CVE-2019-3846

kernel: Heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c

A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network.

CVSS 3.1 · 8.8 High EPSS 5.9% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 14 more

CVE-2019-3845

katello-installer-base: QMF methods exposed to goferd via qdrouterd

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Satellite Tools Satellite and 1 more

CVE-2019-3841

kubevirt/virt-cdi-importer: improper TLS certificate validation

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible undetected tampering of trusted container image content.

CVSS 3.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Kubevirt

Products

Containerized Data Importer

CVE-2019-3840

libvirt: NULL pointer dereference after running qemuAgentCommand in qemuAgentGetInterfaces function

A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service.

CVSS 3.0 · 5.8 Medium EPSS 1.5% KEV · Not listed

Vendors

Opensuse Redhat

Products

Leap Enterprise Linux Libvirt

CVE-2019-3839

ghostscript: missing attack vector protections for CVE-2019-6116

It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.27 are vulnerable.

CVSS 3.1 · 7.8 High EPSS 1.7% KEV · Not listed

Vendors

Artifex Canonical Debian and 3 more

Products

Ghostscript Ubuntu Linux Debian Linux and 3 more

CVE-2019-3838

ghostscript: forceput in DefineResource is still accessible (700576)

It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.

CVSS 3.1 · 5.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Artifex Debian Fedoraproject and 2 more

Products

Ghostscript Debian Linux Fedora and 9 more

CVE-2019-3837

kernel: memory leak in tcp_recvmsg() with NET_DMA

It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2019-3836

gnutls: invalid pointer access upon receiving async handshake messages

It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages.

CVSS 3.0 · 5.9 Medium EPSS 3.4% KEV · Not listed

Vendors

Fedoraproject Gnu Opensuse and 1 more

Products

Fedora Gnutls Leap and 1 more

CVE-2019-3835

ghostscript: superexec operator is available (700585)

It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.

CVSS 3.1 · 5.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Artifex Debian Fedoraproject and 2 more

Products

Ghostscript Debian Linux Fedora and 9 more

CVE-2019-3834

JON: struts1 reversion of fix for CVE-2014-0114

It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.

CVSS 3.1 · 7.3 High EPSS 1.0% KEV · Not listed

Vendors

Redhat

Products

Jboss Operations Network

CVE-2019-3833

openwsman: Infinite loop in process_connection() allows denial of service

Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing specially crafted HTTP requests. A remote, unauthenticated attacker can exploit this vulnerability by sending malicious HTTP request to cause denial of service to openwsman server.

CVSS 3.1 · 7.5 High EPSS 15.2% KEV · Not listed

Vendors

Fedoraproject Opensuse Openwsman Project and 1 more

Products

Fedora Leap Openwsman and 1 more

CVE-2019-3832

libsndfile: incomplete fix for CVE-2018-19758 still allow to read beyond buffer limits

It was discovered the fix for CVE-2018-19758 (libsndfile) was not complete and still allows a read beyond the limits of a buffer in wav_write_header() function in wav.c. A local attacker may use this flaw to make the application crash.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Libsndfile Project

Products

Ubuntu Linux Debian Linux Libsndfile

CVE-2019-3831

vdsm: privilege escalation to root via systemd_run

A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function exposed to the vdsm system user could be abused to execute arbitrary commands as root.

CVSS 3.1 · 6.7 Medium EPSS 1.0% KEV · Not listed

Vendors

Ovirt Redhat

Products

Vdsm Enterprise Linux Gluster Storage and 1 more

CVE-2019-3830

openstack-ceilometer: ceilometer-agent prints sensitive data from config files through log files

A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Openstack Redhat

Products

Ceilometer Openstack

CVE-2019-3829

gnutls: use-after-free/double-free in certificate verification

A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.

CVSS 3.0 · 5.3 Medium EPSS 59.2% KEV · Not listed

Vendors

Fedoraproject Gnu Redhat

Products

Fedora Gnutls Enterprise Linux

CVE-2019-3828

Ansible: path traversal in the fetch module

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Ansible Engine Openstack

CVE-2019-3827

gvfs: Incorrect authorization in admin backend allows privileged users to read and modify arbitrary files without prompting for password

An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Gvfs Enterprise Linux

CVE-2019-3826

prometheus: Stored DOM cross-site scripting (XSS) attack via crafted URL

A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.

CVSS 3.0 · 6.1 Medium EPSS 2.5% KEV · Not listed

Vendors

Prometheus Redhat

Products

Prometheus Openshift Openshift Container Platform

CVE-2019-3825

gdm: lock screen bypass when timed login is enabled

A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to expire, at which time they would gain access to the logged-in user's session.

CVSS 3.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Gnome Redhat

Products

Ubuntu Linux Gnome Display Manager Enterprise Linux

CVE-2019-3824

samba: Out of bound read in ldb_wildcard_compare in Samba AD DC

A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.10. An authenticated user, having read permissions on the LDAP server, could use this flaw to cause denial of service.

CVSS 3.0 · 6.5 Medium EPSS 2.8% KEV · Not listed

Vendors

Canonical Debian Samba

Products

Ubuntu Linux Debian Linux Samba