Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,902

Export CSV
CVE-2020-14364

QEMU: usb: out-of-bounds r/w access issue while processing usb packets

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.

CVSS 3.1 · 5.0 Medium EPSS 5.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2020-14355

spice: multiple buffer overflow vulnerabilities in QUIC decoding code

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

CVSS 3.1 · 6.6 Medium EPSS 2.7% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Leap and 9 more
CVE-2020-14352

librepo: missing path validation in repomd.xml may lead to directory traversal

A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.

CVSS 3.1 · 8.0 High EPSS 2.5% KEV · Not listed
Vendors
Fedoraproject Opensuse Redhat
Products
Fedora Backports Sle Leap and 4 more
CVE-2020-14351

kernel: performance counters race condition use-after-free

A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 5 more
CVE-2020-14350

postgresql: Uncontrolled search path element in CREATE EXTENSION

It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Leap and 6 more
CVE-2020-14349

postgresql: Uncontrolled search path element in logical replication

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.

CVSS 3.1 · 7.1 High EPSS 2.2% KEV · Not listed
Vendors
Opensuse Postgresql Redhat
Products
Leap Postgresql Enterprise Linux and 4 more
CVE-2020-14311

grub2: Integer overflow in grub_ext2_read_link leads to heap-based buffer overflow

There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32_MAX causes an arithmetic overflow leading to a zero-sized memory allocation with subsequent heap-based buffer overflow.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Gnu Opensuse and 1 more
Products
Ubuntu Linux Grub2 Leap and 8 more
CVE-2020-14310

grub2: Integer overflow read_section_as_string may lead to heap-based buffer overflow

There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized allocation and further heap-based buffer overflow.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Gnu Opensuse and 1 more
Products
Ubuntu Linux Grub2 Leap and 8 more
CVE-2020-14309

grub2: Integer overflow in grub_squash_read_symlink may lead to heap-based buffer overflow

There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Opensuse Redhat
Products
Grub2 Leap Enterprise Linux and 4 more
CVE-2020-14308

grub2: grub_malloc does not validate allocation size allowing for arithmetic overflow and subsequent heap-based buffer overflow

In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Opensuse Redhat
Products
Grub2 Leap Enterprise Linux and 4 more
CVE-2020-13398

freerdp: Out-of-bounds write in crypto_rsa_common in libfreerdp/crypto/crypto.c

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c.

CVSS 3.1 · 8.3 High EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Freerdp and 2 more
Products
Ubuntu Linux Debian Linux Freerdp and 4 more
CVE-2020-13249

mariadb-connector-c: Improper validation of content in a OK packet received from server

libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.

CVSS 3.1 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Fedoraproject Mariadb Opensuse and 1 more
Products
Fedora Connector\/c Leap and 4 more
CVE-2020-13112

libexif: several buffer over-reads in EXIF MakerNote handling can lead to information disclosure and DoS

An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This is different from CVE-2020-0093.

CVSS 3.1 · 9.1 Critical EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Libexif Project and 2 more
Products
Ubuntu Linux Debian Linux Libexif and 4 more
CVE-2020-12865

sane-backends: Heap buffer overflow in esci2_img

A heap buffer overflow in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to execute arbitrary code, aka GHSL-2020-084.

CVSS 3.1 · 8.0 High EPSS 1.5% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Leap and 4 more
CVE-2020-12861

sane-backends: Heap buffer overflow in epsonds_net_read in epsonds-net.c

A heap buffer overflow in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to execute arbitrary code, aka GHSL-2020-080.

CVSS 3.1 · 8.8 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Opensuse Redhat and 1 more
Products
Ubuntu Linux Leap Enterprise Linux and 3 more
CVE-2020-12770

kernel: sg_write function lacks an sg_remove_request call in a certain failure case

An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failure case, aka CID-83c6f2390040.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 39 more
CVE-2020-12673

dovecot: Out of bound reads in dovecot NTLM implementation

In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read.

CVSS 3.1 · 7.5 High EPSS 6.2% KEV · Not listed
Vendors
Canonical Debian Dovecot and 2 more
Products
Ubuntu Linux Debian Linux Dovecot and 4 more