Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,348

Export CSV
CVE-2020-14364

QEMU: usb: out-of-bounds r/w access issue while processing usb packets

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.

CVSS 3.1 · 5.0 Medium EPSS 5.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2020-14351

kernel: performance counters race condition use-after-free

A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 5 more
CVE-2020-14311

grub2: Integer overflow in grub_ext2_read_link leads to heap-based buffer overflow

There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32_MAX causes an arithmetic overflow leading to a zero-sized memory allocation with subsequent heap-based buffer overflow.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Gnu Opensuse and 1 more
Products
Ubuntu Linux Grub2 Leap and 8 more
CVE-2020-14310

grub2: Integer overflow read_section_as_string may lead to heap-based buffer overflow

There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized allocation and further heap-based buffer overflow.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Gnu Opensuse and 1 more
Products
Ubuntu Linux Grub2 Leap and 8 more
CVE-2020-14309

grub2: Integer overflow in grub_squash_read_symlink may lead to heap-based buffer overflow

There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Opensuse Redhat
Products
Grub2 Leap Enterprise Linux and 4 more
CVE-2020-14308

grub2: grub_malloc does not validate allocation size allowing for arithmetic overflow and subsequent heap-based buffer overflow

In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Opensuse Redhat
Products
Grub2 Leap Enterprise Linux and 4 more
CVE-2020-12770

kernel: sg_write function lacks an sg_remove_request call in a certain failure case

An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failure case, aka CID-83c6f2390040.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 39 more
CVE-2020-12654

kernel: heap-based buffer overflow in mwifiex_ret_wmm_get_status function in drivers/net/wireless/marvell/mwifiex/wmm.c

An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591.

CVSS 3.1 · 7.1 High EPSS 1.2% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 5 more
CVE-2020-12653

kernel: buffer overflow in mwifiex_cmd_append_vsie_tlv function in drivers/net/wireless/marvell/mwifiex/scan.c

An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of an incorrect memcpy and buffer overflow, aka CID-b70261a288ea.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp and 2 more
Products
Debian Linux Linux Kernel A700s and 39 more
CVE-2020-12403

nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

CVSS 3.1 · 9.1 Critical EPSS 1.5% KEV · Not listed
Vendors
Mozilla Redhat
Products
Nss Enterprise Linux Openshift Do and 4 more
CVE-2020-12362

kernel: Integer overflow in Intel(R) Graphics Drivers

Integer overflow in the firmware for some Intel(R) Graphics Drivers for Windows * before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable an escalation of privilege via local access.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Intel Linux Redhat
Products
Graphics Drivers Linux Kernel Enterprise Linux and 6 more
CVE-2020-12352

kernel: net: bluetooth: information leak when processing certain AMP packets

Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access.

CVSS 3.1 · 6.5 Medium EPSS 5.8% KEV · Not listed
Vendors
Bluez Linux Redhat
Products
Bluez Linux Kernel Enterprise Linux and 5 more
CVE-2020-12351

kernel: net: bluetooth: type confusion while processing AMP packets

Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.

CVSS 3.1 · 8.8 High EPSS 7.8% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Aus and 4 more
CVE-2020-10713

grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process

A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.2 High EPSS 1.7% KEV · Not listed
Vendors
Debian Gnu Opensuse and 2 more
Products
Debian Linux Grub2 Leap and 7 more
CVE-2020-10711

Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category may cause kernel panic

A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service.

CVSS 3.1 · 5.9 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 14 more
CVE-2020-0543

hw: Special Register Buffer Data Sampling (SRBDS)

Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Intel and 4 more
Products
Ubuntu Linux Fedora Celeron 1000m and 721 more
CVE-2020-0466

kernel: use after free in eventpoll.c may lead to escalation of privilege

In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147802478References: Upstream kernel

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Android Enterprise Linux Rhel Aus and 5 more