Export limit exceeded: 10090 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,090

Export CSV
CVE-2020-25674

ImageMagick: heap-based buffer overflow in WriteOnePNGImage in coders/png.c

WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buffer-overflow. This occurs because it is possible for the colormap to have less than 256 valid values but the loop condition will loop 256 times, attempting to pass invalid colormap data to the event logger. The patch replaces the hardcoded 256 value with a call to MagickMin() to ensure the proper value is used. This could impact application availability when a specially crafted input file is processed by ImageMagick. This flaw affects ImageMagick versions prior to 7.0.8-68.

CVSS 3.1 · 5.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Debian Imagemagick
Products
Debian Linux Imagemagick
CVE-2020-25671

kernel: refcount leak in llcp_sock_connect()

A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-free which might lead to privilege escalations.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 20 more
CVE-2020-25669

kernel: use-after-free read in sunkbd_reinit in drivers/input/keyboard/sunkbd.c

A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp
Products
Debian Linux Linux Kernel Cloud Backup and 18 more
CVE-2020-25668

kernel: race condition in fg_console can lead to use-after-free in con_font_op

A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op.

CVSS 3.1 · 7.0 High EPSS 1.0% KEV · Not listed
Vendors
Debian Linux Netapp
Products
Debian Linux Linux Kernel 500f and 23 more
CVE-2020-25666

ImageMagick: outside the range of representable values of type int and signed integer overflow in MagickCore/histogram.c

There are 4 places in HistogramCompare() in MagickCore/histogram.c where an integer overflow is possible during simple math calculations. This occurs in the rgb values and `count` value for a color. The patch uses casts to `ssize_t` type for these calculations, instead of `int`. This flaw could impact application reliability in the event that ImageMagick processes a crafted input file. This flaw affects ImageMagick versions prior to 7.0.9-0.

CVSS 3.1 · 3.3 Low EPSS 1.2% KEV · Not listed
Vendors
Debian Imagemagick
Products
Debian Linux Imagemagick
CVE-2020-25665

ImageMagick: heap-based buffer overflow in WritePALMImage in coders/palm.c

The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytes_per_row in the call to AcquireQuantumMemory(). This could cause impact to reliability. This flaw affects ImageMagick versions prior to 7.0.8-68.

CVSS 3.1 · 5.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Debian Imagemagick
Products
Debian Linux Imagemagick
CVE-2020-25656

kernel: use-after-free in read in vt_do_kdgkb_ioctl

A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat and 1 more
Products
Debian Linux Linux Kernel Enterprise Linux and 2 more
CVE-2020-25654

pacemaker: ACL restrictions bypass

An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.

CVSS 3.1 · 7.2 High EPSS 1.9% KEV · Not listed
Vendors
Clusterlabs Debian Redhat
Products
Pacemaker Debian Linux Enterprise Linux and 1 more
CVE-2020-25653

spice-vdagent: UNIX domain socket peer PID retrieved via SO_PEERCRED is subject to race condition

A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 1 more
CVE-2020-25652

spice-vdagent: possibility to exhaust file descriptors in vdagentd

A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in `/run/spice-vdagentd/spice-vdagent-sock`. Any unprivileged local guest user could use this flaw to prevent legitimate agents from connecting to the spice-vdagentd daemon, resulting in a denial of service. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and prior.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 1 more
CVE-2020-25651

spice-vdagent: possible file transfer DoS and information leak via active_xfers hash map

A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection of an illegitimate local user in the VM system. Active file transfers from other users could also be interrupted, resulting in a denial of service. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 1 more
CVE-2020-25650

spice-vdagent: memory DoS via arbitrary entries in active_xfers hash table

A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path `/run/spice-vdagentd/spice-vdagent-sock` could use this flaw to perform a memory denial of service for spice-vdagentd or even other processes in the VM system. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and previous versions.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 1 more
CVE-2020-25645

kernel: Geneve/IPsec traffic may be unencrypted between two Geneve endpoints

A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 7 more
CVE-2020-25643

kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read overflow

A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.2 High EPSS 3.3% KEV · Not listed
Vendors
Debian Linux Netapp and 3 more
Products
Debian Linux Linux Kernel H410c and 5 more
CVE-2020-25641

kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS

A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 3 more
CVE-2020-25626

django-rest-framework: XSS Vulnerability in API viewer

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.

CVSS 3.1 · 6.1 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Encode Redhat
Products
Debian Linux Django Rest Framework Ansible Tower and 1 more
CVE-2020-25625

QEMU: usb: hcd-ohci: infinite loop issue while processing transfer descriptors

hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2020-25624

QEMU: usb: hcd-ohci: out-of-bound access issue while processing transfer descriptors

hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.

CVSS 3.1 · 5.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu