Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,842

Export CSV
CVE-2019-13727

chromium-browser: Insufficient policy enforcement in WebSockets

Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13726

chromium-browser: Heap buffer overflow in password manager

Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13725

chromium-browser: Use after free in Bluetooth

Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13723

chromium-browser: use-after-free in bluetooth

Use after free in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Google Opensuse and 1 more
Products
Fedora Chrome Backports and 4 more
CVE-2019-13616

SDL: heap-based buffer overflow in SDL blit functions in video/SDL_blit*.c

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.

CVSS 3.1 · 8.1 High EPSS 3.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2019-13313

Libosinfo: osinfo-install-script option leaks password via command line argument

libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Libosinfo Redhat
Products
Fedora Libosinfo Enterprise Linux and 3 more
CVE-2019-13225

oniguruma: NULL pointer dereference in match_at() in regexec.c

A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression. Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

CVSS 3.1 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Fedoraproject Oniguruma Project Redhat
Products
Fedora Oniguruma Enterprise Linux
CVE-2019-13224

oniguruma: Use-after-free in onig_new_deluxe() in regext.c

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

CVSS 3.1 · 9.8 Critical EPSS 4.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 4 more
CVE-2019-13114

exiv2: null-pointer dereference in http.c causing denial of service

http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted response that lacks a space character.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Exiv2 and 2 more
Products
Ubuntu Linux Debian Linux Exiv2 and 2 more
CVE-2019-13113

exiv2: invalid data location in CRW image file causing denial of service

Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW image file.

CVSS 3.1 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Exiv2 Fedoraproject and 1 more
Products
Ubuntu Linux Exiv2 Fedora and 1 more
CVE-2019-13112

exiv2: uncontrolled memory allocation in PngChunk::parseChunkContent causing denial of service

A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to an std::bad_alloc exception) via a crafted PNG image file.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Exiv2 and 2 more
Products
Ubuntu Linux Debian Linux Exiv2 and 2 more
CVE-2019-13111

exiv2: integer overflow in WebPImage::decodeChunks leads to denial of service

A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation followed by a very long running loop) via a crafted WEBP image file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Exiv2 Fedoraproject Redhat
Products
Exiv2 Fedora Enterprise Linux
CVE-2019-13109

exiv2: denial of service in PngImage::readMetadata

An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a chunkLength - iccOffset subtraction.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Exiv2 Fedoraproject Redhat
Products
Exiv2 Fedora Enterprise Linux
CVE-2019-13050

GnuPG: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS

Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
F5 Fedoraproject Gnupg and 3 more
Products
Traffix Signaling Delivery Controller Fedora Gnupg and 3 more
CVE-2019-12854

squid: Denial of service in cachemgr.cgi

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.

CVSS 3.1 · 7.5 High EPSS 11.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2019-12817

kernel: ppc: unrelated processes being able to read/write to each other's virtual memory

arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel before 5.1.15 for powerpc has a bug where unrelated processes may be able to read/write to one another's virtual memory under certain conditions via an mmap above 512 TB. Only a subset of powerpc systems are affected.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 6 more
CVE-2019-12614

kernel: null pointer dereference in dlpar_parse_cc_property in arch/powerrc/platforms/pseries/dlpar.c causing denial of service

An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 2 more
Products
Ubuntu Linux Fedora Linux Kernel and 2 more
CVE-2019-12529

squid: Out of bounds read in Proxy-Authorization header causes DoS

An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages.

CVSS 3.1 · 5.9 Medium EPSS 7.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2019-12528

squid: Information Disclosure issue in FTP Gateway

An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes.

CVSS 3.1 · 7.5 High EPSS 10.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more