CVE-2020-25723

QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c

A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed

Vendors

Debian Qemu Redhat

Products

Debian Linux Qemu Advanced Virtualization and 2 more

CVE-2020-25719

samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets

A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.

CVSS 3.1 · 7.2 High EPSS 1.7% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 15 more

CVE-2020-25717

samba: Active Directory (AD) domain user could become root on domain members

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.

CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 25 more

CVE-2020-25715

pki-core: XSS in the certificate search results

A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity.

CVSS 3.1 · 6.1 Medium EPSS 1.1% KEV · Not listed

Vendors

Dogtagpki Redhat

Products

Dogtagpki Enterprise Linux Rhel Eus

CVE-2020-25705

kernel: ICMP rate limiting can be used for DNS poisoning attack

A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version

CVSS 3.1 · 7.4 High EPSS 6.7% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Aus and 4 more

CVE-2020-25704

kernel: perf_event_parse_addr_filter memory

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Linux Redhat and 1 more

Products

Debian Linux Linux Kernel Enterprise Linux and 6 more

CVE-2020-25696

postgresql: psql's \gset allows overwriting specially treated variables

A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed

Vendors

Debian Postgresql Redhat

Products

Debian Linux Postgresql Enterprise Linux and 3 more

CVE-2020-25695

postgresql: Multiple features escape "security restricted operation" sandbox

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.8 High EPSS 46.4% KEV · Not listed

Vendors

Debian Postgresql Redhat

Products

Debian Linux Postgresql Enterprise Linux and 3 more

CVE-2020-25694

postgresql: Reconnection can downgrade connection security settings

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.1 High EPSS 1.6% KEV · Not listed

Vendors

Debian Postgresql Redhat

Products

Debian Linux Postgresql Enterprise Linux and 3 more

CVE-2020-25654

pacemaker: ACL restrictions bypass

An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.

CVSS 3.1 · 7.2 High EPSS 1.9% KEV · Not listed

Vendors

Clusterlabs Debian Redhat

Products

Pacemaker Debian Linux Enterprise Linux and 1 more

CVE-2020-25647

grub2: Out-of-bounds write in grub_usb_device_initialize()

A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and assumes the USB device is providing sane values. If properly exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Gnu Netapp and 1 more

Products

Fedora Grub2 Ontap Select Deploy Administration Utility and 9 more

CVE-2020-25641

kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS

A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 2 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 3 more

CVE-2020-25632

grub2: Use-after-free in rmmod command

A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.2 High EPSS 1.2% KEV · Not listed

Vendors

Fedoraproject Gnu Netapp and 1 more

Products

Fedora Grub2 Ontap Select Deploy Administration Utility and 9 more

CVE-2020-25613

ruby: Potential HTTP request smuggling in WEBrick

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Fedoraproject Redhat Ruby-lang

Products

Fedora Enterprise Linux Rhel E4s and 4 more

CVE-2020-25219

libproxy: uncontrolled recursion via an infinite stream response leading to stack exhaustion

url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character. This leads to stack exhaustion.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 3 more

CVE-2020-25212

kernel: TOCTOU mismatch in the NFS client code

A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 2 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 7 more

CVE-2020-25211

kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c

In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 6 more

CVE-2020-25097

squid: improper input validation may allow a trusted client to perform HTTP request smuggling

An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.

CVSS 3.1 · 8.6 High EPSS 7.3% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 2 more

Products

Debian Linux Fedora Cloud Manager and 3 more

CVE-2020-24394

kernel: umask not applied on filesystem without ACL support

In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Opensuse and 3 more

Products

Ubuntu Linux Linux Kernel Leap and 8 more

CVE-2020-22219

flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder

Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to run arbitrary code via crafted input to the encoder.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Flac Project Redhat

Products

Flac Enterprise Linux Rhel Aus and 3 more