Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,351

Export CSV
CVE-2020-13361

QEMU: es1370: OOB access due to incorrect frame count leads to DoS

In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Opensuse and 1 more
Products
Ubuntu Linux Debian Linux Leap and 1 more
CVE-2020-13254

django: potential data leakage via malformed memcached keys

An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.

CVSS 3.1 · 5.9 Medium EPSS 6.1% KEV · Not listed
Vendors
Canonical Debian Djangoproject and 4 more
Products
Ubuntu Linux Debian Linux Django and 5 more
CVE-2020-13253

QEMU: sd: OOB access could crash the guest resulting in DoS

sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2020-13143

kernel: usb: gadget: illegal array access in binding with UDC

gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4.

CVSS 3.1 · 6.5 Medium EPSS 5.2% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 35 more
CVE-2020-13114

libexif: unrestricted size in handling Canon EXIF MakerNote data can lead to consumption of large amounts of compute time

An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Canonical Libexif Project Opensuse and 1 more
Products
Ubuntu Linux Libexif Leap and 1 more
CVE-2020-13113

libexif: use of uninitialized memory in EXIF Makernote handling can lead to crashes and use-after-free

An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.

CVSS 3.1 · 8.2 High EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Libexif Project and 2 more
Products
Ubuntu Linux Debian Linux Libexif and 2 more
CVE-2020-13112

libexif: several buffer over-reads in EXIF MakerNote handling can lead to information disclosure and DoS

An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This is different from CVE-2020-0093.

CVSS 3.1 · 9.1 Critical EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Libexif Project and 2 more
Products
Ubuntu Linux Debian Linux Libexif and 4 more
CVE-2020-12867

sane-backends: NULL pointer dereference in sanei_epson_net_read function

A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2020-12866

sane-backends: null pointer dereference in epsonds_net_read in epsonds-net.c

A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, GHSL-2020-079.

CVSS 3.1 · 5.7 Medium EPSS 1.0% KEV · Not listed
Vendors
Canonical Opensuse Sane-project
Products
Ubuntu Linux Leap Sane Backends
CVE-2020-12865

sane-backends: Heap buffer overflow in esci2_img

A heap buffer overflow in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to execute arbitrary code, aka GHSL-2020-084.

CVSS 3.1 · 8.0 High EPSS 1.5% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Leap and 4 more
CVE-2020-12864

sane-backends: Reading uninitialized data in epsonds_net_read in epsonds-net.c

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-081.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Opensuse Sane-project
Products
Ubuntu Linux Leap Sane Backends
CVE-2020-12863

sane-backends: Out-of-bounds read in esci2_check_header

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-083.

CVSS 3.1 · 4.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Canonical Debian Opensuse and 1 more
Products
Ubuntu Linux Debian Linux Leap and 1 more
CVE-2020-12862

sane-backends: Out-of-bounds read in decode_binary

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-082.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian Opensuse and 1 more
Products
Ubuntu Linux Debian Linux Leap and 1 more
CVE-2020-12861

sane-backends: Heap buffer overflow in epsonds_net_read in epsonds-net.c

A heap buffer overflow in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to execute arbitrary code, aka GHSL-2020-080.

CVSS 3.1 · 8.8 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Opensuse Redhat and 1 more
Products
Ubuntu Linux Leap Enterprise Linux and 3 more
CVE-2020-12829

qemu: OOB read and write due to integer overflow in sm501_2d_operation() in hw/display/sm501.c

In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2020-12826

kernel: possible to send arbitrary signals to a privileged (suidroot) parent process

A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. Because exec_id in include/linux/sched.h is only 32 bits, an integer overflow can interfere with a do_notify_parent protection mechanism. A child process can send an arbitrary signal to a parent process in a different security domain. Exploitation limitations include the amount of elapsed time before an integer overflow occurs, and the lack of scenarios where signals to a parent process present a substantial operational threat.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 2 more
CVE-2020-12783

exim: out-of-bounds read in the SPA authenticator can lead to SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c

Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Exim and 1 more
Products
Ubuntu Linux Debian Linux Exim and 1 more
CVE-2020-12771

kernel: deadlock if a coalescing operation fails in btree_gc_coalesce function in drivers/md/bcache/btree.c

An issue was discovered in the Linux kernel through 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c has a deadlock if a coalescing operation fails.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 34 more
CVE-2020-12770

kernel: sg_write function lacks an sg_remove_request call in a certain failure case

An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failure case, aka CID-83c6f2390040.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 39 more