached, the Samba process providing the LDAP service will follow the NULL pointer, terminating the process. There is no further vulnerability associated with this issue, merely a denial of service.


definition_id: oval:org.debian:def:38889055607936727941846323503107936510
title: CVE-2018-16852 samba
description:
Samba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference. During the processing of an DNS zone in the DNS management DCE/RPC server, the internal DNS server or the Samba DLZ plugin for BIND9, if the DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS property is set, the server will follow a NULL pointer and terminate. There is no further vulnerability associated with this issue, merely a denial of service.


definition_id: oval:org.debian:def:226999977525237233517505751926937734421
title: CVE-2018-16853 samba
description:
Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore the Samba Team will not issue security patches for this configuration. Additionally, Samba 4.7.12, 4.8.7 and 4.9.3 have been issued as security releases to prevent building of the AD DC with MIT Kerberos unless --with-experimental-mit-ad-dc is specified to the configure command.


definition_id: oval:org.debian:def:291283759912073204939060066414896379632
title: CVE-2018-16855 pdns-recursor
description:
An issue has been found in PowerDNS Recursor before version 4.1.8 where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of the query for a packet cache lookup, possibly leading to a crash.


definition_id: oval:org.debian:def:107385546737089414544243726270057217945
title: CVE-2018-16857 samba
description:
Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been upgraded from Samba 4.8 and earlier. In these cases the manual testing done to confirm an organisation's password policies apply as expected may not have been re-done after the upgrade.


definition_id: oval:org.debian:def:49931845900539838752082673342125930305
title: CVE-2018-16858 libreoffice
description:
It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location.


definition_id: oval:org.debian:def:260079299384825025087729837784490430338
title: CVE-2018-16860 heimdal
description:
A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC effectively obtaining a ticket for that principal.


definition_id: oval:org.debian:def:52382945320678644326776497137516950211
title: CVE-2018-16862 linux
description:
A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one.


definition_id: oval:org.debian:def:86382003145915612431941511100111958604
title: CVE-2018-16864 systemd
description:
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate privileges.


definition_id: oval:org.debian:def:194539536110917138790586644177008944136
title: CVE-2018-16865 systemd
description:
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges.


definition_id: oval:org.debian:def:80259334505420205615980390374881932718
title: CVE-2018-16866 systemd
description:
An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data.


definition_id: oval:org.debian:def:252306237964515932409523931577453075066
title: CVE-2018-16867 qemu
description:
A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/usb/dev-mtp.c due to an improper filename sanitization. When the guest device is mounted in read-write mode, this allows to read/write arbitrary files which may lead do DoS scenario OR possibly lead to code execution on the host.


definition_id: oval:org.debian:def:215110956828524918777194383679699249562
title: CVE-2018-16868 gnutls28
description:
A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.


definition_id: oval:org.debian:def:218907920697943041662601240445433329565
title: CVE-2018-16869 nettle
description:
A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.


definition_id: oval:org.debian:def:214606557766591732780588702283252410142
title: CVE-2018-16871 linux
description:
A flaw was found in the Linux kernel's NFS implementation. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.


definition_id: oval:org.debian:def:192957750862638677639341349576891357668
title: CVE-2018-16872 qemu
description:
A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS.


definition_id: oval:org.debian:def:132483408194125012917691173676012399159
title: CVE-2018-16873 golang-1.11
description:
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".


definition_id: oval:org.debian:def:84783535592593150547519591132918870481
title: CVE-2018-16874 golang-1.11
description:
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.


definition_id: oval:org.debian:def:267443097158484621998617528585592218813
title: CVE-2018-16875 golang-1.11
description:
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.


definition_id: oval:org.debian:def:186032832457124686035405663673753985025
title: CVE-2018-16876 ansible
description:
ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.


definition_id: oval:org.debian:def:185547888670099410623944182371197649519
title: CVE-2018-16877 pacemaker
description:
A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.


definition_id: oval:org.debian:def:154580395963118077565407532543163111760
title: CVE-2018-16878 pacemaker
description:
A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS


definition_id: oval:org.debian:def:6875880911452110745216674684909409509
title: CVE-2018-16880 linux
description:
A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.


definition_id: oval:org.debian:def:318940809416613103571091433160714015541
title: CVE-2018-16881 rsyslog
description:
A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions before 8.27.0 are vulnerable.


definition_id: oval:org.debian:def:244662932365118173123514518485459877476
title: CVE-2018-16882 linux
description:
A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before 4.14.91 and before 4.19.13 are vulnerable.


definition_id: oval:org.debian:def:337938829191735199021183315221993541509
title: CVE-2018-16884 linux
description:
A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.


definition_id: oval:org.debian:def:229026037803245385265662311374665363143
title: CVE-2018-16885 linux
description:
A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and buffer length. This can cause a read beyond the buffer boundaries flaw and, in certain cases, cause a memory access fault and a system halt by accessing invalid memory address.


definition_id: oval:org.debian:def:216442394396911566619862355276573607362
title: CVE-2018-16886 etcd
description:
etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.


definition_id: oval:org.debian:def:69659008800048344686144774461096831216
title: CVE-2018-16888 systemd
description:
It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.


definition_id: oval:org.debian:def:3439850826334446854536261775792577036
title: CVE-2018-16889 ceph
description:
It was found that Ceph RGW did not properly sanitize encryption keys in debug logging for v4 auth. Encryption keys could be inadvertently disclosed when sharing debug logs.


definition_id: oval:org.debian:def:96276125973239817322714982519281835395
title: CVE-2018-16890 curl
description:
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.


definition_id: oval:org.debian:def:187701237599217473194870752885406375404
title: CVE-2018-16947 openafs
description:
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database. For example, an unauthenticated attacker can replace any volume's content with arbitrary data.


definition_id: oval:org.debian:def:164628150585861288291120157513819178659
title: CVE-2018-16948 openafs
description:
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. For example, RXAFSCB_TellMeAboutYourself leaks kernel memory and KAM_ListEntry leaks kaserver memory.


definition_id: oval:org.debian:def:233054098847377626954106231375398216416
title: CVE-2018-16949 openafs
description:
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.


definition_id: oval:org.debian:def:4876628308054079561398438692712675085
title: CVE-2018-16976 gitolite3
description:
Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access.


definition_id: oval:org.debian:def:68985213652350306665652471378364930235
title: CVE-2018-16981 libstb
description:
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.


definition_id: oval:org.debian:def:180828539045311524875441948141888297777
title: CVE-2018-16999 nasm
description:
Netwide Assembler (NASM) 2.14rc15 has an invalid memory write (segmentation fault) in expand_smacro in preproc.c, which allows attackers to cause a denial of service via a crafted input file.


definition_id: oval:org.debian:def:173919117669990171324591479836606636186
title: CVE-2018-17000 tiff
description:
A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp.


definition_id: oval:org.debian:def:137680766443511680094299621508266079299
title: CVE-2018-17019 bro
description:
In Bro through 2.5.5, there is a DoS in IRC protocol names command parsing in analyzer/protocol/irc/IRC.cc.


definition_id: oval:org.debian:def:35198542239214648063945807718502314517
title: CVE-2018-17082 php7.3
description:
The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.


definition_id: oval:org.debian:def:187326486948136116164795647644254111725
title: CVE-2018-17088 jhead
description:
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is unrelated to the CVE-2018-16554 gpsinfo.c vulnerability.


definition_id: oval:org.debian:def:48984828742797383626113655573858644083
title: CVE-2018-17095 audiofile
description:
An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.


definition_id: oval:org.debian:def:83557737131151803096111855115212015764
title: CVE-2018-17096 soundtouch
description:
The BPMDetect class in BPMDetect.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (assertion failure and application exit), as demonstrated by SoundStretch.


definition_id: oval:org.debian:def:60310297698200466054286093978334426700
title: CVE-2018-17097 soundtouch
description:
The WavFileBase class in WavFile.cpp in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (double free) or possibly have unspecified other impact, as demonstrated by SoundStretch.


definition_id: oval:org.debian:def:297536232033998854700606886588652712877
title: CVE-2018-17098 soundtouch
description:
The WavFileBase class in WavFile.cpp in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (heap corruption from size inconsistency) or possibly have unspecified other impact, as demonstrated by SoundStretch.


definition_id: oval:org.debian:def:112735705891271778632125900020041211087
title: CVE-2018-17100 tiff
description:
An issue was discovered in LibTIFF 4.0.9. There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file.


definition_id: oval:org.debian:def:277798792474055829384918224792306401771
title: CVE-2018-17101 tiff
description:
An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.


definition_id: oval:org.debian:def:336074820767206740064599192853393250933
title: CVE-2018-17141 hylafax
description:
HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled, which is mishandled in FaxModem::writeECMData() in the faxd/CopyQuality.c++ file.


definition_id: oval:org.debian:def:69440913980095465242081065499783511791
title: CVE-2018-17175 python-marshmallow
description:
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").


definition_id: oval:org.debian:def:100734311075978199344352802306372378333
title: CVE-2018-17182 linux
description:
An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations.


definition_id: oval:org.debian:def:7335508605277543357229114279136692706
title: CVE-2018-17183 ghostscript
description:
Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code.


definition_id: oval:org.debian:def:338347368415190128826733905406058527885
title: CVE-2018-17187 qpid-proton
description:
The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with options to configure this explicitly or select a certificate verification mode with or without hostname verification being performed. The latter hostname verifying mode was not implemented in Apache Qpid Proton-J versions 0.3 to 0.29.0, with attempts to use it resulting in an exception. This left only the option to verify the certificate is trusted, leaving such a client vulnerable to Man In The Middle (MITM) attack. Uses of the Proton-J protocol engine which do not utilise the optional transport TLS wrapper are not impacted, e.g. usage within Qpid JMS. Uses of Proton-J utilising the optional transport TLS wrapper layer that wish to enable hostname verification must be upgraded to version 0.30.0 or later and utilise the VerifyMode#VERIFY_PEER_NAME configuration, which is now the default for client mode usage unless configured otherwise.


definition_id: oval:org.debian:def:105344729996107481723975070077891392521
title: CVE-2018-17189 apache2
description:
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.


definition_id: oval:org.debian:def:144945885026096927441647562924420927559
title: CVE-2018-17197 tika
description:
A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.


definition_id: oval:org.debian:def:286676228638507927863569649067352178609
title: CVE-2018-17199 apache2
description:
In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.


definition_id: oval:org.debian:def:51024560795116406021844784986523986222
title: CVE-2018-17204 openvswitch
description:
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c. When decoding a group mod, it validates the group type and command after the whole group mod has been decoded. The OF1.5 decoder, however, tries to use the type and command earlier, when it might still be invalid. This causes an assertion failure (via OVS_NOT_REACHED). ovs-vswitchd does not enable support for OpenFlow 1.5 by default.


definition_id: oval:org.debian:def:83510258029149906706407018570185299018
title: CVE-2018-17205 openvswitch
description:
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c. During bundle commit, flows that are added in a bundle are applied to ofproto in order. If a flow cannot be added (e.g., the flow action is a go-to for a group id that does not exist), OvS tries to revert back all previous flows that were successfully applied from the same bundle. This is possible since OvS maintains list of old flows that were replaced by flows from the bundle. While reinserting old flows, OvS has an assertion failure due to a check on rule state != RULE_INITIALIZED. This would work for new flows, but for an old flow the rule state is RULE_REMOVED. The assertion failure causes an OvS crash.


definition_id: oval:org.debian:def:40010341393978286072806607866356771938
title: CVE-2018-17206 openvswitch
description:
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6. The decode_bundle function inside lib/ofp-actions.c is affected by a buffer over-read issue during BUNDLE action decoding.


definition_id: oval:org.debian:def:138342655343714516087062252489600671251
title: CVE-2018-17281 asterisk
description:
There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.


definition_id: oval:org.debian:def:49208366220835469210978858117985825348
title: CVE-2018-17294 liblouis
description:
The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's length, allowing attackers to cause a denial of service (application crash via out-of-bounds read) by crafting an input file with certain translation dictionaries.


definition_id: oval:org.debian:def:223171707712587208106411810810351627924
title: CVE-2018-17336 udisks2
description:
UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.


definition_id: oval:org.debian:def:224199642509386451815617661163777238643
title: CVE-2018-17407 texlive-bin
description:
An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex.


definition_id: oval:org.debian:def:189054186312604539319115600589208825318
title: CVE-2018-17456 git
description:
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.


definition_id: oval:org.debian:def:3329033891652971043051681052411941362
title: CVE-2018-17466 firefox-esr
description:
Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


definition_id: oval:org.debian:def:89055418244878349999755995045623949762
title: CVE-2018-17480 chromium
description:
Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


definition_id: oval:org.debian:def:231310165299927496945857481358017592687
title: CVE-2018-17481 chromium
description:
Incorrect object lifecycle handling in PDFium in Google Chrome prior to 71.0.3578.98 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.


definition_id: oval:org.debian:def:337334172169464241253170972333668163391
title: CVE-2018-17567 jekyll
description:
Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "_config.yml" file.


definition_id: oval:org.debian:def:102964171194935239983775860228369790597
title: CVE-2018-17580 tcpreplay
description:
A heap-based buffer over-read exists in the function fast_edit_packet() in the file send_packets.c of Tcpreplay v4.3.0 beta1. This can lead to Denial of Service (DoS) and potentially Information Exposure when the application attempts to process a crafted pcap file.


definition_id: oval:org.debian:def:144934407803592626963213176203016924775
title: CVE-2018-17581 exiv2
description:
CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service.


definition_id: oval:org.debian:def:190520080974678580079665398302719568565
title: CVE-2018-17582 tcpreplay
description:
Tcpreplay v4.3.0 beta1 contains a heap-based buffer over-read. The get_next_packet() function in the send_packets.c file uses the memcpy() function unsafely to copy sequences from the source buffer pktdata to the destination (*prev_packet)->pktdata. This will result in a Denial of Service (DoS) and potentially Information Exposure when the application attempts to process a file.


definition_id: oval:org.debian:def:245444862832799755021787304998750163305
title: CVE-2018-17780 telegram-desktop
description:
Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsafe default behavior in which P2P connections are accepted from clients outside of the My Contacts list.


definition_id: oval:org.debian:def:223909300164673175683063593286121741336
title: CVE-2018-17795 tiff
description:
The function t2p_write_pdf in tiff2pdf.c in LibTIFF 4.0.9 and earlier allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, a similar issue to CVE-2017-9935.


definition_id: oval:org.debian:def:285992067865390243925109646179164170530
title: CVE-2018-17825 adplug
description:
An issue was discovered in AdPlug 2.3.1. There are several double-free vulnerabilities in the CEmuopl class in emuopl.cpp because of a destructor's two OPLDestroy calls, each of which frees TL_TABLE, SIN_TABLE, AMS_TABLE, and VIB_TABLE.


definition_id: oval:org.debian:def:55124609109743601661843764922788387260
title: CVE-2018-17846 golang-golang-x-net-dev
description:
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.


definition_id: oval:org.debian:def:8239968483856885681075690945125990443
title: CVE-2018-17847 golang-golang-x-net-dev
description:
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.


definition_id: oval:org.debian:def:36453265072151864729113157121288213757
title: CVE-2018-17848 golang-golang-x-net-dev
description:
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.


definition_id: oval:org.debian:def:287745896952472853924497921786642857898
title: CVE-2018-17937 gpsd
description:
gpsd versions 2.90 to 3.17 and microjson versions 1.0 to 1.3, an open source project, allow a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code on embedded platforms via traffic on Port 2947/TCP or crafted JSON inputs.


definition_id: oval:org.debian:def:29361275456205939382890364205681475283
title: CVE-2018-17942 gnulib
description:
The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\0' character during %f processing.


definition_id: oval:org.debian:def:161427889243666024228655275871168557157
title: CVE-2018-17958 qemu
description:
Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.


definition_id: oval:org.debian:def:172201084322935422352162356558255280152
title: CVE-2018-17961 ghostscript
description:
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183.


definition_id: oval:org.debian:def:217213993726065703269180911425698374010
title: CVE-2018-17962 qemu
description:
Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.


definition_id: oval:org.debian:def:281183782751220747223702202770307392415
title: CVE-2018-17963 qemu
description:
qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact.


definition_id: oval:org.debian:def:240146863603397032796798672112124745027
title: CVE-2018-17972 linux
description:
An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents.


definition_id: oval:org.debian:def:321162290373080167131016966373301443717
title: CVE-2018-17974 tcpreplay
description:
An issue was discovered in Tcpreplay 4.3.0 beta1. A heap-based buffer over-read was triggered in the function dlt_en10mb_encode() of the file plugins/dlt_en10mb/en10mb.c, due to inappropriate values in the function memmove(). The length (pktlen + ctx -> l2len) can be larger than source value (packet + ctx->l2len) because the function fails to ensure the length of a packet is valid. This leads to Denial of Service.


definition_id: oval:org.debian:def:113715959893706612826351060510962908797
title: CVE-2018-17983 mercurial
description:
cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.


definition_id: oval:org.debian:def:288682065885542363346365218779565299604
title: CVE-2018-18021 linux
description:
arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the KVM_SET_ON_REG ioctl. This is exploitable by attackers who can create virtual machines. An attacker can arbitrarily redirect the hypervisor flow of control (with full register control). An attacker can also cause a denial of service (hypervisor panic) via an illegal exception return. This occurs because of insufficient restrictions on userspace access to the core register file, and because PSTATE.M validation does not prevent unintended execution modes.


definition_id: oval:org.debian:def:92329541241673946969550609382906673477
title: CVE-2018-18023 imagemagick
description:
In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the SVGStripString function of coders/svg.c, which allows attackers to cause a denial of service via a crafted SVG image file.


definition_id: oval:org.debian:def:195280478184388503259646317109480312410
title: CVE-2018-18024 imagemagick
description:
In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.


definition_id: oval:org.debian:def:41316094888173412152624422734165060507
title: CVE-2018-18025 imagemagick
description:
In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the EncodeImage function of coders/pict.c, which allows attackers to cause a denial of service via a crafted SVG image file.


definition_id: oval:org.debian:def:314027550880725711049731421563730536660
title: CVE-2018-18065 net-snmp
description:
_set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.


definition_id: oval:org.debian:def:141177104338111627766707815886009763912
title: CVE-2018-18066 net-snmp
description:
snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.


definition_id: oval:org.debian:def:323161792865254941107854090196071636683
title: CVE-2018-18073 ghostscript
description:
Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object.


definition_id: oval:org.debian:def:319808149571860123347442178032047832391
title: CVE-2018-18074 requests
description:
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.


definition_id: oval:org.debian:def:201085247956726732518825195349144603019
title: CVE-2018-18225 wireshark
description:
In Wireshark 2.6.0 to 2.6.3, the CoAP dissector could crash. This was addressed in epan/dissectors/packet-coap.c by ensuring that the piv length is correctly computed.


definition_id: oval:org.debian:def:80515736825904196286416013575219150786
title: CVE-2018-18226 wireshark
description:
In Wireshark 2.6.0 to 2.6.3, the Steam IHS Discovery dissector could consume system memory. This was addressed in epan/dissectors/packet-steam-ihs-discovery.c by changing the memory-management approach.


definition_id: oval:org.debian:def:297401643700533008442627807170862759562
title: CVE-2018-18227 wireshark
description:
In Wireshark 2.6.0 to 2.6.3 and 2.4.0 to 2.4.9, the MS-WSP protocol dissector could crash. This was addressed in epan/dissectors/packet-mswsp.c by properly handling NULL return values.


definition_id: oval:org.debian:def:116275260501588226330855221102401295780
title: CVE-2018-18245 nagios4
description:
Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified check_load plugin to NRPE.


definition_id: oval:org.debian:def:97285149501774636216379990466739903172
title: CVE-2018-18246 icingaweb2
description:
Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module.


definition_id: oval:org.debian:def:284563921452602097299874115576363116473
title: CVE-2018-18248 icingaweb2
description:
Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string.


definition_id: oval:org.debian:def:224474516944818451410968605238872196092
title: CVE-2018-18249 icingaweb2
description:
Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=${PATH}_${APACHE_RUN_DIR}_${APACHE_RUN_USER} parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet.


definition_id: oval:org.debian:def:138880802768893338624039166936112919935
title: CVE-2018-18250 icingaweb2
description:
Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item.


definition_id: oval:org.debian:def:49926302971845381735539643565338673784
title: CVE-2018-18281 linux
description:
Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19.


definition_id: oval:org.debian:def:41383406334848296535573764360225918787
title: CVE-2018-18284 ghostscript
description:
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.


definition_id: oval:org.debian:def:319612234515905509569944208779252215072
title: CVE-2018-18310 elfutils
description:
An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.


definition_id: oval:org.debian:def:238666561705397818226954886657649825203
title: CVE-2018-18311 perl
description:
Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.


definition_id: oval:org.debian:def:144419031388362729729976991634520008433
title: CVE-2018-18312 perl
description:
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.


definition_id: oval:org.debian:def:149394874540587609294748973699693563957
title: CVE-2018-18313 perl
description:
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.


definition_id: oval:org.debian:def:332061172620178391843982215467227198778
title: CVE-2018-18314 perl
description:
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.


definition_id: oval:org.debian:def:62375715897720707075789610228667682086
title: CVE-2018-18335 chromium
description:
Heap buffer overflow in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:337865363812539974407193095406662716262
title: CVE-2018-18336 chromium
description:
Incorrect object lifecycle in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.


definition_id: oval:org.debian:def:112183067555929118081973132380852921501
title: CVE-2018-18337 chromium
description:
Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:225024711394246641677520141145613373666
title: CVE-2018-18338 chromium
description:
Incorrect, thread-unsafe use of SkImage in Canvas in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:54898231170617318385090504130873895813
title: CVE-2018-18339 chromium
description:
Incorrect object lifecycle in WebAudio in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:88714441263798676797844309498734087407
title: CVE-2018-18340 chromium
description:
Incorrect object lifecycle in MediaRecorder in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:115844277618159722307291465519819649515
title: CVE-2018-18341 chromium
description:
An integer overflow leading to a heap buffer overflow in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:113558020829174820301146471949600796300
title: CVE-2018-18342 chromium
description:
Execution of user supplied Javascript during object deserialization can update object length leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


definition_id: oval:org.debian:def:38857508807145925861640801208653823378
title: CVE-2018-18343 chromium
description:
Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:258127973122189153486757981902558673914
title: CVE-2018-18344 chromium
description:
Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker with control of an installed extension to access files on the local file system via a crafted Chrome Extension.


definition_id: oval:org.debian:def:337332956025341231269725872790406506488
title: CVE-2018-18345 chromium
description:
Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker who had compromised the renderer process to bypass site isolation protections via a crafted HTML page.


definition_id: oval:org.debian:def:325852700654945195272527027633141912720
title: CVE-2018-18346 chromium
description:
Incorrect handling of alert box display in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to present confusing browser UI via a crafted HTML page.


definition_id: oval:org.debian:def:142300609247141251951049243918589446763
title: CVE-2018-18347 chromium
description:
Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to trick a user into executing javascript in an arbitrary origin via a crafted HTML page.


definition_id: oval:org.debian:def:200258748670421428544017763314549205457
title: CVE-2018-18348 chromium
description:
Incorrect handling of bidirectional domain names with RTL characters in Omnibox in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.


definition_id: oval:org.debian:def:337947117887031465725217433941587579430
title: CVE-2018-18349 chromium
description:
Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension.


definition_id: oval:org.debian:def:89927481448283140141860320329319380905
title: CVE-2018-18350 chromium
description:
Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass content security policy via a crafted HTML page.


definition_id: oval:org.debian:def:324558501279546859357605668083491944773
title: CVE-2018-18351 chromium
description:
Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass SameSite cookie policy via a crafted HTML page.


definition_id: oval:org.debian:def:79254109511091972479521360255638248281
title: CVE-2018-18352 chromium
description:
Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same origin policy for audio content via a crafted HTML page.


definition_id: oval:org.debian:def:122512357581816707427550922119762649295
title: CVE-2018-18353 chromium
description:
Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of an auto dialog via a crafted HTML page.


definition_id: oval:org.debian:def:14768424316235898415389451716867002855
title: CVE-2018-18354 chromium
description:
Insufficient validate of external protocols in Shell Integration in Google Chrome on Windows prior to 71.0.3578.80 allowed a remote attacker to launch external programs via a crafted HTML page.


definition_id: oval:org.debian:def:324040915113609898420727165086139131488
title: CVE-2018-18355 chromium
description:
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.


definition_id: oval:org.debian:def:22728482629817601453151579422241376078
title: CVE-2018-18356 chromium
description:
An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:131462924109534932640591350566471124324
title: CVE-2018-18358 chromium
description:
Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the local network segment to proxy resources on localhost via a crafted WPAD file.


definition_id: oval:org.debian:def:204071557158940004922727286635869818002
title: CVE-2018-18359 chromium
description:
Incorrect handling of Reflect.construct in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


definition_id: oval:org.debian:def:191276959866574073677168976502752548347
title: CVE-2018-18384 unzip
description:
Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12.


definition_id: oval:org.debian:def:328922696879329721548598046010540587469
title: CVE-2018-18385 asciidoctor
description:
Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.


definition_id: oval:org.debian:def:67838616922098847000098140671382683314
title: CVE-2018-18386 linux
description:
drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ.


definition_id: oval:org.debian:def:150363138835813055550711716660153389311
title: CVE-2018-18397 linux
description:
The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.


definition_id: oval:org.debian:def:76779318279393587522094851103211380807
title: CVE-2018-18407 tcpreplay
description:
A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0 beta1, during the incremental checksum operation. The issue gets triggered in the function csum_replace4() in incremental_checksum.h, causing a denial of service.


definition_id: oval:org.debian:def:64895486767346704072559649849167812269
title: CVE-2018-18408 tcpreplay
description:
A use-after-free was discovered in the tcpbridge binary of Tcpreplay 4.3.0 beta1. The issue gets triggered in the function post_args() at tcpbridge.c, causing a denial of service or possibly unspecified other impact.


definition_id: oval:org.debian:def:73036930569080811480071192302896731007
title: CVE-2018-18409 tcpflow
description:
A stack-based buffer over-read exists in setbit() at iptree.h of TCPFLOW 1.5.0, due to received incorrect values causing incorrect computation, leading to denial of service during an address_histogram call or a get_histogram call.


definition_id: oval:org.debian:def:214901374138192355845721980460456554560
title: CVE-2018-18438 qemu
description:
Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value.


definition_id: oval:org.debian:def:320647117374318335917963390930152036378
title: CVE-2018-18444 openexr
description:
makeMultiView.cpp in exrmultiview in OpenEXR 2.3.0 has an out-of-bounds write, leading to an assertion failure or possibly unspecified other impact.


definition_id: oval:org.debian:def:65191329978420775235096230804763214618
title: CVE-2018-18445 linux
description:
In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts.


definition_id: oval:org.debian:def:26943639485110263190965486019037945459
title: CVE-2018-18492 firefox-esr
description:
A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.


definition_id: oval:org.debian:def:80916100766158155077292423417643131333
title: CVE-2018-18493 firefox-esr
description:
A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.


definition_id: oval:org.debian:def:57755508549671203451812925461121441908
title: CVE-2018-18494 firefox-esr
description:
A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.


definition_id: oval:org.debian:def:36759231674239836815712319900477390881
title: CVE-2018-18498 firefox-esr
description:
A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This leads to a possible out-of-bounds write. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.


definition_id: oval:org.debian:def:307291665376728323681366195432610275611
title: CVE-2018-18499 firefox-esr
description:
A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.


definition_id: oval:org.debian:def:151197130192776663001809631491677074040
title: CVE-2018-18500 firefox-esr
description:
A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being freed while still in use, leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65.


definition_id: oval:org.debian:def:85511648733996164335537029450273178549
title: CVE-2018-18501 firefox-esr
description:
Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65.


definition_id: oval:org.debian:def:242677711535223283665749279479430451042
title: CVE-2018-18505 firefox-esr
description:
An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC process creation. This authentication is insufficient for channels created after the IPC process is started, leading to the authentication not being correctly applied to later channels. This could allow for a sandbox escape through IPC channels due to lack of message validation in the listener process. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65.


definition_id: oval:org.debian:def:221836395928703162601540337777554000513
title: CVE-2018-18506 firefox-esr
description:
When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server. This behavior is disallowed by default when a proxy is manually configured, but when enabled could allow for attacks on services and tools that bind to the localhost for networked behavior if they are accessed through browsing. This vulnerability affects Firefox < 65.


definition_id: oval:org.debian:def:61412043461496922637906547459100155432
title: CVE-2018-18508 nss
description:
In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.


definition_id: oval:org.debian:def:121105773944538509873734044146416654634
title: CVE-2018-18509 thunderbird
description:
A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird < 60.5.1.


definition_id: oval:org.debian:def:131419817087754453319887349301421068743
title: CVE-2018-18511 firefox-esr
description:
Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox < 65.0.1.


definition_id: oval:org.debian:def:108053686240872524643885471132185044346
title: CVE-2018-18512 thunderbird
description:
A use-after-free vulnerability can occur while playing a sound notification in Thunderbird. The memory storing the sound data is immediately freed, although the sound is still being played asynchronously, leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5.


definition_id: oval:org.debian:def:144655810064551723908322270305886855359
title: CVE-2018-18513 thunderbird
description:
A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature. This can be used as a denial-of-service (DOS) attack because Thunderbird reopens the last seen message on restart, triggering the crash again. This vulnerability affects Thunderbird < 60.5.


definition_id: oval:org.debian:def:250194121903852946793617390399509731764
title: CVE-2018-18520 elfutils
description:
An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.


definition_id: oval:org.debian:def:62771720942404962080473204816606806390
title: CVE-2018-18521 elfutils
description:
Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.


definition_id: oval:org.debian:def:87605683080428648790346268005064206858
title: CVE-2018-18541 teeworlds
description:
In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets.


definition_id: oval:org.debian:def:103324362598723751367198551544270172961
title: CVE-2018-18544 graphicsmagick
description:
There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31.


definition_id: oval:org.debian:def:308273521434407232748978528905881994417
title: CVE-2018-18557 tiff
description:
LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size, which leads to a tif_jbig.c JBIGDecode out-of-bounds write.


definition_id: oval:org.debian:def:58994061365270523574331253169138742203
title: CVE-2018-18559 linux
description:
In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control.


definition_id: oval:org.debian:def:37356649524635641225651039341130625896
title: CVE-2018-18584 cabextract
description:
In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write.


definition_id: oval:org.debian:def:339977861264173015740892254001893826428
title: CVE-2018-18585 libmspack
description:
chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name).


definition_id: oval:org.debian:def:41395192279461096561865806155587291888
title: CVE-2018-18586 libmspack
description:
** DISPUTED ** chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application.


definition_id: oval:org.debian:def:46181549208770093037330866459770118957
title: CVE-2018-18655 prayer
description:
Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting.


definition_id: oval:org.debian:def:239315687380639519093154337718802395513
title: CVE-2018-18661 tiff
description:
An issue was discovered in LibTIFF 4.0.9. There is a NULL pointer dereference in the function LZWDecode in the file tif_lzw.c.


definition_id: oval:org.debian:def:315944069584475237027498059097091530257
title: CVE-2018-18662 mupdf
description:
There is an out-of-bounds read in fz_run_t3_glyph in fitz/font.c in Artifex MuPDF 1.14.0, as demonstrated by mutool.


definition_id: oval:org.debian:def:194872926892015927282332025105423753107
title: CVE-2018-18690 linux
description:
In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because xfs_attr_shortform_addname in fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE operations with conversion of an attr from short to long form.


definition_id: oval:org.debian:def:235773322525650357368031840610924566275
title: CVE-2018-18710 linux
description:
An issue was discovered in the Linux kernel through 4.19. An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658.


definition_id: oval:org.debian:def:21817694719174512317116594434115020817
title: CVE-2018-18718 gthumb
description:
An issue was discovered in gThumb through 3.6.2. There is a double-free vulnerability in the add_themes_from_dir method in dlg-contact-sheet.c because of two successive calls of g_free, each of which frees the same buffer.


definition_id: oval:org.debian:def:320922936137772220726720892772547650338
title: CVE-2018-18751 gettext
description:
An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-catalog.c, related to an invalid free in po_gram_parse in po-gram-gen.y, as demonstrated by lt-msgfmt.


definition_id: oval:org.debian:def:63470516900375604851991804071442367315
title: CVE-2018-18764 smplayer
description:
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in a parse_mqtt getu16 call. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.


definition_id: oval:org.debian:def:84977992389923545750487910910223042867
title: CVE-2018-18765 smplayer
description:
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mg_mqtt_next_subscribe_topic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.


definition_id: oval:org.debian:def:222113949252928288580592130018387687226
title: CVE-2018-18820 icecast2
description:
A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any malicious HTTP client can send a request for that specific resource including a crafted header, leading to denial of service and potentially remote code execution.


definition_id: oval:org.debian:def:117224843715202308126676283206536213764
title: CVE-2018-18836 netdata
description:
An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c.


definition_id: oval:org.debian:def:46178929758474877885659502205415965661
title: CVE-2018-18837 netdata
description:
An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c.


definition_id: oval:org.debian:def:312332024071297210690478298190975732293
title: CVE-2018-18838 netdata
description:
An issue was discovered in Netdata 1.10.0. Log Injection (or Log Forgery) exists via a %0a sequence in the url parameter to api/v1/registry.


definition_id: oval:org.debian:def:305857597536844015043705810362687582001
title: CVE-2018-18839 netdata
description:
** DISPUTED ** An issue was discovered in Netdata 1.10.0. Full Path Disclosure (FPD) exists via api/v1/alarms. NOTE: the vendor says "is intentional."


definition_id: oval:org.debian:def:275494729648976273816949071941810711935
title: CVE-2018-18849 qemu
description:
In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value.


definition_id: oval:org.debian:def:170097925442718456767279419699294080512
title: CVE-2018-18883 xen
description:
An issue was discovered in Xen 4.9.x through 4.11.x, on Intel x86 platforms, allowing x86 HVM and PVH guests to cause a host OS denial of service (NULL pointer dereference) or possibly have unspecified other impact because nested VT-x is not properly restricted.


definition_id: oval:org.debian:def:304151368823314661678460800478832429793
title: CVE-2018-18897 poppler
description:
An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo.


definition_id: oval:org.debian:def:198714106331924693707115953793331033589
title: CVE-2018-18898 libemail-address-list-perl
description:
The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.


definition_id: oval:org.debian:def:171945039633790763669886602493979905033
title: CVE-2018-18928 icu
description:
International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.


definition_id: oval:org.debian:def:42555580842991444736191456541492179940
title: CVE-2018-18954 qemu
description:
The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu before 3.1 allows out-of-bounds write or read access to PowerNV memory.


definition_id: oval:org.debian:def:259101138070992420764452794048868672728
title: CVE-2018-18955 linux
description:
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.


definition_id: oval:org.debian:def:259439852975101602785036562416362281204
title: CVE-2018-18956 suricata
description:
The ProcessMimeEntity function in util-decode-mime.c in Suricata 4.x before 4.0.6 allows remote attackers to cause a denial of service (segfault and daemon crash) via crafted input to the SMTP parser, as exploited in the wild in November 2018.


definition_id: oval:org.debian:def:333405665615966754763355088692198007872
title: CVE-2018-19044 keepalived
description:
keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd.


definition_id: oval:org.debian:def:163978173718467421312540606623551545663
title: CVE-2018-19045 keepalived
description:
keepalived 2.0.8 used mode 0666 when creating new temporary files upon a call to PrintData or PrintStats, potentially leaking sensitive information.


definition_id: oval:org.debian:def:61223830336576734767576838950801455001
title: CVE-2018-19046 keepalived
description:
keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats. If a local attacker had previously created a file with the expected name (e.g., /tmp/keepalived.data or /tmp/keepalived.stats), with read access for the attacker and write access for the keepalived process, then this potentially leaked sensitive information.


definition_id: oval:org.debian:def:205524887084507021368742547054028557331
title: CVE-2018-19052 lighttpd
description:
An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.


definition_id: oval:org.debian:def:9169456552518733405642532260757461707
title: CVE-2018-19058 poppler
description:
An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.


definition_id: oval:org.debian:def:240994938538452748322339296434155716100
title: CVE-2018-19105 librecad
description:
LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access violation and application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:115923428753744029131654317849282906779
title: CVE-2018-19107 exiv2
description:
In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp (called from psdimage.cpp in the PSD image reader) may suffer from a denial of service (heap-based buffer over-read) caused by an integer overflow via a crafted PSD image file.


definition_id: oval:org.debian:def:222605691636464250927884097182936807856
title: CVE-2018-19108 exiv2
description:
In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of service (infinite loop) caused by an integer overflow via a crafted PSD image file.


definition_id: oval:org.debian:def:208362007544854338140558375937150421605
title: CVE-2018-19115 keepalived
description:
keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extract_status_code in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap.


definition_id: oval:org.debian:def:118032364967250270825671783250923720615
title: CVE-2018-19120 kio-extras
description:
The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.


definition_id: oval:org.debian:def:210690896627340848988167697786663660397
title: CVE-2018-19131 squid
description:
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.


definition_id: oval:org.debian:def:166003394153999838729561248185771779527
title: CVE-2018-19132 squid
description:
Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.


definition_id: oval:org.debian:def:177983076959189765233428054054021722917
title: CVE-2018-19134 ghostscript
description:
In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.


definition_id: oval:org.debian:def:207283717924149407696225892037676443376
title: CVE-2018-19141 otrs2
description:
Open Ticket Request System (OTRS) 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to conduct an XSS attack via a modified URL because user and customer preferences are mishandled.


definition_id: oval:org.debian:def:160941942816542739285219165322392326765
title: CVE-2018-19142 otrs2
description:
Open Ticket Request System (OTRS) 6.0.x before 6.0.13 allows an admin to conduct an XSS attack via a modified URL.


definition_id: oval:org.debian:def:273118955601066645214569903463838562890
title: CVE-2018-19143 otrs2
description:
Open Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0.13 allows an authenticated user to delete files via a modified submission form because upload caching is mishandled.


definition_id: oval:org.debian:def:81520829693564567857824925573501086649
title: CVE-2018-19149 poppler
description:
Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.


definition_id: oval:org.debian:def:14608636696057192740468551273522757618
title: CVE-2018-19198 uriparser
description:
An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or uriComposeQueryEx* function because the '&' character is mishandled in certain contexts.


definition_id: oval:org.debian:def:208402249330901535647605463440755130587
title: CVE-2018-19199 uriparser
description:
An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.


definition_id: oval:org.debian:def:303450882402694697160710849603005177999
title: CVE-2018-19200 uriparser
description:
An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.


definition_id: oval:org.debian:def:236404825455005197502711188071400453651
title: CVE-2018-19205 roundcube
description:
Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php.


definition_id: oval:org.debian:def:7204029176171052475023034250355668102
title: CVE-2018-19206 roundcube
description:
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.


definition_id: oval:org.debian:def:275542683953330513033790121173226452905
title: CVE-2018-19208 libwpd
description:
In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack. This is related to WPXTable.h.


definition_id: oval:org.debian:def:185539523874772256766017417010967278320
title: CVE-2018-19209 nasm
description:
Netwide Assembler (NASM) 2.14rc15 has a NULL pointer dereference in the function find_label in asm/labels.c that will lead to a DoS attack.


definition_id: oval:org.debian:def:63846736563484939920590577365288349231
title: CVE-2018-19210 tiff
description:
In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset.


definition_id: oval:org.debian:def:35937465891220762770137324774056004513
title: CVE-2018-19211 ncurses
description:
In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection.


definition_id: oval:org.debian:def:122014835692971750148181505796626268606
title: CVE-2018-19214 nasm
description:
Netwide Assembler (NASM) 2.14rc15 has a heap-based buffer over-read in expand_mmac_params in asm/preproc.c for insufficient input.


definition_id: oval:org.debian:def:160018980829844259725077571966504560027
title: CVE-2018-19215 nasm
description:
Netwide Assembler (NASM) 2.14rc16 has a heap-based buffer over-read in expand_mmac_params in asm/preproc.c for the special cases of the % and $ and ! characters.


definition_id: oval:org.debian:def:54717360216113566668617652861124024376
title: CVE-2018-19217 ncurses
description:
** DISPUTED ** In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_match that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-party.


definition_id: oval:org.debian:def:294300266268895546846232930815992483114
title: CVE-2018-19351 jupyter-notebook
description:
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.


definition_id: oval:org.debian:def:18113919310577521250136820529060003165
title: CVE-2018-19352 jupyter-notebook
description:
Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.


definition_id: oval:org.debian:def:197382225613476093281043221232049216558
title: CVE-2018-19360 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.


definition_id: oval:org.debian:def:302154847305682006601421773474272972527
title: CVE-2018-19361 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.


definition_id: oval:org.debian:def:325162331885524090956959297338146844064
title: CVE-2018-19362 jackson-databind
description:
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.


definition_id: oval:org.debian:def:283530498018580185781736147159087427161
title: CVE-2018-19364 qemu
description:
hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.


definition_id: oval:org.debian:def:115193137697906238130212954774486692630
title: CVE-2018-19407 linux
description:
The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized.


definition_id: oval:org.debian:def:180843008435540653182051507675480000021
title: CVE-2018-19409 ghostscript
description:
An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used.


definition_id: oval:org.debian:def:340061759738606755638422764190660892535
title: CVE-2018-19416 sysstat
description:
An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf.


definition_id: oval:org.debian:def:292565583501784441045478896671716155580
title: CVE-2018-19432 libsndfile
description:
An issue was discovered in libsndfile 1.0.28. There is a NULL pointer dereference in the function sf_write_int in sndfile.c, which will lead to a denial of service.


definition_id: oval:org.debian:def:302388352018841998787470057052452118036
title: CVE-2018-19475 ghostscript
description:
psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same.


definition_id: oval:org.debian:def:258828475920904782498557650906396782511
title: CVE-2018-19476 ghostscript
description:
psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion.


definition_id: oval:org.debian:def:3872136056852609439888970115875014420
title: CVE-2018-19477 ghostscript
description:
psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode type confusion.


definition_id: oval:org.debian:def:137647377569931720206925574716030538909
title: CVE-2018-19478 ghostscript
description:
In Artifex Ghostscript before 9.26, a carefully crafted PDF file can trigger an extremely long running computation when parsing the file.


definition_id: oval:org.debian:def:110418962693800084975850414289703055997
title: CVE-2018-19486 git
description:
Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.


definition_id: oval:org.debian:def:302962031999479192870576750260797735157
title: CVE-2018-19489 qemu
description:
v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming.


definition_id: oval:org.debian:def:251929996236827281772771111909498150254
title: CVE-2018-19497 sleuthkit
description:
In The Sleuth Kit (TSK) through 4.6.4, hfs_cat_traverse in tsk/fs/hfs.c does not properly determine when a key length is too large, which allows attackers to cause a denial of service (SEGV on unknown address with READ memory access in a tsk_getu16 call in hfs_dir_open_meta_cb in tsk/fs/hfs_dent.c).


