CVE-2019-20477

PyYAML: command execution through python/object/apply constructor in FullLoader

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

CVSS 3.1 · 9.8 Critical EPSS 5.1% KEV · Not listed

Vendors

Fedoraproject Pyyaml Redhat

Products

Fedora Pyyaml Enterprise Linux and 1 more

CVE-2019-20446

librsvg: Resource exhaustion via crafted SVG file with nested patterns

In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.

CVSS 3.1 · 6.5 Medium EPSS 2.1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 4 more

CVE-2019-20421

exiv2: infinite loop and hang in Jp2Image::readMetadata() in jp2image.cpp could lead to DoS

In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.

CVSS 3.1 · 7.5 High EPSS 4.3% KEV · Not listed

Vendors

Canonical Debian Exiv2 and 1 more

Products

Ubuntu Linux Debian Linux Exiv2 and 1 more

CVE-2019-20398

libyang: NULL pointer dereference in function lys_extension_instances_free()

A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang to parse untrusted input yang files may crash.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20397

libyang: double-free in yyparse() when organization field is not terminated

A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20396

libyang: heap-based buffer over-read in function lys_type_free() due to malformed pattern

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20395

libyang: stack-overflow when parsing yang files with self-referential union types

A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20394

libyang: double-free in yyparse() when a type statement is used in a notification statement

A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.

CVSS 3.1 · 8.8 High EPSS 2.8% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20393

libyang: double-free in function yyparse() when empty description is used

A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.

CVSS 3.1 · 8.8 High EPSS 2.8% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20392

libyang: invalid memory access when if-feature statement is used inside a list key node

An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20391

libyang: invalid memory access in resolve_feature_value() when a if-feature is used inside a bit

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Cesnet Redhat

Products

Libyang Enterprise Linux

CVE-2019-20387

libsolv: out-of-bounds read in repodata_schema2id in repodata.c

repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input schema.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed

Vendors

Debian Opensuse Redhat

Products

Debian Linux Libsolv Enterprise Linux

CVE-2019-20382

QEMU: vnc: memory leakage upon disconnect

QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Opensuse and 2 more

Products

Ubuntu Linux Debian Linux Leap and 4 more

CVE-2019-20372

nginx: HTTP request smuggling in configurations with URL redirect used as error_page

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

CVSS 3.1 · 5.3 Medium EPSS 15.0% KEV · Not listed

Vendors

Apple Canonical F5 and 3 more

Products

Xcode Ubuntu Linux Nginx and 5 more

CVE-2019-20054

kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c

In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel 8300 8300 Firmware and 16 more

CVE-2019-20044

zsh: insecure dropping of privileges when unsetting PRIVILEGED option

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 3 more

Products

Ipados Iphone Os Mac Os X and 9 more

CVE-2019-1559

0-byte record padding oracle

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

CVSS 3.1 · 5.9 Medium EPSS 17.1% KEV · Not listed

Vendors

Canonical Debian F5 and 10 more

Products

Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 88 more

CVE-2019-1549

Fork Protection

OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).

CVSS 3.1 · 5.3 Medium EPSS 6.2% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Core Services

CVE-2019-1547

ECDSA remote timing attack

Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

CVSS 3.1 · 4.7 Medium EPSS 1.1% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Core Services

CVE-2019-1352

git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams

A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387.

CVSS 3.1 · 8.8 High EPSS 24.0% KEV · Not listed

Vendors

Microsoft Redhat

Products

Visual Studio 2017 Visual Studio 2019 Enterprise Linux and 2 more