Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,087

Export CSV
CVE-2020-14310

grub2: Integer overflow read_section_as_string may lead to heap-based buffer overflow

There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized allocation and further heap-based buffer overflow.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Gnu Opensuse and 1 more
Products
Ubuntu Linux Grub2 Leap and 8 more
CVE-2020-14309

grub2: Integer overflow in grub_squash_read_symlink may lead to heap-based buffer overflow

There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Opensuse Redhat
Products
Grub2 Leap Enterprise Linux and 4 more
CVE-2020-14308

grub2: grub_malloc does not validate allocation size allowing for arithmetic overflow and subsequent heap-based buffer overflow

In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Opensuse Redhat
Products
Grub2 Leap Enterprise Linux and 4 more
CVE-2020-14305

kernel: memory corruption in Voice over IP nf_conntrack_h323 module

An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 8.1 High EPSS 5.2% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel A250 A250 Firmware and 9 more
CVE-2020-14301

libvirt: leak of sensitive cookie information via dumpxml

An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker to access potentially sensitive information in the domain configuration via the `dumpxml` command.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat
Products
Ontap Select Deploy Administration Utility Advanced Virtualization Codeready Linux Builder and 11 more
CVE-2020-14300

docker: Security regression of CVE-2016-9962 due to inclusion of vulnerable runc

The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version of runc that was missing multiple bug and security fixes. One of the fixes regressed in that update was the fix for CVE-2016-9962, that was previously corrected in the docker packages in Red Hat Enterprise Linux 7 Extras via RHSA-2017:0116 (https://access.redhat.com/errata/RHSA-2017:0116). The CVE-2020-14300 was assigned to this security regression and it is specific to the docker packages produced by Red Hat. The original issue - CVE-2016-9962 - could possibly allow a process inside container to compromise a process entering container namespace and execute arbitrary code outside of the container. This could lead to compromise of the container host or other containers running on the same container host. This issue only affects a single version of Docker, 1.13.1-108.git4ef4b30, shipped in Red Hat Enterprise Linux 7. Both earlier and later versions are not affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Docker Redhat
Products
Docker Enterprise Linux Server Rhel Extras Other
CVE-2020-14298

docker: Security regression of CVE-2019-5736 due to inclusion of vulnerable runc

The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. This issue only affects docker version 1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Docker Redhat
Products
Docker Enterprise Linux Server Openshift Container Platform and 1 more
CVE-2020-14058

squid: DoS in TLS handshake

An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Fedoraproject Netapp Redhat and 1 more
Products
Fedora Cloud Manager Enterprise Linux and 1 more
CVE-2020-14040

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Text 3scale Amp and 13 more
CVE-2020-14019

python-rtslib: weak permissions for /etc/target/saveconfig.json

Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Rtslib-fb Project
Products
Enterprise Linux Rtslib-fb
CVE-2020-13987

Open-iSCSI: OOB read in checksum calculation in uIP

An issue was discovered in Contiki through 3.0. An Out-of-Bounds Read vulnerability exists in the uIP TCP/IP Stack component when calculating the checksums for IP packets in upper_layer_chksum in net/ipv4/uip.c.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Contiki-os Open-iscsi Project Redhat and 2 more
Products
Contiki Open-iscsi Enterprise Linux and 9 more
CVE-2020-13974

kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c

An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in the community argue that the integer overflow does not lead to a security issue in this case.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 1 more
CVE-2020-13962

qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS applications

Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1 is not affected, regardless of the Qt version.)

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Fedoraproject Mumble Opensuse and 2 more
Products
Fedora Mumble Leap and 2 more
CVE-2020-13950

mod_proxy_http NULL pointer dereference

Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service

CVSS 3.1 · 7.5 High EPSS 50.0% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 2 more
Products
Http Server Debian Linux Fedora and 5 more
CVE-2020-13765

QEMU: loader: OOB access while loading registered ROM may lead to code execution

rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.

CVSS 3.1 · 5.6 Medium EPSS 2.5% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 1 more
CVE-2020-13754

QEMU: msix: OOB access during mmio operations may lead to DoS

hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 2 more
CVE-2020-13584

webkitgtk: use-after-free may lead to arbitrary code execution

An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML web page can cause a use-after-free condition, resulting in a remote code execution. The victim needs to visit a malicious web site to trigger this vulnerability.

CVSS 3.1 · 8.8 High EPSS 4.9% KEV · Not listed
Vendors
Fedoraproject Redhat Webkitgtk
Products
Fedora Enterprise Linux Rhel Els and 1 more