CVE-2019-1349

git: Recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/

A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.

CVSS 3.1 · 8.8 High EPSS 34.0% KEV · Not listed

Vendors

Microsoft Redhat

Products

Visual Studio 2017 Visual Studio 2019 Enterprise Linux and 2 more

CVE-2019-1348

git: Arbitrary path overwriting via export-marks in-stream command feature

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Git-scm Opensuse Redhat

Products

Git Leap Enterprise Linux and 2 more

CVE-2019-19768

kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c

In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer).

CVSS 3.1 · 7.5 High EPSS 4.2% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 5 more

CVE-2019-19532

kernel: malicious USB devices can lead to multiple out-of-bounds write

In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kernel HID drivers, aka CID-d9d4b1e46d95. This affects drivers/hid/hid-axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c, drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c, drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c, drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c, drivers/hid/hid-logitech-hidpp.c, drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c, drivers/hid/hid-tmff.c, and drivers/hid/hid-zpff.c.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Aus and 4 more

CVE-2019-19450

python-reportlab: code injection in paraparser.py allows code execution

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

CVSS 3.1 · 9.8 Critical EPSS 6.0% KEV · Not listed

Vendors

Debian Redhat Reportlab

Products

Debian Linux Enterprise Linux Rhel Aus and 4 more

CVE-2019-19447

kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c

In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list in fs/ext4/super.c.

CVSS 3.1 · 7.8 High EPSS 3.5% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel Active Iq Unified Manager Cloud Backup and 10 more

CVE-2019-18660

kernel: powerpc: incomplete Spectre-RSB mitigation leads to information exposure

The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Fedoraproject Linux and 2 more

Products

Ubuntu Linux Fedora Linux Kernel and 4 more

CVE-2019-18634

sudo: Stack based buffer overflow when pwfeedback is enabled

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

CVSS 3.1 · 7.8 High EPSS 19.3% KEV · Not listed

Vendors

Debian Redhat Sudo Project

Products

Debian Linux Enterprise Linux Rhel E4s and 1 more

CVE-2019-18408

libarchive: use-after-free in archive_read_format_rar_read_data when there is an error in the decompression of an archive entry

archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.

CVSS 3.1 · 7.5 High EPSS 4.0% KEV · Not listed

Vendors

Canonical Debian Libarchive and 2 more

Products

Ubuntu Linux Debian Linux Libarchive and 3 more

CVE-2019-18397

fribidi: buffer overflow in fribidi_get_par_embedding_levels_ex() in lib/fribidi-bidi.c leading to denial of service and possible code execution

A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.

CVSS 3.1 · 7.8 High EPSS 2.2% KEV · Not listed

Vendors

Debian Gnu Redhat

Products

Debian Linux Fribidi Enterprise Linux and 1 more

CVE-2019-17666

kernel: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain upper-bound check, leading to a buffer overflow

rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow.

CVSS 3.1 · 8.8 High EPSS 3.0% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 7 more

CVE-2019-17626

python-reportlab: code injection in colors.py allows attacker to execute code

ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.

CVSS 3.1 · 9.8 Critical EPSS 9.5% KEV · Not listed

Vendors

Redhat Reportlab

Products

Enterprise Linux Rhel E4s Reportlab

CVE-2019-17133

kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c

In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow.

CVSS 3.1 · 9.8 Critical EPSS 6.7% KEV · Not listed

Vendors

Canonical Debian Linux and 2 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 8 more

CVE-2019-17024

Mozilla: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4

Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Canonical Debian Mozilla and 2 more

Products

Ubuntu Linux Debian Linux Firefox and 10 more

CVE-2019-17022

Mozilla: CSS sanitization does not escape HTML tags

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape &lt; and &gt; characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

CVSS 3.1 · 6.1 Medium EPSS 2.0% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Firefox and 8 more

CVE-2019-17017

Mozilla: Type Confusion in XPCVariant.cpp

Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Firefox and 8 more

CVE-2019-17016

Mozilla: Bypass of @namespace CSS sanitization during pasting

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

CVSS 3.1 · 6.1 Medium EPSS 2.0% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Firefox and 8 more

CVE-2019-17012

Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3

Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Firefox Esr and 4 more

CVE-2019-17011

Mozilla: Use-after-free when retrieving a document in antitracking

Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Firefox Esr and 4 more

CVE-2019-17010

Mozilla: Use-after-free when performing device orientation checks

Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Firefox Esr and 4 more