Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,250

Export CSV
CVE-2019-19807

kernel: use-after-free in sound/core/timer.c

In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 2 more
CVE-2019-19768

kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c

In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer).

CVSS 3.1 · 7.5 High EPSS 4.2% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 5 more
CVE-2019-19532

kernel: malicious USB devices can lead to multiple out-of-bounds write

In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kernel HID drivers, aka CID-d9d4b1e46d95. This affects drivers/hid/hid-axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c, drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c, drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c, drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c, drivers/hid/hid-logitech-hidpp.c, drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c, drivers/hid/hid-tmff.c, and drivers/hid/hid-zpff.c.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Aus and 4 more
CVE-2019-19527

kernel: use-after-free caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver

In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver, aka CID-9c09b214f30e.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Opensuse and 1 more
Products
Debian Linux Linux Kernel Leap and 3 more
CVE-2019-19450

python-reportlab: code injection in paraparser.py allows code execution

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

CVSS 3.1 · 9.8 Critical EPSS 6.0% KEV · Not listed
Vendors
Debian Redhat Reportlab
Products
Debian Linux Enterprise Linux Rhel Aus and 4 more
CVE-2019-19447

kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c

In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list in fs/ext4/super.c.

CVSS 3.1 · 7.8 High EPSS 3.5% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel Active Iq Unified Manager Cloud Backup and 10 more
CVE-2019-19338

Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135)

A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Eus and 1 more
CVE-2019-19204

oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c

An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as fetch_range_quantifier) in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read.

CVSS 3.1 · 7.5 High EPSS 6.9% KEV · Not listed
Vendors
Debian Fedoraproject Oniguruma Project and 1 more
Products
Debian Linux Fedora Oniguruma and 3 more
CVE-2019-19203

oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c

An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.

CVSS 3.1 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Fedoraproject Oniguruma Project Redhat
Products
Fedora Oniguruma Enterprise Linux and 2 more
CVE-2019-19046

kernel: Denial Of Service in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c

A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering ida_simple_get() failure, aka CID-4aa7afb0ee20. NOTE: third parties dispute the relevance of this because an attacker cannot realistically control this failure at probe time

CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed
Vendors
Fedoraproject Linux Opensuse and 1 more
Products
Fedora Linux Kernel Leap and 3 more
CVE-2019-19012

oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read

An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.

CVSS 3.1 · 9.8 Critical EPSS 10.6% KEV · Not listed
Vendors
Debian Fedoraproject Oniguruma Project and 1 more
Products
Debian Linux Fedora Oniguruma and 2 more
CVE-2019-18660

kernel: powerpc: incomplete Spectre-RSB mitigation leads to information exposure

The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 2 more
Products
Ubuntu Linux Fedora Linux Kernel and 4 more
CVE-2019-17666

kernel: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain upper-bound check, leading to a buffer overflow

rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow.

CVSS 3.1 · 8.8 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 7 more
CVE-2019-17133

kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c

In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow.

CVSS 3.1 · 9.8 Critical EPSS 6.7% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 8 more
CVE-2019-17006

nss: Check length of inputs for cryptographic primitives

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Mozilla Netapp Redhat and 1 more
Products
Network Security Services Hci Compute Node Hci Management Node and 24 more
CVE-2019-16255

ruby: Code injection via command argument of Shell#test / Shell#[]

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.

CVSS 3.1 · 8.1 High EPSS 4.2% KEV · Not listed
Vendors
Debian Opensuse Oracle and 2 more
Products
Debian Linux Leap Graalvm and 5 more
CVE-2019-16254

ruby: HTTP response splitting in WEBrick

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.

CVSS 3.1 · 5.3 Medium EPSS 4.6% KEV · Not listed
Vendors
Debian Redhat Ruby-lang
Products
Debian Linux Enterprise Linux Rhel E4s and 3 more
CVE-2019-16201

ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.

CVSS 3.1 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Debian Redhat Ruby-lang
Products
Debian Linux Enterprise Linux Rhel E4s and 3 more