CVE-2019-9500

Broadcom brcmfmac driver is vulnerable to a heap buffer overflow

The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets to compromise the host, or when used in combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.

CVSS 3.1 · 7.9 High EPSS 3.9% KEV · Not listed

Vendors

Broadcom Linux Redhat

Products

Brcmfmac Driver Linux Kernel Enterprise Linux and 2 more

CVE-2019-9458

kernel: use after free due to race condition in the video driver leads to local privilege escalation

In the Android kernel in the video driver there is a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Google Opensuse Redhat

Products

Android Leap Enterprise Linux and 1 more

CVE-2019-9456

kernel: OOB write due to missing bounds check leads to local privilege escalation

In the Android kernel in Pixel C USB monitor driver there is a possible OOB write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Google Opensuse Redhat

Products

Android Leap Enterprise Linux and 1 more

CVE-2019-9455

kernel: kernel pointer leak due to WARN_ON statement in video driver leads to local information disclosure

In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Google Opensuse Redhat

Products

Android Leap Enterprise Linux

CVE-2019-9454

kernel: out of bounds write in i2c driver leads to local escalation of privilege

In the Android kernel in i2c driver there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Android Enterprise Linux Rhel Aus and 4 more

CVE-2019-9433

libvpx: Use-after-free in vp8_deblock() in vp8/common/postproc.c

In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354

CVSS 3.1 · 6.5 Medium EPSS 3.0% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 3 more

CVE-2019-9371

libvpx: Resource exhaustion after memory leak in mkvparser.cc

In libvpx, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-132783254

CVSS 3.1 · 6.5 Medium EPSS 3.0% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 3 more

CVE-2019-9278

libexif: out of bounds write in exif-data.c

In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774

CVSS 3.1 · 8.8 High EPSS 4.1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 3 more

CVE-2019-9232

libvpx: Out of bounds read in vp8_norm table

In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-122675483

CVSS 3.1 · 7.5 High EPSS 4.9% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 3 more

CVE-2019-9213

kernel: lack of check for mmap minimum address in expand_downwards in mm/mmap.c leads to NULL pointer dereferences exploit on non-SMAP platforms

In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.

CVSS 3.1 · 5.5 Medium EPSS 5.7% KEV · Not listed

Vendors

Canonical Debian Linux and 2 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 2 more

CVE-2019-9210

advancecomp: integer overflow in png_compress in pngex.cc

In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed

Vendors

Advancemame Canonical Debian and 2 more

Products

Advancecomp Ubuntu Linux Debian Linux and 2 more

CVE-2019-9200

poppler: heap-based buffer overflow in function ImageStream::getLine() in Stream.cc

A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.

CVSS 3.0 · 8.8 High EPSS 3.5% KEV · Not listed

Vendors

Canonical Debian Freedesktop and 1 more

Products

Ubuntu Linux Debian Linux Poppler and 1 more

CVE-2019-9143

exiv2: infinite recursion in Exiv2::Image::printTiffStructure in file image.cpp resulting in denial of service

An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file image.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.

CVSS 3.0 · 8.8 High EPSS 2.8% KEV · Not listed

Vendors

Exiv2 Redhat

Products

Exiv2 Enterprise Linux

CVE-2019-9024

php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.

CVSS 3.0 · 7.5 High EPSS 7.1% KEV · Not listed

Vendors

Canonical Debian Netapp and 3 more

Products

Ubuntu Linux Debian Linux Storage Automation Store and 4 more

CVE-2019-9023

php: Heap-based buffer over-read in mbstring regular expression functions

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.

CVSS 3.0 · 9.8 Critical EPSS 9.3% KEV · Not listed

Vendors

Canonical Debian Netapp and 3 more

Products

Ubuntu Linux Debian Linux Storage Automation Store and 4 more

CVE-2019-9022

php: memcpy with negative length via crafted DNS response

An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries.

CVSS 3.0 · 7.5 High EPSS 4.2% KEV · Not listed

Vendors

Canonical Debian Netapp and 2 more

Products

Ubuntu Linux Debian Linux Storage Automation Store and 3 more

CVE-2019-9021

php: Heap-based buffer over-read in PHAR reading functions

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.

CVSS 3.0 · 9.8 Critical EPSS 10.1% KEV · Not listed

Vendors

Canonical Debian Netapp and 3 more

Products

Ubuntu Linux Debian Linux Storage Automation Store and 4 more

CVE-2019-9020

php: Invalid memory access in function xmlrpc_decode()

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.

CVSS 3.0 · 9.8 Critical EPSS 10.1% KEV · Not listed

Vendors

Canonical Debian Netapp and 3 more

Products

Ubuntu Linux Debian Linux Storage Automation Store and 4 more

CVE-2019-9003

kernel: use-after-free and OOPS in drivers/char/ipmi/ipmi_msghandler.c

In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a "service ipmievd restart" loop.

CVSS 3.1 · 7.5 High EPSS 4.8% KEV · Not listed

Vendors

Canonical Linux Netapp and 2 more

Products

Ubuntu Linux Linux Kernel Cn1610 and 6 more

CVE-2019-8980

kernel: memory leak in the kernel_read_file function in fs/exec.c allows to cause a denial of service

A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.

CVSS 3.1 · 7.5 High EPSS 5.9% KEV · Not listed

Vendors

Canonical Debian Linux and 2 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 2 more