Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 77

Export CSV
CVE-2019-3836

gnutls: invalid pointer access upon receiving async handshake messages

It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages.

CVSS 3.0 · 5.9 Medium EPSS 3.4% KEV · Not listed
Vendors
Fedoraproject Gnu Opensuse and 1 more
Products
Fedora Gnutls Leap and 1 more
CVE-2019-19553

wireshark: CMS dissector crash (wnpa-sec-2019-22)

In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/asn1/cms/packet-cms-template.c by ensuring that an object identifier is set to NULL after a ContentInfo dissection.

CVSS 3.1 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Debian Opensuse Oracle and 1 more
Products
Debian Linux Leap Solaris and 2 more
CVE-2019-18786

kernel: memory disclosure in rcar_drif_g_fmt_sdr_cap in drivers/media/platform/rcar_drif.c

In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is uninitialized in rcar_drif_g_fmt_sdr_cap in drivers/media/platform/rcar_drif.c, which could cause a memory disclosure problem.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux
Products
Ubuntu Linux Linux Kernel
CVE-2019-12979

imagemagick: use of uninitialized value in functionSyncImageSettings in MagickCore/image.c

ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage in magick/image.c.

CVSS 3.1 · 7.8 High EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Imagemagick and 2 more
Products
Ubuntu Linux Debian Linux Imagemagick and 2 more
CVE-2019-12978

imagemagick: use of uninitialized value in function ReadPANGOImage in coders/pango.c

ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the ReadPANGOImage function in coders/pango.c.

CVSS 3.0 · 7.8 High EPSS 1.9% KEV · Not listed
Vendors
Imagemagick Redhat
Products
Imagemagick Enterprise Linux
CVE-2019-12977

imagemagick: use of uninitialised value in function WriteJP2Image in coders/jp2.c

ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the WriteJP2Image function in coders/jp2.c.

CVSS 3.0 · 7.8 High EPSS 1.9% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2019-11833

kernel: fs/ext4/extents.c leads to information disclosure

fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 13 more
CVE-2019-11498

wavpack: Use of uninitialized variable in WavpackSetConfiguration64 leads to DoS

WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 2 more
CVE-2018-19626

wireshark: DCOM dissector crash resulting in information leak

In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the DCOM dissector could crash. This was addressed in epan/dissectors/packet-dcom.c by adding '\0' termination.

CVSS 3.0 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Wireshark
Products
Debian Linux Wireshark
CVE-2018-15911

ghostscript: Uninitialized memory access in the aesdecode operator (699665)

In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code.

CVSS 3.0 · 7.8 High EPSS 3.0% KEV · Not listed
Vendors
Artifex Canonical Debian and 2 more
Products
Ghostscript Gpl Ghostscript Ubuntu Linux and 9 more
CVE-2018-14641

kernel: a bug in ip_frag_reasm() can cause a crash in ip_do_fragment()

A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel from 4.19-rc1 to 4.19-rc3 inclusive, which can cause a later system crash in ip_do_fragment(). With certain non-default, but non-rare, configuration of a victim host, an attacker can trigger this crash remotely, thus leading to a remote denial-of-service.

CVSS 3.0 · 6.5 Medium EPSS 2.9% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2018-14551

ImageMagick: Uninitialized variable in coders/mat.c:ReadMATImageV4() allows for memory corruption

The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption.

CVSS 3.0 · 9.8 Critical EPSS 4.0% KEV · Not listed
Vendors
Canonical Imagemagick
Products
Ubuntu Linux Imagemagick
CVE-2018-11508

kernel: Missing initialization in kernel/compat.c:compat_get_timex() allows local attacker to obtain possibly sensitive information via adjtimex

The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensitive information from kernel memory via adjtimex.

CVSS 3.0 · 5.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Linux
Products
Ubuntu Linux Linux Kernel
CVE-2017-7777

graphite2: use of uninitialized memory "graphite2::GlyphCache::Loader::read_glyph"

Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function.

CVSS 3.0 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Mozilla Redhat Sil
Products
Firefox Enterprise Linux Graphite2
CVE-2017-10988

freeradius: Incorrectly created 'signed' attributes

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

CVSS 3.0 · 3.7 Low EPSS n/a KEV · Not listed
Vendors
—
Products
—