Search vulnerabilities

Expected end of text, found '–' (at char 11), (line:1, col:12)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,892

CVE-2020-6096

glibc: signed comparison vulnerability in the ARMv7 memcpy function

An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

CVSS 3.1 · 8.1 High EPSS 5.5% KEV · Not listed
Vendors
Debian Fedoraproject Gnu
Products
Debian Linux Fedora Glibc
CVE-2020-1752

glibc: use-after-free in glob() function when expanding ~user

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Gnu and 2 more
Products
Ubuntu Linux Debian Linux Glibc and 7 more
CVE-2020-1751

glibc: array overflow in backtrace functions for powerpc

An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Gnu Redhat
Products
Ubuntu Linux Glibc Enterprise Linux
CVE-2020-1712

systemd: use-after-free when asynchronous polkit queries are performed

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Redhat Systemd Project
Products
Debian Linux Ceph Storage Discovery and 5 more
CVE-2020-11501

gnutls: DTLS client hello contains a random value of all zeroes

GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol.

CVSS 3.1 · 7.4 High EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2020-10878

perl: corruption of intermediate language state of compiled regular expression due to integer overflow leads to DoS

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVSS 3.1 · 8.6 High EPSS 4.9% KEV · Not listed
Vendors
Fedoraproject Netapp Opensuse and 3 more
Products
Fedora Oncommand Workflow Automation Snap Creator Framework and 19 more
CVE-2020-10735

python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading to DoS

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 6.2 Medium EPSS 4.5% KEV · Not listed
Vendors
Fedoraproject Python Redhat
Products
Fedora Python Enterprise Linux and 4 more
CVE-2020-10531

ICU: Integer overflow in UnicodeString::doAppend()

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

CVSS 3.1 · 8.8 High EPSS 2.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 6 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2020-10029

glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions

The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2019-25013

glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding

The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.

CVSS 3.1 · 5.9 Medium EPSS 3.6% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 3 more
Products
Fabric Operating System Debian Linux Fedora and 9 more
CVE-2019-1010180

gdb: buffer overflow while opening an ELF for debugging leads to Dos, information dislosure and code execution

GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet.

CVSS 3.1 · 7.8 High EPSS 2.6% KEV · Not listed
Vendors
Gnu Opensuse Redhat
Products
Gdb Leap Enterprise Linux
CVE-2019-1010025

glibc: information disclosure of heap addresses of pthread_created thread

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.

CVSS 3.0 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Gnu
Products
Glibc
CVE-2019-1010024

glibc: ASLR bypass using cache of thread stack and heap

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

CVSS 3.0 · 5.3 Medium EPSS 3.2% KEV · Not listed
Vendors
Gnu
Products
Glibc
CVE-2019-1010023

glibc: running ldd on malicious ELF leads to code execution because of wrong size computation

GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

CVSS 3.1 · 5.4 Medium EPSS 3.1% KEV · Not listed
Vendors
Gnu
Products
Glibc
CVE-2019-1010022

glibc: stack guard protection bypass

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Gnu
Products
Glibc
CVE-2019-20907

python: infinite loop in the tarfile module via crafted TAR archive

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CVSS 3.1 · 5.5 Medium EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2019-20795

iproute: use-after-free in get_netnsid_from_name in ip/ipnetns.c

iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Iproute2 Project
Products
Ubuntu Linux Iproute2