Export limit exceeded: 17087 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,087

Export CSV
CVE-2019-18397

fribidi: buffer overflow in fribidi_get_par_embedding_levels_ex() in lib/fribidi-bidi.c leading to denial of service and possible code execution

A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.

CVSS 3.1 · 7.8 High EPSS 2.2% KEV · Not listed
Vendors
Debian Gnu Redhat
Products
Debian Linux Fribidi Enterprise Linux and 1 more
CVE-2019-18391

virglrenderer: heap based buffer overflow in the vrend_renderer_transfer_write_iov function

A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Enterprise Linux and 1 more
CVE-2019-18390

virglrenderer: out-of-bounds read in the vrend_blit_need_swizzle may lead to DoS

An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_BLIT commands.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Enterprise Linux and 1 more
CVE-2019-18389

virglrenderer: heap buffer overflow in the vrend_renderer_transfer_write_iov function

A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service, or QEMU guest-to-host escape and code execution, via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Enterprise Linux and 1 more
CVE-2019-18282

kernel: The flow_dissector feature allows device tracking

The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code.

CVSS 3.1 · 5.3 Medium EPSS 2.9% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel 8300 and 18 more
CVE-2019-18281

qt5-qtbase: Out-of-bounds access in generateDirectionalRuns() function in qtextengine.cpp

An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters.

CVSS 3.1 · 4.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Qt Redhat
Products
Debian Linux Qtbase Enterprise Linux
CVE-2019-18277

haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated "chunked" value

A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).

CVSS 3.1 · 7.5 High EPSS 10.1% KEV · Not listed
Vendors
Haproxy Redhat
Products
Haproxy Enterprise Linux Openshift and 1 more
CVE-2019-18218

file: heap-based buffer overflow in cdf_read_property_info in cdf.c

cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).

CVSS 3.1 · 7.8 High EPSS 1.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 4 more
CVE-2019-17666

kernel: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain upper-bound check, leading to a buffer overflow

rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow.

CVSS 3.1 · 8.8 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 7 more
CVE-2019-17639

JDK: Information disclosure via calls to System.arraycopy() with invalid length

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.

CVSS 3.1 · 5.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Eclipse Redhat
Products
Openj9 Enterprise Linux Rhel Extras
CVE-2019-17626

python-reportlab: code injection in colors.py allows attacker to execute code

ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.

CVSS 3.1 · 9.8 Critical EPSS 9.5% KEV · Not listed
Vendors
Redhat Reportlab
Products
Enterprise Linux Rhel E4s Reportlab
CVE-2019-17596

golang: invalid public key causes panic in dsa.Verify

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

CVSS 3.1 · 7.5 High EPSS 4.7% KEV · Not listed
Vendors
Arista Debian Fedoraproject and 3 more
Products
Cloudvision Portal Eos Mos and 10 more
CVE-2019-17570

xmlrpc: Deserialization of server-side exception from faultCause in XMLRPC error response

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

CVSS 3.1 · 9.8 Critical EPSS 49.3% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Xml-rpc Ubuntu Linux Debian Linux and 5 more
CVE-2019-17541

ImageMagick: Use after free in ReadICCProfile function in coders/jpeg.c

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

CVSS 3.1 · 8.8 High EPSS 2.4% KEV · Not listed
Vendors
Imagemagick Redhat
Products
Imagemagick Enterprise Linux
CVE-2019-17451

binutils: integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as demonstrated by nm.

CVSS 3.1 · 6.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Gnu Opensuse and 1 more
Products
Ubuntu Linux Binutils Leap and 1 more
CVE-2019-17450

binutils: denial of service via crafted ELF file

find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.

CVSS 3.1 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Canonical Gnu Opensuse and 1 more
Products
Ubuntu Linux Binutils Leap and 1 more
CVE-2019-17402

exiv2: out-of-bounds read in CiffDirectory::readDirectory due to lack of size check

Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Exiv2 and 1 more
Products
Ubuntu Linux Debian Linux Exiv2 and 1 more