CVE-2020-2763

mysql: Server: Replication unspecified vulnerability (CPU Apr 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 2.1% KEV · Not listed

Vendors

Canonical Fedoraproject Netapp and 2 more

Products

Ubuntu Linux Fedora Active Iq Unified Manager and 8 more

CVE-2020-2762

mysql: InnoDB unspecified vulnerability (CPU Apr 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 2.5% KEV · Not listed

Vendors

Canonical Fedoraproject Netapp and 2 more

Products

Ubuntu Linux Fedora Active Iq Unified Manager and 8 more

CVE-2020-2761

mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed

Vendors

Fedoraproject Netapp Oracle and 1 more

Products

Fedora Active Iq Unified Manager Oncommand Insight and 7 more

CVE-2020-2760

mysql: InnoDB unspecified vulnerability (CPU Apr 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).

CVSS 3.1 · 5.5 Medium EPSS 3.2% KEV · Not listed

Vendors

Canonical Fedoraproject Mariadb and 4 more

Products

Ubuntu Linux Fedora Mariadb and 10 more

CVE-2020-2759

mysql: Server: Replication unspecified vulnerability (CPU Apr 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 2.1% KEV · Not listed

Vendors

Canonical Fedoraproject Netapp and 2 more

Products

Ubuntu Linux Fedora Active Iq Unified Manager and 8 more

CVE-2020-2757

OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS 3.1 · 3.7 Low EPSS 4.2% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 5 more

Products

Ubuntu Linux Debian Linux Fedora and 21 more

CVE-2020-2756

OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization (Serialization, 8224541)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS 3.1 · 3.7 Low EPSS 4.2% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 5 more

Products

Ubuntu Linux Debian Linux Fedora and 20 more

CVE-2020-2755

OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS 3.1 · 3.7 Low EPSS 3.9% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 5 more

Products

Ubuntu Linux Debian Linux Fedora and 20 more

CVE-2020-2754

OpenJDK: Misplaced regular expression syntax error check in RegExpScanner (Scripting, 8223898)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS 3.1 · 3.7 Low EPSS 4.2% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 5 more

Products

Ubuntu Linux Debian Linux Fedora and 12 more

CVE-2020-2752

mysql: C API unspecified vulnerability (CPU Apr 2020)

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 5.3 Medium EPSS 2.3% KEV · Not listed

Vendors

Fedoraproject Mariadb Netapp and 3 more

Products

Fedora Mariadb Active Iq Unified Manager and 9 more

CVE-2020-29661

kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free

A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed

Vendors

Broadcom Debian Fedoraproject and 4 more

Products

Fabric Operating System Debian Linux Fedora and 22 more

CVE-2020-29660

kernel: locking inconsistency in drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c can lead to a read-after-free

A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom Debian Fedoraproject and 3 more

Products

Fabric Operating System Debian Linux Fedora and 15 more

CVE-2020-29623

webkitgtk: User may be unable to fully delete browsing history

"Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. A user may be unable to fully delete browsing history.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Apple Fedoraproject Redhat and 1 more

Products

Ipados Iphone Os Mac Os X and 6 more

CVE-2020-29130

QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets

slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Debian Fedoraproject Libslirp Project and 1 more

Products

Debian Linux Fedora Libslirp and 1 more

CVE-2020-29129

QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets

ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

CVSS 3.1 · 4.3 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Fedoraproject Libslirp Project and 1 more

Products

Debian Linux Fedora Libslirp and 1 more

CVE-2020-28948

Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

CVSS 3.1 · 7.8 High EPSS 47.5% KEV · Not listed

Vendors

Debian Drupal Fedoraproject and 2 more

Products

Debian Linux Drupal Fedora and 3 more

CVE-2020-28493

Regular Expression Denial of Service (ReDoS)

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

CVSS 3.1 · 5.3 Medium EPSS 3.6% KEV · Not listed

Vendors

Fedoraproject Palletsprojects Redhat

Products

Fedora Jinja Enterprise Linux and 1 more

CVE-2020-28374

kernel: SCSI target (LIO) write to any block on ILO backstore

In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.

CVSS 3.1 · 8.1 High EPSS 6.6% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 6 more

CVE-2020-28366

Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed

Vendors

Fedoraproject Golang Netapp and 1 more

Products

Fedora Go Cloud Insights Telegraf Agent and 4 more

CVE-2020-28362

golang: math/big: panic during recursive division of very large numbers

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

CVSS 3.1 · 7.5 High EPSS 3.9% KEV · Not listed

Vendors

Fedoraproject Golang Netapp and 1 more

Products

Fedora Go Cloud Insights Telegraf Agent and 9 more