CVE-2020-10751

kernel: SELinux netlink permission check bypass

A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Kernel Redhat

Products

Selinux Enterprise Linux Enterprise Linux Server and 1 more

CVE-2020-10711

Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category may cause kernel panic

A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service.

CVSS 3.1 · 5.9 Medium EPSS 3.1% KEV · Not listed

Vendors

Canonical Debian Linux and 2 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 14 more

CVE-2019-9959

poppler: integer overflow in JPXStream::init function leading to memory consumption

The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Debian Fedoraproject Freedesktop and 1 more

Products

Debian Linux Fedora Poppler and 4 more

CVE-2019-9903

poppler: stack consumption in function Dict::find() in Dict.cc

PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.

CVSS 3.1 · 6.5 Medium EPSS 2.4% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 5 more

CVE-2019-9755

ntfs-3g: heap-based buffer overflow leads to local root privilege escalation

An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Redhat Tuxera

Products

Advanced Virtualization Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2019-9506

Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.

CVSS 3.1 · 8.1 High EPSS 2.9% KEV · Not listed

Vendors

Apple Blackberry Canonical and 5 more

Products

Iphone Os Mac Os X Tvos and 277 more

CVE-2019-8846

webkitgtk: Use after free issue may lead to remote code execution

A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 13.3, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows, iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Ipados Iphone Os and 7 more

CVE-2019-8844

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3, watchOS 6.1.1, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows, iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Ipados Iphone Os and 8 more

CVE-2019-8835

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows, iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Ipados Iphone Os and 7 more

CVE-2019-8816

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.6% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Ipados Iphone Os and 8 more

CVE-2019-8815

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.3% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Ipados Iphone Os and 7 more

CVE-2019-8814

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Ipados Iphone Os and 7 more

CVE-2019-8689

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 13.6% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 8 more

CVE-2019-8688

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.3% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 8 more

CVE-2019-8684

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.4% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 8 more

CVE-2019-8676

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 8 more

CVE-2019-8672

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 11.1% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 8 more

CVE-2019-8669

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.6% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 8 more

CVE-2019-8544

webkitgtk: malicious crafted web content leads to arbitrary we content

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.3% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 7 more

CVE-2019-8536

webkitgtk: malicious crafted web content leads to arbitrary code execution

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.1% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 7 more