Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2019-18676

squid: Buffer overflow in URI processor

An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity is high due to this vulnerability occurring before normal security checks; any remote client that can reach the proxy port can trivially perform the attack via a crafted URI scheme.

CVSS 3.1 · 7.5 High EPSS 9.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 2 more
CVE-2019-18660

kernel: powerpc: incomplete Spectre-RSB mitigation leads to information exposure

The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 2 more
Products
Ubuntu Linux Fedora Linux Kernel and 4 more
CVE-2019-18634

sudo: Stack based buffer overflow when pwfeedback is enabled

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

CVSS 3.1 · 7.8 High EPSS 19.3% KEV · Not listed
Vendors
Debian Redhat Sudo Project
Products
Debian Linux Enterprise Linux Rhel E4s and 1 more
CVE-2019-18609

librabbitmq: integer overflow in amqp_handle_input in amqp_connection.c leads to heap-based buffer overflow

An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server could return a malicious frame header that leads to a smaller target_size value than needed. This condition is then carried on to a memcpy function that copies too much data into a heap buffer.

CVSS 3.1 · 9.8 Critical EPSS 3.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 2 more
CVE-2019-18466

podman: resolving symlink in host filesystem leads to unexpected results of copy operation

An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a victim user to the host filesystem, may overwrite existing files with others from the host.

CVSS 3.1 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Libpod Project Redhat
Products
Libpod Enterprise Linux Rhel Extras Other
CVE-2019-18408

libarchive: use-after-free in archive_read_format_rar_read_data when there is an error in the decompression of an archive entry

archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.

CVSS 3.1 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Canonical Debian Libarchive and 2 more
Products
Ubuntu Linux Debian Linux Libarchive and 3 more
CVE-2019-18397

fribidi: buffer overflow in fribidi_get_par_embedding_levels_ex() in lib/fribidi-bidi.c leading to denial of service and possible code execution

A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.

CVSS 3.1 · 7.8 High EPSS 2.2% KEV · Not listed
Vendors
Debian Gnu Redhat
Products
Debian Linux Fribidi Enterprise Linux and 1 more
CVE-2019-18391

virglrenderer: heap based buffer overflow in the vrend_renderer_transfer_write_iov function

A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Enterprise Linux and 1 more
CVE-2019-18390

virglrenderer: out-of-bounds read in the vrend_blit_need_swizzle may lead to DoS

An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_BLIT commands.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Enterprise Linux and 1 more
CVE-2019-18389

virglrenderer: heap buffer overflow in the vrend_renderer_transfer_write_iov function

A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service, or QEMU guest-to-host escape and code execution, via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Enterprise Linux and 1 more
CVE-2019-18282

kernel: The flow_dissector feature allows device tracking

The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code.

CVSS 3.1 · 5.3 Medium EPSS 2.9% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel 8300 and 18 more
CVE-2019-18281

qt5-qtbase: Out-of-bounds access in generateDirectionalRuns() function in qtextengine.cpp

An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters.

CVSS 3.1 · 4.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Qt Redhat
Products
Debian Linux Qtbase Enterprise Linux
CVE-2019-18277

haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated "chunked" value

A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).

CVSS 3.1 · 7.5 High EPSS 10.1% KEV · Not listed
Vendors
Haproxy Redhat
Products
Haproxy Enterprise Linux Openshift and 1 more
CVE-2019-18218

file: heap-based buffer overflow in cdf_read_property_info in cdf.c

cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).

CVSS 3.1 · 7.8 High EPSS 1.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 4 more
CVE-2019-17666

kernel: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain upper-bound check, leading to a buffer overflow

rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow.

CVSS 3.1 · 8.8 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 7 more
CVE-2019-17639

JDK: Information disclosure via calls to System.arraycopy() with invalid length

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.

CVSS 3.1 · 5.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Eclipse Redhat
Products
Openj9 Enterprise Linux Rhel Extras
CVE-2019-17638

jetty: double release of resource can lead to information disclosure

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with other data. Thread1 then proceeds to write the buffer that now contains different data. This results in client1, which issued request1 seeing data from another request or response which could contain sensitive data belonging to client2 (HTTP session ids, authentication credentials, etc.). If the Jetty version cannot be upgraded, the vulnerability can be significantly reduced by configuring a responseHeaderSize significantly larger than the requestHeaderSize (12KB responseHeaderSize and 8KB requestHeaderSize).

CVSS 3.1 · 9.4 Critical EPSS 11.1% KEV · Not listed
Vendors
Eclipse Redhat
Products
Jetty Jboss Fuse Openshift
CVE-2019-17626

python-reportlab: code injection in colors.py allows attacker to execute code

ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.

CVSS 3.1 · 9.8 Critical EPSS 9.5% KEV · Not listed
Vendors
Redhat Reportlab
Products
Enterprise Linux Rhel E4s Reportlab
CVE-2019-17596

golang: invalid public key causes panic in dsa.Verify

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

CVSS 3.1 · 7.5 High EPSS 4.7% KEV · Not listed
Vendors
Arista Debian Fedoraproject and 3 more
Products
Cloudvision Portal Eos Mos and 10 more