CVE-2019-12519

squid: improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow

An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack won't overflow.

CVSS 3.1 · 9.8 Critical EPSS 6.7% KEV · Not listed

Vendors

Canonical Debian Opensuse and 2 more

Products

Ubuntu Linux Debian Linux Leap and 4 more

CVE-2019-12382

kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service

An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5. There is an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: The vendor disputes this issues as not being a vulnerability because kstrdup() returning NULL is handled sufficiently and there is no chance for a NULL pointer dereference

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2019-11811

kernel: use-after-free in drivers/char/ipmi/ipmi_si_intf.c, ipmi_si_mem_io.c, ipmi_si_port_io.c

An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module is removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux Opensuse Redhat

Products

Linux Kernel Leap Enterprise Linux and 12 more

CVE-2019-11810

kernel: a NULL pointer dereference in drivers/scsi/megaraid/megaraid_sas_base.c leading to DoS

An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free.

CVSS 3.1 · 7.5 High EPSS 5.8% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 3 more

CVE-2019-11756

nss: Use-after-free in sftk_FreeSession due to improper refcounting

Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Enterprise Linux Openshift Do and 4 more

CVE-2019-11745

nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

CVSS 3.1 · 8.8 High EPSS 3.0% KEV · Not listed

Vendors

Canonical Debian Mozilla and 3 more

Products

Ubuntu Linux Debian Linux Firefox and 26 more

CVE-2019-11599

kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping

The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 5 more

CVE-2019-11487

kernel: Count overflow in FUSE request leading to use-after-free issues.

The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can occur with FUSE requests.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 7 more

CVE-2019-11479

kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of service

Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.

CVSS 3.1 · 7.5 High EPSS 91.3% KEV · Not listed

Vendors

Canonical F5 Linux and 1 more

Products

Ubuntu Linux Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 24 more

CVE-2019-11478

SACK can cause extensive memory use via fragmented resend queue

Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.

CVSS 3.0 · 5.3 Medium EPSS 94.4% KEV · Not listed

Vendors

Canonical F5 Ivanti and 3 more

Products

Ubuntu Linux Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 26 more

CVE-2019-11477

Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segs

Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.

CVSS 3.1 · 7.5 High EPSS 98.7% KEV · Not listed

Vendors

Canonical F5 Ivanti and 3 more

Products

Ubuntu Linux Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 26 more

CVE-2019-11085

kernel: insufficient input validation in kernel mode driver in Intel i915 graphics leads to privilege escalation

Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Intel Redhat

Products

I915 I915 Firmware Enterprise Linux and 6 more

CVE-2019-10639

Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR

The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to have a dependency on an address associated with a network namespace.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2019-10221

pki-core: Reflected XSS in getcookies?url= endpoint in CA

A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Dogtagpki Redhat

Products

Dogtagpki Enterprise Linux Rhel Eus

CVE-2019-10208

postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution

A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.

CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed

Vendors

Postgresql Redhat

Products

Postgresql Enterprise Linux Rhel E4s and 2 more

CVE-2019-10179

pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab

A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dogtagpki Redhat

Products

Dogtagpki Enterprise Linux Rhel Eus

CVE-2019-10171

389-ds-base: Insufficient fix for CVE-2018-14648 denial of service in RHEL-7.5

It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacker would still be able to provoke excessive CPU consumption leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

389 Directory Server Enterprise Linux Server Eus Rhel Eus

CVE-2019-10164

postgresql: Stack-based buffer overflow via setting a password

PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.

CVSS 3.1 · 8.8 High EPSS 3.6% KEV · Not listed

Vendors

Fedoraproject Opensuse Postgresql and 1 more

Products

Fedora Leap Postgresql and 4 more

CVE-2019-10146

pki-core: Reflected XSS in 'path length' constraint field in CA's Agent page

A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Dogtagpki Redhat

Products

Dogtagpki Enterprise Linux Rhel Eus

CVE-2019-10130

postgresql: Selectivity estimators bypass row security policies

A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Opensuse Postgresql Redhat

Products

Leap Postgresql Enterprise Linux and 3 more