CVE-2019-8688

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.3% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 8 more

CVE-2019-8684

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.4% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 8 more

CVE-2019-8676

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 8 more

CVE-2019-8672

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 11.1% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 8 more

CVE-2019-8669

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.6% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 8 more

CVE-2019-8544

webkitgtk: malicious crafted web content leads to arbitrary we content

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.3% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 7 more

CVE-2019-8536

webkitgtk: malicious crafted web content leads to arbitrary code execution

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.1% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 7 more

CVE-2019-8535

webkitgtk: malicious crafted web content leads to arbitrary code execution

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 6 more

CVE-2019-8308

flatpak: potential /proc based sandbox escape

Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.

CVSS 3.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Debian Flatpak Redhat

Products

Debian Linux Flatpak Enterprise Linux and 6 more

CVE-2019-7845

flash-plugin: Arbitrary Code Execution vulnerability (APSB19-30)

Adobe Flash Player versions 32.0.0.192 and earlier, 32.0.0.192 and earlier, and 32.0.0.192 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 5.5% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Macos Chrome Os and 8 more

CVE-2019-7837

flash-plugin: Arbitrary Code Execution vulnerability (APSB19-26)

Adobe Flash Player versions 32.0.0.171 and earlier, 32.0.0.171 and earlier, and 32.0.0.171 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

CVSS 3.0 · 8.8 High EPSS 9.7% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 9 more

CVE-2019-7665

elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c

In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Canonical Debian Elfutils Project and 2 more

Products

Ubuntu Linux Debian Linux Elfutils and 9 more

CVE-2019-7664

elfutils: out of bound write in elf_cvt_note in libelf/note_xlate.h

In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).

CVSS 3.1 · 5.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Elfutils Project Redhat

Products

Elfutils Ansible Tower Enterprise Linux and 6 more

CVE-2019-7310

poppler: heap-based buffer over-read in XRef::getEntry in XRef.cc

In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 8 more

CVE-2019-7222

Kernel: KVM: leak of uninitialized stack contents to guest

The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 16 more

CVE-2019-7221

Kernel: KVM: nVMX: use-after-free of the hrtimer for emulation of the preemption timer

The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 17 more

CVE-2019-7150

elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c

An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Canonical Debian Elfutils Project and 2 more

Products

Ubuntu Linux Debian Linux Elfutils and 9 more

CVE-2019-6974

Kernel: KVM: potential use-after-free via kvm_ioctl_create_device()

In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.

CVSS 3.1 · 8.1 High EPSS 16.5% KEV · Not listed

Vendors

Canonical Debian F5 and 2 more

Products

Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 26 more

CVE-2019-6454

systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash

An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).

CVSS 3.1 · 5.5 Medium EPSS 2.0% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 5 more

Products

Ubuntu Linux Debian Linux Fedora and 23 more

CVE-2019-6133

polkit: Temporary auth hijacking via PID reuse and non-atomic fork

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

CVSS 3.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Polkit Project and 1 more

Products

Ubuntu Linux Debian Linux Polkit and 9 more