CVSS: 5.3EPSS: 0%CPEs: 21EXPL: 0CVE-2018-3174 – mysql: Init script calling kill with root privileges using pid from pidfile owned by mysql user (CPU Oct 2018)
https://notcve.org/view.php?id=CVE-2018-3174
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. • http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html http://www.securityfocus.com/bid/105612 http://www.securitytracker.com/id/1041888 https://access.redhat.com/errata/RHSA-2018:3655 https://access.redhat.com/errata/RHSA-2019:1258 https://lists.debian.org/debian-lts-announce/2018/11/msg00004.html https://lists.debian.org/debian-lts-announce/2018/11/msg00007.html https://security.gentoo.org/glsa/201908-24 https://security.netapp.com/advisory/ntap-20181018-0002 •
CVSS: 5.5EPSS: 0%CPEs: 15EXPL: 0CVE-2018-3185 – mysql: InnoDB unspecified vulnerability (CPU Oct 2018)
https://notcve.org/view.php?id=CVE-2018-3185
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). • http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html http://www.securityfocus.com/bid/105594 http://www.securitytracker.com/id/1041888 https://access.redhat.com/errata/RHSA-2018:3655 https://access.redhat.com/errata/RHSA-2019:1258 https://security.gentoo.org/glsa/201908-24 https://security.netapp.com/advisory/ntap-20181018-0002 https://usn.ubuntu.com/3799-1 https://access.redhat.com/security/cve/CVE-2018-3185 https://bugzilla.redhat.com/show_bug.cgi?id& •
CVSS: 4.9EPSS: 0%CPEs: 14EXPL: 0CVE-2018-3276 – mysql: Server: Memcached unspecified vulnerability (CPU Oct 2018)
https://notcve.org/view.php?id=CVE-2018-3276
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Memcached). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). • http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html http://www.securityfocus.com/bid/105600 http://www.securitytracker.com/id/1041888 https://access.redhat.com/errata/RHSA-2018:3655 https://security.netapp.com/advisory/ntap-20181018-0002 https://usn.ubuntu.com/3799-1 https://access.redhat.com/security/cve/CVE-2018-3276 https://bugzilla.redhat.com/show_bug.cgi?id=1640307 •
CVSS: 4.4EPSS: 0%CPEs: 13EXPL: 0CVE-2018-3284 – mysql: InnoDB unspecified vulnerability (CPU Oct 2018)
https://notcve.org/view.php?id=CVE-2018-3284
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). • http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html http://www.securityfocus.com/bid/105594 http://www.securitytracker.com/id/1041888 https://access.redhat.com/errata/RHSA-2018:3655 https://access.redhat.com/errata/RHSA-2019:1258 https://security.gentoo.org/glsa/201908-24 https://security.netapp.com/advisory/ntap-20181018-0002 https://usn.ubuntu.com/3799-1 https://access.redhat.com/security/cve/CVE-2018-3284 https://bugzilla.redhat.com/show_bug.cgi?id& •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 1CVE-2018-10839 – QEMU: ne2000: integer overflow leads to buffer overflow issue
https://notcve.org/view.php?id=CVE-2018-10839
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS. El emulador Qemu en versiones iguales o anteriores a la 3.0.0 con soporte para emulación NE2000 NIC es vulnerable a un desbordamiento de enteros, lo que podría conducir a un problema de desbordamiento de búfer. Podría ocurrir al recibir paquetes por red. • https://access.redhat.com/errata/RHSA-2019:2892 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10839 https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03273.html https://usn.ubuntu.com/3826-1 https://www.debian.org/security/2018/dsa-4338 https://www.openwall.com/lists/oss-security/2018/10/08/1 https://access.redhat.com/security/cve/CVE-2018-10839 https://bugzilla.redhat.com/show • CWE-121: Stack-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •