CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 2CVE-2018-14498 – libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service
https://notcve.org/view.php?id=CVE-2018-14498
get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries. get_8bit_row en rdbmp.c en libjpeg-turbo, hasta la versión 1.5.90, y MozJPEG, hasta la versión 3.3.1, permite a los atacantes provocar una denegación de servicio (sobrelectura de búfer basada en memoria dinámica [heap]) mediante un BMP de 8-bit manipulado en el que uno o más de los índices de color está fuera de rango en para el número de entradas de paleta. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00015.html https://access.redhat.com/errata/RHSA-2019:2052 https://access.redhat.com/errata/RHSA-2019:3705 https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9c78a04df4e44ef6487eee99c4258397f4fdca55 https://github.com/libjpeg-turbo/libjpeg-turbo/issues/258 https://github.com/mozilla/mozjpeg/issues/299 https://lists.debian.org/debian-lts-announce/2019/03/msg00021 • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 13EXPL: 4CVE-2019-9213 – Linux < 4.20.14 - Virtual Address 0 is Mappable via Privileged write() to /proc/*/mem
https://notcve.org/view.php?id=CVE-2019-9213
In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task. En el kernel de Linux, en versiones anteriores a la 4.20.14, expand_downwards en mm/mmap.c carece de una comprobación para la dirección mínima de mmap, lo que facilita que los atacantes exploten desreferencias de puntero NULL en el kernel en plataformas que no son SMAP. Esto esto está relacionado con una comprobación de capacidades para la tarea equivocada. A flaw was found in mmap in the Linux kernel allowing the process to map a null page. • https://www.exploit-db.com/exploits/46502 https://www.exploit-db.com/exploits/47957 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0a1d52994d440e21def1c2174932410b4f2a98a1 http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00045.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00052.html http://packetstormsecurity.com/files/156053/Reliable-Datagram-Sockets-RDS-rds_atomic_free_op-Privilege-Escalation.html http://www.securityfocus.com/bid/107296 https&# • CWE-476: NULL Pointer Dereference •
CVSS: 9.8EPSS: 2%CPEs: 8EXPL: 0CVE-2019-9215
https://notcve.org/view.php?id=CVE-2019-9215
In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function. En Live555, antes del 27/02/2019, cabeceras mal formadas conducen a un acceso de memoria inválida en la función parseAuthorizationHeader. • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00044.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00024.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00009.html http://www.live555.com/liveMedia/public/changelog.txt https://lists.debian.org/debian-lts-announce/2019/03/msg00022.html https://seclists.org/bugtraq/2019/Mar/22 https://security.gentoo.org/glsa/202005-06 https://www.debian.org/security/2019/dsa-4408 •
CVSS: 5.5EPSS: 0%CPEs: 10EXPL: 1CVE-2019-9209
https://notcve.org/view.php?id=CVE-2019-9209
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. This was addressed in epan/dissectors/packet-ber.c by preventing a buffer overflow associated with excessive digits in time values. En Wireshark, desde la versión 2.4.0 hasta la 2.4.12 y desde la 2.6.0 hasta la 2.6.6, el disector ASN.1 BER y relacionados podrían cerrarse inesperadamente. Esto se abordó en epan/dissectors/packet-ber.c, previniendo un desbordamiento de búfer asociado con dígitos excesivos en los valores de tiempo. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00027.html http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html http://www.securityfocus.com/bid/107203 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15447 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f8fbe9f934d65b2694fa74622e5eb2e1dc8cd20b https://lists.debian.org/debian-lts-announce/2019/03/msg00031.html https:/ • CWE-193: Off-by-one Error CWE-787: Out-of-bounds Write •
CVSS: 5.9EPSS: 1%CPEs: 180EXPL: 0CVE-2019-1559 – 0-byte record padding oracle
https://notcve.org/view.php?id=CVE-2019-1559
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html http://www.securityfocus.com/bid/107174 https://access. • CWE-203: Observable Discrepancy CWE-325: Missing Cryptographic Step •