Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,351

Export CSV
CVE-2019-13224

oniguruma: Use-after-free in onig_new_deluxe() in regext.c

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

CVSS 3.1 · 9.8 Critical EPSS 4.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 4 more
CVE-2019-13164

Qemu: qemu-bridge-helper ACL can be bypassed when names are too long

qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Opensuse and 1 more
Products
Ubuntu Linux Debian Linux Leap and 1 more
CVE-2019-13132

zeromq: stack-overflow on any server protected by encryption/authentication

In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.

CVSS 3.1 · 9.8 Critical EPSS 42.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 1 more
Products
Ubuntu Linux Debian Linux Fedora and 1 more
CVE-2019-13114

exiv2: null-pointer dereference in http.c causing denial of service

http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted response that lacks a space character.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Exiv2 and 2 more
Products
Ubuntu Linux Debian Linux Exiv2 and 2 more
CVE-2019-13113

exiv2: invalid data location in CRW image file causing denial of service

Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW image file.

CVSS 3.1 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Exiv2 Fedoraproject and 1 more
Products
Ubuntu Linux Exiv2 Fedora and 1 more
CVE-2019-13112

exiv2: uncontrolled memory allocation in PngChunk::parseChunkContent causing denial of service

A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to an std::bad_alloc exception) via a crafted PNG image file.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Exiv2 and 2 more
Products
Ubuntu Linux Debian Linux Exiv2 and 2 more
CVE-2019-13110

exiv2: integer-overflow and out-of-bounds read in CiffDirectory::readDirectory leads to denail of service

A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted CRW image file.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Exiv2 and 1 more
Products
Ubuntu Linux Debian Linux Exiv2 and 1 more
CVE-2019-12979

imagemagick: use of uninitialized value in functionSyncImageSettings in MagickCore/image.c

ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage in magick/image.c.

CVSS 3.1 · 7.8 High EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Imagemagick and 2 more
Products
Ubuntu Linux Debian Linux Imagemagick and 2 more
CVE-2019-12881

kernel: NULL pointer dereference in i915_gem_userptr_get_pages allows local denial of service via crafted ioctl calls

i915_gem_userptr_get_pages in drivers/gpu/drm/i915/i915_gem_userptr.c in the Linux kernel 4.15.0 on Ubuntu 18.04.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) or possibly have unspecified other impact via crafted ioctl calls to /dev/dri/card0.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Linux
Products
Ubuntu Linux Linux Kernel
CVE-2019-12854

squid: Denial of service in cachemgr.cgi

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.

CVSS 3.1 · 7.5 High EPSS 11.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2019-12817

kernel: ppc: unrelated processes being able to read/write to each other's virtual memory

arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel before 5.1.15 for powerpc has a bug where unrelated processes may be able to read/write to one another's virtual memory under certain conditions via an mmap above 512 TB. Only a subset of powerpc systems are affected.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 6 more
CVE-2019-12781

Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS

An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.

CVSS 3.0 · 5.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Djangoproject and 1 more
Products
Ubuntu Linux Debian Linux Django and 3 more
CVE-2019-12614

kernel: null pointer dereference in dlpar_parse_cc_property in arch/powerrc/platforms/pseries/dlpar.c causing denial of service

An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 2 more
Products
Ubuntu Linux Fedora Linux Kernel and 2 more
CVE-2019-12529

squid: Out of bounds read in Proxy-Authorization header causes DoS

An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages.

CVSS 3.1 · 5.9 Medium EPSS 7.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2019-12528

squid: Information Disclosure issue in FTP Gateway

An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes.

CVSS 3.1 · 7.5 High EPSS 10.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more