CVE-2020-18898

exiv2: stack exhaustion issue in the printIFDStructure function may lead to DoS

A stack exhaustion issue in the printIFDStructure function of Exiv2 0.27 allows remote attackers to cause a denial of service (DOS) via a crafted file.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Exiv2 Redhat

Products

Exiv2 Enterprise Linux

CVE-2020-18652

exempi: denial of service via opening of crafted webp file

Buffer Overflow vulnerability in WEBP_Support.cpp in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted webp file.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Exempi Project Redhat

Products

Exempi Enterprise Linux

CVE-2020-18651

exempi: denial of service via opening of crafted audio file with ID3V2 frame

Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted audio file with ID3V2 frame.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Exempi Project Redhat

Products

Exempi Enterprise Linux

CVE-2020-18032

graphviz: off-by-one in parse_reclbl() in lib/common/shapes.c

Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted file into the "lib/common/shapes.c" component.

CVSS 3.1 · 7.8 High EPSS 2.6% KEV · Not listed

Vendors

Debian Fedoraproject Graphviz and 1 more

Products

Debian Linux Fedora Graphviz and 1 more

CVE-2020-17541

libjpeg-turbo: Stack-based buffer overflow in the "transform" component

Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.

CVSS 3.1 · 8.8 High EPSS 2.7% KEV · Not listed

Vendors

Libjpeg-turbo Redhat

Products

Libjpeg-turbo Enterprise Linux

CVE-2020-17507

qt: buffer over-read in read_xbm_body in gui/image/qxbmhandler.cpp

An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read.

CVSS 3.1 · 5.3 Medium EPSS 4.0% KEV · Not listed

Vendors

Debian Fedoraproject Qt and 1 more

Products

Debian Linux Fedora Qt and 1 more

CVE-2020-17489

gnome-shell: Password from logged-out user may be shown on login screen

An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog reappears with the password still visible. If the user had decided to have the password shown in cleartext at login time, it is then visible for a brief moment upon a logout. (If the password were never shown in cleartext, only the password length is revealed.)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Gnome and 2 more

Products

Ubuntu Linux Debian Linux Gnome-shell and 2 more

CVE-2020-17049

Kerberos KDC Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

CVSS 3.1 · 6.6 Medium EPSS 13.8% KEV · Not listed

Vendors

Microsoft Redhat Samba

Products

Windows Server 1903 Windows Server 1909 Windows Server 2004 and 10 more

CVE-2020-16845

golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

CVSS 3.1 · 7.5 High EPSS 4.9% KEV · Not listed

Vendors

Debian Fedoraproject Golang and 2 more

Products

Debian Linux Fedora Go and 10 more

CVE-2020-16310

ghostscript: division by zero in dot24_print_page() in devices/gdevdm24.c could result in a DoS

A division by zero vulnerability in dot24_print_page() in devices/gdevdm24.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

CVSS 3.1 · 5.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Artifex Canonical Debian and 1 more

Products

Ghostscript Ubuntu Linux Debian Linux and 1 more

CVE-2020-16309

ghostscript: buffer overflow in lxm5700m_print_page() in devices/gdevlxm.c could result in a DoS

A buffer overflow vulnerability in lxm5700m_print_page() in devices/gdevlxm.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted eps file. This is fixed in v9.51.

CVSS 3.1 · 5.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Artifex Canonical Debian and 1 more

Products

Ghostscript Ubuntu Linux Debian Linux and 1 more

CVE-2020-16308

ghostscript: buffer overflow in p_print_image() in devices/gdevcdj.c could result in a DoS

A buffer overflow vulnerability in p_print_image() in devices/gdevcdj.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

CVSS 3.1 · 5.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Artifex Canonical Debian and 1 more

Products

Ghostscript Ubuntu Linux Debian Linux and 1 more

CVE-2020-16307

ghostscript: NULL pointer dereference in devices/vector/gdevtxtw.c and psi/zbfont.c could result in a DoS

A null pointer dereference vulnerability in devices/vector/gdevtxtw.c and psi/zbfont.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted postscript file. This is fixed in v9.51.

CVSS 3.1 · 5.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Artifex Canonical Debian and 1 more

Products

Ghostscript Ubuntu Linux Debian Linux and 1 more

CVE-2020-16306

ghostscript: NULL pointer dereference in devices/gdevtsep.c could result in a DoS

A null pointer dereference vulnerability in devices/gdevtsep.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted postscript file. This is fixed in v9.51.

CVSS 3.1 · 5.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Artifex Canonical Debian and 1 more

Products

Ghostscript Ubuntu Linux Debian Linux and 1 more

CVE-2020-16305

ghostscript: buffer overflow in pcx_write_rle() in contrib/japanese/gdev10v.c could result in a DoS

A buffer overflow vulnerability in pcx_write_rle() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

CVSS 3.1 · 5.5 Medium EPSS 2.3% KEV · Not listed

Vendors

Artifex Canonical Debian and 1 more

Products

Ghostscript Ubuntu Linux Debian Linux and 1 more

CVE-2020-16303

ghostscript: use-after-free in xps_finish_image_path() in devices/vector/gdevxps.c could result in a privilege escalation

A use-after-free vulnerability in xps_finish_image_path() in devices/vector/gdevxps.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalate privileges via a crafted PDF file. This is fixed in v9.51.

CVSS 3.1 · 7.8 High EPSS 1.8% KEV · Not listed

Vendors

Artifex Canonical Debian and 1 more

Products

Ghostscript Ubuntu Linux Debian Linux and 1 more

CVE-2020-16302

ghostscript: buffer overflow in jetp3852_print_page() in devices/gdev3852.c could result in a privilege escalation

A buffer overflow vulnerability in jetp3852_print_page() in devices/gdev3852.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalate privileges via a crafted PDF file. This is fixed in v9.51.

CVSS 3.1 · 5.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Artifex Canonical Debian and 1 more

Products

Ghostscript Ubuntu Linux Debian Linux and 1 more

CVE-2020-16301

ghostscript: buffer overflow in okiibm_print_page1() in devices/gdevokii.c could result in a DoS

A buffer overflow vulnerability in okiibm_print_page1() in devices/gdevokii.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

CVSS 3.1 · 5.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Artifex Canonical Debian and 1 more

Products

Ghostscript Ubuntu Linux Debian Linux and 1 more

CVE-2020-16300

ghostscript: buffer overflow in tiff12_print_page() in devices/gdevtfnx.c could result in a DoS

A buffer overflow vulnerability in tiff12_print_page() in devices/gdevtfnx.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

CVSS 3.1 · 5.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Artifex Canonical Debian and 1 more

Products

Ghostscript Ubuntu Linux Debian Linux and 1 more

CVE-2020-16299

ghostscript: division by zero in bj10v_print_page() in contrib/japanese/gdev10v.c could result in a DoS

A Division by Zero vulnerability in bj10v_print_page() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

CVSS 3.1 · 5.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Artifex Canonical Debian and 1 more

Products

Ghostscript Ubuntu Linux Debian Linux and 1 more