CVE-2019-12817

kernel: ppc: unrelated processes being able to read/write to each other's virtual memory

arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel before 5.1.15 for powerpc has a bug where unrelated processes may be able to read/write to one another's virtual memory under certain conditions via an mmap above 512 TB. Only a subset of powerpc systems are affected.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 6 more

CVE-2019-12527

squid: heap-based buffer overflow in HttpHeader::getAuth

An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.

CVSS 3.1 · 8.8 High EPSS 50.3% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 5 more

CVE-2019-12450

glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.

CVSS 3.1 · 9.8 Critical EPSS 2.6% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 7 more

CVE-2019-11884

kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command

The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\0' character.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 10 more

CVE-2019-11833

kernel: fs/ext4/extents.c leads to information disclosure

fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 13 more

CVE-2019-11811

kernel: use-after-free in drivers/char/ipmi/ipmi_si_intf.c, ipmi_si_mem_io.c, ipmi_si_port_io.c

An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module is removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux Opensuse Redhat

Products

Linux Kernel Leap Enterprise Linux and 12 more

CVE-2019-11459

evince: uninitialized memory use in function tiff_document_render() and tiff_document_get_thumbnail()

The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.

CVSS 3.1 · 5.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 6 more

CVE-2019-11356

cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

CVSS 3.1 · 9.8 Critical EPSS 7.6% KEV · Not listed

Vendors

Canonical Cyrus Debian and 2 more

Products

Ubuntu Linux Imap Debian Linux and 5 more

CVE-2019-11235

freeradius: eap-pwd: authentication bypass via an invalid curve attack

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.

CVSS 3.0 · 9.8 Critical EPSS 3.6% KEV · Not listed

Vendors

Canonical Fedoraproject Freeradius and 2 more

Products

Ubuntu Linux Fedora Freeradius and 7 more

CVE-2019-10216

ghostscript: -dSAFER escape via .buildfont1 (701394)

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

CVSS 3.1 · 7.8 High EPSS 2.3% KEV · Not listed

Vendors

Artifex Redhat

Products

Ghostscript 3scale Amp 3scale Api Management and 7 more

CVE-2019-10193

redis: Stack buffer overflow in HyperLogLog triggered by malicious client

A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.

CVSS 3.1 · 7.2 High EPSS 23.3% KEV · Not listed

Vendors

Canonical Debian Oracle and 2 more

Products

Ubuntu Linux Debian Linux Communications Operations Monitor and 7 more

CVE-2019-10192

redis: Heap buffer overflow in HyperLogLog triggered by malicious client

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.

CVSS 3.1 · 7.2 High EPSS 25.6% KEV · Not listed

Vendors

Canonical Debian Oracle and 2 more

Products

Ubuntu Linux Debian Linux Communications Operations Monitor and 9 more

CVE-2019-10168

libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU APIs

The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Advanced Virtualization Enterprise Linux Enterprise Linux Desktop and 7 more

CVE-2019-10167

libvirt: arbitrary command execution via virConnectGetDomainCapabilities API

The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Advanced Virtualization Enterprise Linux Enterprise Linux Desktop and 7 more

CVE-2019-10166

libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients

It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Advanced Virtualization Enterprise Linux Enterprise Linux Desktop and 7 more

CVE-2019-10126

kernel: Heap overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c

A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other consequences.

CVSS 3.1 · 9.8 Critical EPSS 6.8% KEV · Not listed

Vendors

Canonical Debian Linux and 3 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 26 more

CVE-2019-1010238

pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

CVSS 3.1 · 9.8 Critical EPSS 6.3% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 11 more

CVE-2019-0820

dotnet: timeouts for regular expressions are not enforced

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.

CVSS 3.1 · 7.5 High EPSS 5.7% KEV · Not listed

Vendors

Microsoft Redhat

Products

.net Core .net Framework Windows 10 and 12 more

CVE-2019-0757

dotnet: NuGet Tampering Vulnerability

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed

Vendors

Apple Microsoft Mono-project and 1 more

Products

Macos .net Core .net Core Sdk and 8 more

CVE-2019-0223

qpid-proton: TLS Man in the Middle Vulnerability

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.

CVSS 3.1 · 7.4 High EPSS 6.2% KEV · Not listed

Vendors

Apache Redhat

Products

Qpid A Mq Clients Cloudforms Managementengine and 14 more