Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 772

CVE-2019-9755

ntfs-3g: heap-based buffer overflow leads to local root privilege escalation

An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tuxera
Products
Advanced Virtualization Enterprise Linux Enterprise Linux Eus and 4 more
CVE-2019-9506

Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.

CVSS 3.1 · 8.1 High EPSS 2.9% KEV · Not listed
Vendors
Apple Blackberry Canonical and 5 more
Products
Iphone Os Mac Os X Tvos and 277 more
CVE-2019-8308

flatpak: potential /proc based sandbox escape

Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.

CVSS 3.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Debian Flatpak Redhat
Products
Debian Linux Flatpak Enterprise Linux and 6 more
CVE-2019-7665

elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c

In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Canonical Debian Elfutils Project and 2 more
Products
Ubuntu Linux Debian Linux Elfutils and 9 more
CVE-2019-7664

elfutils: out of bound write in elf_cvt_note in libelf/note_xlate.h

In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).

CVSS 3.1 · 5.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Elfutils Project Redhat
Products
Elfutils Ansible Tower Enterprise Linux and 6 more
CVE-2019-7310

poppler: heap-based buffer over-read in XRef::getEntry in XRef.cc

In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more
CVE-2019-7164

python-sqlalchemy: SQL Injection when the order_by parameter can be controlled

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Debian Opensuse Oracle and 2 more
Products
Debian Linux Backports Sle Leap and 6 more
CVE-2019-7150

elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c

An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Canonical Debian Elfutils Project and 2 more
Products
Ubuntu Linux Debian Linux Elfutils and 9 more
CVE-2019-6454

systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash

An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).

CVSS 3.1 · 5.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 23 more
CVE-2019-6133

polkit: Temporary auth hijacking via PID reuse and non-atomic fork

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

CVSS 3.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Polkit Project and 1 more
Products
Ubuntu Linux Debian Linux Polkit and 9 more
CVE-2019-6116

ghostscript: subroutines within pseudo-operators must themselves be pseudo-operators (700317)

In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.

CVSS 3.1 · 7.8 High EPSS 41.6% KEV · Not listed
Vendors
Artifex Canonical Debian and 3 more
Products
Ghostscript Ubuntu Linux Debian Linux and 9 more
CVE-2019-3887

Kernel: KVM: nVMX: guest accesses L0 MSR causes potential DoS

A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 1 more
Products
Ubuntu Linux Fedora Linux Kernel and 8 more
CVE-2019-3878

mod_auth_mellon: authentication bypass in ECP flow

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.

CVSS 3.0 · 8.1 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Fedoraproject Mod Auth Mellon Project and 1 more
Products
Ubuntu Linux Fedora Mod Auth Mellon and 8 more
CVE-2019-3838

ghostscript: forceput in DefineResource is still accessible (700576)

It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.

CVSS 3.1 · 5.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 2 more
Products
Ghostscript Debian Linux Fedora and 9 more
CVE-2019-3835

ghostscript: superexec operator is available (700585)

It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.

CVSS 3.1 · 5.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 2 more
Products
Ghostscript Debian Linux Fedora and 9 more
CVE-2019-3816

openwsman: Disclosure of arbitrary files outside of the registered URIs

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.

CVSS 3.1 · 7.5 High EPSS 14.7% KEV · Not listed
Vendors
Fedoraproject Opensuse Openwsman Project and 1 more
Products
Fedora Leap Openwsman and 8 more