Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 33

Export CSV
CVE-2020-29573

glibc: stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern

sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of "Fixed for glibc 2.33" in the 26649 reference.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Gnu Netapp Redhat
Products
Glibc Cloud Backup Solidfire Baseboard Management Controller and 6 more
CVE-2020-8177

curl: Incorrect argument check can allow remote servers to overwrite local files

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Not listed
Vendors
Debian Fujitsu Haxx and 3 more
Products
Debian Linux M10-1 M10-1 Firmware and 16 more
CVE-2020-10029

glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions

The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2019-25013

glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding

The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.

CVSS 3.1 · 5.9 Medium EPSS 3.6% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 3 more
Products
Fabric Operating System Debian Linux Fedora and 9 more
CVE-2019-20907

python: infinite loop in the tarfile module via crafted TAR archive

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CVSS 3.1 · 5.5 Medium EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2019-5188

e2fsprogs: Out-of-bounds write in e2fsck/rehash.c

A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian E2fsprogs Project and 4 more
Products
Ubuntu Linux Debian Linux E2fsprogs and 7 more
CVE-2019-5094

e2fsprogs: Crafted ext4 partition leads to out-of-bounds write

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian E2fsprogs Project and 3 more
Products
Ubuntu Linux Debian Linux E2fsprogs and 5 more
CVE-2019-19126

glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries

On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2019-17498

libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

CVSS 3.1 · 8.1 High EPSS 3.8% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 3 more
Products
Debian Linux Fedora Libssh2 and 10 more
CVE-2019-15903

expat: heap-based buffer over-read via crafted XML input

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

CVSS 3.1 · 6.5 Medium EPSS 6.6% KEV · Not listed
Vendors
Libexpat Project Python Redhat
Products
Libexpat Python Enterprise Linux and 2 more
CVE-2018-20843

expat: large number of colons in input makes parser consume high amount of resources, leading to DoS

In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).

CVSS 3.1 · 7.5 High EPSS 7.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 9 more
CVE-2019-16935

python: XSS vulnerability in the documentation XML-RPC server in server_title field

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.

CVSS 3.1 · 6.1 Medium EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Python and 1 more
Products
Ubuntu Linux Debian Linux Python and 3 more
CVE-2020-12400

nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Mobile Enterprise Linux and 1 more
CVE-2020-6829

nss: Side channel attack on ECDSA signature generation

When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

CVSS 3.1 · 5.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Mobile Enterprise Linux and 1 more
CVE-2020-12401

nss: ECDSA timing attack mitigation bypass

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Mobile Enterprise Linux and 1 more