CVE-2019-0205

thrift: Endless loop when feed with specific input data

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.

CVSS 3.1 · 7.5 High EPSS 9.2% KEV · Not listed

Vendors

Apache Oracle Redhat

Products

Thrift Communications Cloud Native Core Network Slice Selection Function Enterprise Linux Server and 6 more

CVE-2019-0160

edk2: Buffer overflows in PartitionDxe and UdfDxe with long file names and invalid UDF media

Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed

Vendors

Fedoraproject Opensuse Redhat and 1 more

Products

Fedora Leap Enterprise Linux and 5 more

CVE-2019-0155

hw: Intel GPU blitter manipulation can allow for arbitrary kernel memory write

Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6, E-2100 and E-2200 Processor Families; Intel(R) Graphics Driver for Windows before 26.20.100.6813 (DCH) or 26.20.100.6812 and before 21.20.x.5077 (aka15.45.5077), i915 Linux Driver for Intel(R) Processor Graphics before versions 5.4-rc7, 5.3.11, 4.19.84, 4.14.154, 4.9.201, 4.4.201 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Intel Redhat

Products

Ubuntu Linux Atom X5-e3930 Atom X5-e3930 Firmware and 713 more

CVE-2018-9568

kernel: Memory corruption due to incorrect socket cloning

In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-113509306. References: Upstream kernel.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Google Linux and 1 more

Products

Ubuntu Linux Android Linux Kernel and 13 more

CVE-2018-8976

exiv2: out-of-bounds read in Exiv2::Internal::stringFormat image.cpp

In Exiv2 0.26, jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringFormat out-of-bounds read) via a crafted file.

CVSS 3.1 · 6.5 Medium EPSS 2.1% KEV · Not listed

Vendors

Debian Exiv2 Redhat

Products

Debian Linux Exiv2 Enterprise Linux and 3 more

CVE-2018-8945

binutils: Crash in elf.c:bfd_section_from_shdr() with crafted executable

The bfd_section_from_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (segmentation fault) via a large attribute section.

CVSS 3.0 · 5.5 Medium EPSS 2.0% KEV · Not listed

Vendors

Gnu Redhat

Products

Binutils Enterprise Linux Enterprise Linux Desktop and 2 more

CVE-2018-8905

libtiff: heap-based buffer overflow in tif_lzw.c:LZWDecodeCompat() allows for denial of service

In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps.

CVSS 3.1 · 8.8 High EPSS 3.1% KEV · Not listed

Vendors

Canonical Debian Libtiff and 1 more

Products

Ubuntu Linux Debian Linux Libtiff and 4 more

CVE-2018-8897

Kernel: error in exception handling leads to DoS

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.

CVSS 3.0 · 7.8 High EPSS 18.5% KEV · Not listed

Vendors

Apple Canonical Citrix and 5 more

Products

Mac Os X Ubuntu Linux Xenserver and 16 more

CVE-2018-8787

freerdp: Integer overflow leading to heap-based buffer overflow in gdi_Bitmap_Decompress() function

FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_Decompress() and results in a memory corruption and probably even a remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 8.4% KEV · Not listed

Vendors

Canonical Debian Freerdp and 1 more

Products

Ubuntu Linux Debian Linux Freerdp and 7 more

CVE-2018-8786

freerdp: Integer truncation leading to heap-based buffer overflow in update_read_bitmap_update() function

FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 8.2% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 8 more

CVE-2018-8781

kernel: Integer overflow in drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() can allow attackers to execute code in kernel space

The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel version 3.4 and up to and including 4.15 has an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 5 more

CVE-2018-8088

slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.

CVSS 3.1 · 9.8 Critical EPSS 14.7% KEV · Not listed

Vendors

Oracle Qos Redhat

Products

Goldengate Application Adapters Goldengate Stream Analytics Utilities Framework and 20 more

CVE-2018-7858

QEMU: cirrus: OOB access when updating VGA display

Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Opensuse Qemu and 1 more

Products

Ubuntu Linux Leap Qemu and 8 more

CVE-2018-7750

python-paramiko: Authentication bypass in transport.py

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

CVSS 3.1 · 9.8 Critical EPSS 27.1% KEV · Not listed

Vendors

Debian Paramiko Redhat

Products

Debian Linux Paramiko Ansible Engine and 15 more

CVE-2018-7740

kernel: Denial of service in resv_map_release function in mm/hugetlb.c

The resv_map_release function in mm/hugetlb.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (BUG) via a crafted application that makes mmap system calls and has a large pgoff argument to the remap_file_pages system call.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 6 more

CVE-2018-7643

binutils: Integer overflow in the display_debug_ranges function resulting in crash

The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, as demonstrated by objdump.

CVSS 3.0 · 7.8 High EPSS 2.3% KEV · Not listed

Vendors

Gnu Redhat

Products

Binutils Enterprise Linux Enterprise Linux Desktop and 2 more

CVE-2018-7642

binutils: NULL pointer dereference in swap_std_reloc_in function in aoutx.h resulting in crash

The swap_std_reloc_in function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (aout_32_swap_std_reloc_out NULL pointer dereference and application crash) via a crafted ELF file, as demonstrated by objcopy.

CVSS 3.0 · 5.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Gnu Redhat

Products

Binutils Enterprise Linux Enterprise Linux Desktop and 2 more

CVE-2018-7569

binutils: integer underflow or overflow via an ELF file with a corrupt DWARF FORM block in libbfd library

dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer underflow or overflow, and application crash) via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm.

CVSS 3.0 · 5.5 Medium EPSS 2.0% KEV · Not listed

Vendors

Gnu Redhat

Products

Binutils Enterprise Linux Enterprise Linux Desktop and 2 more

CVE-2018-7568

binutils: integer overflow via an ELF file with corrupt dwarf1 debug information in libbfd library

The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm.

CVSS 3.0 · 5.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Gnu Redhat

Products

Binutils Enterprise Linux Enterprise Linux Desktop and 2 more

CVE-2018-7566

kernel: race condition in snd_seq_write() may lead to UAF or OOB-access

The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 3 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 13 more