Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2019-13114

exiv2: null-pointer dereference in http.c causing denial of service

http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted response that lacks a space character.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Exiv2 and 2 more
Products
Ubuntu Linux Debian Linux Exiv2 and 2 more
CVE-2019-13113

exiv2: invalid data location in CRW image file causing denial of service

Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW image file.

CVSS 3.1 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Exiv2 Fedoraproject and 1 more
Products
Ubuntu Linux Exiv2 Fedora and 1 more
CVE-2019-13112

exiv2: uncontrolled memory allocation in PngChunk::parseChunkContent causing denial of service

A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to an std::bad_alloc exception) via a crafted PNG image file.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Exiv2 and 2 more
Products
Ubuntu Linux Debian Linux Exiv2 and 2 more
CVE-2019-13111

exiv2: integer overflow in WebPImage::decodeChunks leads to denial of service

A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation followed by a very long running loop) via a crafted WEBP image file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Exiv2 Fedoraproject Redhat
Products
Exiv2 Fedora Enterprise Linux
CVE-2019-13109

exiv2: denial of service in PngImage::readMetadata

An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a chunkLength - iccOffset subtraction.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Exiv2 Fedoraproject Redhat
Products
Exiv2 Fedora Enterprise Linux
CVE-2019-13050

GnuPG: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS

Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
F5 Fedoraproject Gnupg and 3 more
Products
Traffix Signaling Delivery Controller Fedora Gnupg and 3 more
CVE-2019-13045

irssi: use after free when sending SASL login to server

Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server.

CVSS 3.0 · 8.1 High EPSS 3.4% KEV · Not listed
Vendors
Irssi Redhat
Products
Irssi Enterprise Linux
CVE-2019-13012

glib2: insecure permissions for files and directories

The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Gnome Redhat
Products
Glib Enterprise Linux
CVE-2019-12979

imagemagick: use of uninitialized value in functionSyncImageSettings in MagickCore/image.c

ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage in magick/image.c.

CVSS 3.1 · 7.8 High EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Imagemagick and 2 more
Products
Ubuntu Linux Debian Linux Imagemagick and 2 more
CVE-2019-12978

imagemagick: use of uninitialized value in function ReadPANGOImage in coders/pango.c

ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the ReadPANGOImage function in coders/pango.c.

CVSS 3.0 · 7.8 High EPSS 1.9% KEV · Not listed
Vendors
Imagemagick Redhat
Products
Imagemagick Enterprise Linux
CVE-2019-12974

imagemagick: null-pointer dereference in function ReadPANGOImage in coders/pango.c and ReadVIDImage in coders/vid.c causing denial of service

A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted image.

CVSS 3.0 · 5.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Imagemagick Redhat
Products
Imagemagick Enterprise Linux
CVE-2019-12973

openjpeg: denial of service in function opj_t1_encode_cblks in openjp2/t1.c

In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.

CVSS 3.1 · 5.5 Medium EPSS 2.6% KEV · Not listed
Vendors
Debian Opensuse Oracle and 2 more
Products
Debian Linux Leap Database Server and 3 more
CVE-2019-12854

squid: Denial of service in cachemgr.cgi

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.

CVSS 3.1 · 7.5 High EPSS 11.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2019-12819

kernel: use-after-free in function __mdiobus_register() in drivers/net/phy/mdio_bus.c

An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in drivers/net/phy/mdio_bus.c calls put_device(), which will trigger a fixed_mdio_bus_init use-after-free. This will cause a denial of service.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2019-12817

kernel: ppc: unrelated processes being able to read/write to each other's virtual memory

arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel before 5.1.15 for powerpc has a bug where unrelated processes may be able to read/write to one another's virtual memory under certain conditions via an mmap above 512 TB. Only a subset of powerpc systems are affected.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 6 more