CVE-2020-11100

haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes

In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.

CVSS 3.1 · 8.8 High EPSS 61.6% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 7 more

CVE-2020-11099

OOB Read in license_read_new_or_upgrade_license_packet in FreeRDP

In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2.

CVSS 3.1 · 3.5 Low EPSS 2.2% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 3 more

CVE-2020-11098

Out-of-bound read in glyph_cache_put in FreeRDP

In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2.

CVSS 3.1 · 3.5 Low EPSS 1.7% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 3 more

CVE-2020-11097

OOB read in ntlm_av_pair_get in FreeRDP

In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2.

CVSS 3.1 · 3.5 Low EPSS 1.4% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 3 more

CVE-2020-11096

Global OOB read in update_read_cache_bitmap_v3_order in FreeRDP

In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a workaround, one can disable bitmap cache with -bitmap-cache (default). This is fixed in version 2.1.2.

CVSS 3.1 · 3.5 Low EPSS 1.9% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 3 more

CVE-2020-11095

Global OOB read in update_recv_primary_order in FreeRDP

In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2.

CVSS 3.1 · 3.5 Low EPSS 1.4% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 3 more

CVE-2020-11089

Out-of-bound read in FreeRDP

In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0.

CVSS 3.1 · 3.7 Low EPSS 1.1% KEV · Not listed

Vendors

Debian Freerdp Opensuse and 1 more

Products

Debian Linux Freerdp Leap and 1 more

CVE-2020-11088

Out-of-bound read in FreeRDP

In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0.

CVSS 3.1 · 3.1 Low EPSS 1.4% KEV · Not listed

Vendors

Debian Freerdp Opensuse and 1 more

Products

Debian Linux Freerdp Leap and 1 more

CVE-2020-11087

Out-of-bounds Read in FreeRDP

In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage. This has been fixed in 2.1.0.

CVSS 3.1 · 3.1 Low EPSS 1.4% KEV · Not listed

Vendors

Debian Freerdp Opensuse and 1 more

Products

Debian Linux Freerdp Leap and 1 more

CVE-2020-11086

Out-of-bounds Read in FreeRDP `ntlm_read_ntlm_v2_response`

In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0.

CVSS 3.1 · 3.1 Low EPSS 1.4% KEV · Not listed

Vendors

Debian Freerdp Opensuse and 1 more

Products

Debian Linux Freerdp Leap and 1 more

CVE-2020-11085

Out-of-bounds Read in FreeRDP

In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0.

CVSS 3.1 · 2.6 Low EPSS 1.7% KEV · Not listed

Vendors

Debian Freerdp Opensuse and 1 more

Products

Debian Linux Freerdp Leap and 1 more

CVE-2020-11082

Cross-Site Scripting in Kaminari

In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

CVSS 3.1 · 6.4 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Kaminari Project

Products

Debian Linux Kaminari

CVE-2020-11078

CRLF injection in httplib2

In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.

CVSS 3.1 · 6.8 Medium EPSS 2.4% KEV · Not listed

Vendors

Debian Fedoraproject Httplib2 Project and 1 more

Products

Debian Linux Fedora Httplib2 and 3 more

CVE-2020-11077

HTTP Smuggling via Transfer-Encoding Header in Puma

In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This is a similar but different vulnerability from CVE-2020-11076. The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

CVSS 3.1 · 6.8 Medium EPSS 2.9% KEV · Not listed

Vendors

Debian Fedoraproject Opensuse and 1 more

Products

Debian Linux Fedora Leap and 1 more

CVE-2020-11076

HTTP Smuggling via Transfer-Encoding Header in Puma

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

CVSS 3.1 · 7.5 High EPSS 4.1% KEV · Not listed

Vendors

Debian Fedoraproject Puma

Products

Debian Linux Fedora Puma

CVE-2020-11061

Heap-based Buffer Overflow in Bareos Director

In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in Bareos versions 19.2.8, 18.2.9 and 17.2.10.

CVSS 3.1 · 6 Medium EPSS 1.2% KEV · Not listed

Vendors

Bareos Debian

Products

Bareos Debian Linux

CVE-2020-11058

Improper Restriction of Operations within the Bounds of a Memory Buffer in FreeRDP

In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0.

CVSS 3.1 · 2.2 Low EPSS 1.5% KEV · Not listed

Vendors

Canonical Debian Freerdp and 1 more

Products

Ubuntu Linux Debian Linux Freerdp and 1 more

CVE-2020-11049

Out-of-bounds Read in FreeRDPrdp_read_share_control_header

In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0.

CVSS 3.1 · 5.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Canonical Debian Freerdp and 1 more

Products

Ubuntu Linux Debian Linux Freerdp and 1 more

CVE-2020-11048

Out-of-bounds Read in FreeRDPrdp_read_flow_control_pdu

In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session. No data extraction is possible. This has been fixed in 2.0.0.

CVSS 3.1 · 2.2 Low EPSS 1.8% KEV · Not listed

Vendors

Canonical Debian Freerdp and 1 more

Products

Ubuntu Linux Debian Linux Freerdp and 1 more

CVE-2020-11047

Out-of-bounds Read in FreeRDP

In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0.

CVSS 3.1 · 5.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Canonical Debian Freerdp and 1 more

Products

Ubuntu Linux Debian Linux Freerdp and 1 more