CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 3CVE-2020-12049 – dbus: denial of service via file descriptor leak
https://notcve.org/view.php?id=CVE-2020-12049
08 Jun 2020 — An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients. Se detectó un problema en dbus versiones posteriores a 1.3.0 e incluyéndola y anteriores a 1.12... • https://packetstorm.news/files/id/172840 • CWE-400: Uncontrolled Resource Consumption CWE-404: Improper Resource Shutdown or Release •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2019-20811 – kernel: net-sysfs: *_queue_add_kobject refcount issue
https://notcve.org/view.php?id=CVE-2019-20811
03 Jun 2020 — An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c. Se detectó un problema en el kernel de Linux versiones anteriores a 5.0.6. En la funciones rx_queue_add_kobject() y netdev_queue_add_kobject() en el archivo net/core/net-sysfs.c, un reconteo de referencias es manejado inapropiadamente, también se conoce como CID-a3e23f719f5c. A flaw was found in the way the rx_queue... • https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.6 • CWE-460: Improper Cleanup on Thrown Exception •
CVSS: 5.9EPSS: 0%CPEs: 14EXPL: 1CVE-2020-13254 – django: potential data leakage via malformed memcached keys
https://notcve.org/view.php?id=CVE-2020-13254
03 Jun 2020 — An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage. Se detectó un problema en Django versiones 2.2 anteriores a 2.2.13 y versiones 3.0 anteriores a 3.0.7. En casos donde un backend memcached no lleva a cabo una comprobación de la clave, pasa claves de caché maliciosas que podría resultar en una colisión de claves y una potencial f... • https://github.com/danpalmer/django-cve-2020-13254 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-295: Improper Certificate Validation •
CVSS: 6.1EPSS: 0%CPEs: 13EXPL: 0CVE-2020-13596 – Debian Security Advisory 4705-1
https://notcve.org/view.php?id=CVE-2020-13596
03 Jun 2020 — An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack. Se detectó un problema en Django versiones 2.2 anteriores a 2.2.13 y versiones 3.0 anteriores a 3.0.7. En casos donde un backend memcached no lleva a cabo una comprobación de la clave, pasa claves de caché maliciosas que podría resultar en una colisión de claves y una potencial filtración de da... • https://docs.djangoproject.com/en/3.0/releases/security • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 10EXPL: 0CVE-2019-20810 – Ubuntu Security Notice USN-4427-1
https://notcve.org/view.php?id=CVE-2019-20810
02 Jun 2020 — go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586. La función go7007_snd_init en el archivo driversdrivers/media/usb/go7007/snd-go7007.c en el kernel de Linux versiones anteriores a 5.6, no llama a snd_card_free para una ruta de fallo, lo que causa una pérdida de memoria, también se conoce como CID-9453264ef586. It was discovered that the network block device implementation ... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 8.2EPSS: 0%CPEs: 9EXPL: 0CVE-2020-13113 – libexif: use of uninitialized memory in EXIF Makernote handling can lead to crashes and use-after-free
https://notcve.org/view.php?id=CVE-2020-13113
21 May 2020 — An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions. Se descubrió un problema en libexif versiones anteriores a la versión 0.6.22. Un uso de la memoria no inicializada en el manejo de EXIF Makemote podría conllevar a bloqueos y condiciones potenciales de uso de la memoria previamente liberada. It was discovered that libexif incorrectly handled certain inputs. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html • CWE-822: Untrusted Pointer Dereference CWE-908: Use of Uninitialized Resource •
CVSS: 9.1EPSS: 0%CPEs: 9EXPL: 0CVE-2020-13112 – libexif: several buffer over-reads in EXIF MakerNote handling can lead to information disclosure and DoS
https://notcve.org/view.php?id=CVE-2020-13112
21 May 2020 — An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This is different from CVE-2020-0093. Se descubrió un problema en libexif versiones anteriores a la versión 0.6.22. Varias lecturas excesivas de buffer en el manejo de EXIF MakerNote podrían conllevar a una divulgación de información y a bloqueos. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2020-13114 – libexif: unrestricted size in handling Canon EXIF MakerNote data can lead to consumption of large amounts of compute time
https://notcve.org/view.php?id=CVE-2020-13114
21 May 2020 — An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data. Se descubrió un problema en el libexif versiones anteriores a la versión 0.6.22. Un tamaño sin restricciones en el manejo de los datos de Canon EXIF MakerNote podría conllevar al consumo de grandes cantidades de tiempo de cálculo para la decodificación de datos EXIF. It was discovered that libexif incorrectly handled c... • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 97%CPEs: 31EXPL: 5CVE-2020-8617 – A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
https://notcve.org/view.php?id=CVE-2020-8617
19 May 2020 — Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately e... • https://packetstorm.news/files/id/180550 • CWE-617: Reachable Assertion •
CVSS: 6.5EPSS: 0%CPEs: 45EXPL: 0CVE-2020-13143 – Debian Security Advisory 4698-1
https://notcve.org/view.php?id=CVE-2020-13143
18 May 2020 — gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4. En la función gadget_dev_desc_UDC_store en el archivo drivers/usb/gadget/configfs.c en el kernel de Linux versión 3.16 hasta la versión 5.6.13, se basa en kstrdup sin considerar la posibilidad de un valor "\0" interno, lo que permite a atacantes desenca... • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html • CWE-125: Out-of-bounds Read •