CVSS: 9.1EPSS: 2%CPEs: 6EXPL: 0CVE-2019-17544
https://notcve.org/view.php?id=CVE-2019-17544
libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character. La biblioteca libaspell.a en GNU Aspell versiones anteriores a 0.60.8, presenta una lectura excesiva del búfer en la región stack de la memoria en la función acommon::unescape en el archivo common/getdata.cpp por medio de un carácter \ aislado. • https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16109 https://github.com/GNUAspell/aspell/commit/80fa26c74279fced8d778351cff19d1d8f44fe4e https://github.com/GNUAspell/aspell/compare/rel-0.60.7...rel-0.60.8 https://lists.debian.org/debian-lts-announce/2019/10/msg00027.html https://lists.debian.org/debian-lts-announce/2021/07/msg00021.html https://usn.ubuntu.com/4155-1 https://usn.ubuntu.com/4155-2 https://www.debian.org/security/2021/dsa-4948 • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 2CVE-2019-17455
https://notcve.org/view.php?id=CVE-2019-17455
Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request. Libntlm versiones hasta 1.5, se basa en un tamaño de búfer fijo para operaciones de lectura y escritura de las funciones tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge y tSmbNtlmAuthResponse, como es demostrado por una lectura excesiva de búfer en la región heap de la memoria en la función buildSmbNtlmAuthRequest en el archivo smbutil.c para una petición NTLM especialmente diseñada. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00029.html http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00032.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942145 https://gitlab.com/jas/libntlm/issues/2 https://lists.debian.org/debian-lts-announce/2020/05/msg00010.html https://lists.debian.org/debian-lts-announce/2021/11/msg00026.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BVFO3OVJPMSGIXBKNOCVOJZ3UTGZQF5 • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2019-17402 – exiv2: out-of-bounds read in CiffDirectory::readDirectory due to lack of size check
https://notcve.org/view.php?id=CVE-2019-17402
Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size. Exiv2 versión 0.27.2, permite a atacantes activar un bloqueo en la función Exiv2::getULong en el archivo types.cpp cuando es llamada desde la función Exiv2::Internal::CiffDirectory::readDirectory en el archivo crwimage_int.cpp, porque no existe comprobación de la relación del tamaño total con el desplazamiento y el tamaño. An out of bounds read vulnerability was discovered in the way exiv2 parses Canon raw format (CRW) images. An application that uses exiv2 library to parse untrusted images may be vulnerable to this flaw, which could be used by an attacker to extract data from the application's memory or make it crash. The biggest threat with this vulnerability is availability of the system. • https://github.com/Exiv2/exiv2/issues/1019 https://lists.debian.org/debian-lts-announce/2019/12/msg00001.html https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html https://usn.ubuntu.com/4159-1 https://access.redhat.com/security/cve/CVE-2019-17402 https://bugzilla.redhat.com/show_bug.cgi?id=1773683 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 48%CPEs: 159EXPL: 17CVE-2019-2215 – Android Kernel Use-After-Free Vulnerability
https://notcve.org/view.php?id=CVE-2019-2215
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095 Un uso de la memoria previamente liberada en el archivo binder.c, permite una elevación de privilegios desde una aplicación en el kernel de Linux. No es requerida una interacción del usuario para explotar esta vulnerabilidad, sin embargo, la explotación necesita de la instalación de una aplicación local maliciosa o una vulnerabilidad separada en una aplicación de red. Producto: Android; ID de Android: A-141720095 Android suffers from a use-after-free vulnerability in the binder driver at /drivers/android/binder.c. Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. • https://www.exploit-db.com/exploits/48129 https://www.exploit-db.com/exploits/47463 https://github.com/timwr/CVE-2019-2215 https://github.com/LIznzn/CVE-2019-2215 https://github.com/ATorNinja/CVE-2019-2215 https://github.com/stevejubx/CVE-2019-2215 https://github.com/c3r34lk1ll3r/CVE-2019-2215 https://github.com/qre0ct/android-kernel-exploitation-ashfaq-CVE-2019-2215 https://github.com/mufidmb38/CVE-2019-2215 https://github.com/Byte-Master-101/CVE-2019-2215 https: • CWE-416: Use After Free •
CVSS: 9.8EPSS: 1%CPEs: 12EXPL: 0CVE-2019-17133 – kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c
https://notcve.org/view.php?id=CVE-2019-17133
In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow. En el kernel de Linux versiones hasta 5.3.2, la función cfg80211_mgd_wext_giwessid en el archivo net/wireless/wext-sme.c no rechaza un SSID IE largo, conllevando a un Desbordamiento de Búfer. A vulnerability was found in the Linux kernel's generic WiFi ESSID handling implementation. The flaw allows a system to join a wireless network where the ESSID is longer than the maximum length of 32 characters, which can cause the system to crash or execute code. • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00064.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00010.html http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html https://access.redhat.com/errata/RHSA-2020:0174 https://access.redhat.com/errata/RHSA-2020:0374 https://access.redhat.com/errata/RHSA-2020:0375 https://access.redhat.com/errata/RHSA-2020:0543 https://access.redhat.com/errata/RHSA-2020:0592 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •