Page 14 of 254 results (0.025 seconds)

CVSS: 6.7EPSS: 0%CPEs: 11EXPL: 0

CVE-2020-14344 – libX11: Heap overflow in the X input method client

https://notcve.org/view.php?id=CVE-2020-14344

An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux. Se encontró un desbordamiento de enteros conllevando a un desbordamiento del búfer de la pila en el cliente X Input Method (XIM), se implementó en libX11 anterior a la versión 1.6.10. Según aguas arriba, esto es relevante para la seguridad cuando los programas setuid llaman a las funciones del cliente XIM mientras se ejecutan con privilegios elevados. • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00024.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00031.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14344 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4VDDSAYV7XGNRCXE7HCU23645MG74OFF https://lists.fedoraproject.org/ar • CWE-190: Integer Overflow or Wraparound •

CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0

CVE-2020-14347 – X.Org Server Pixel Data Uninitialized Memory Information Disclosure Vulnerability

https://notcve.org/view.php?id=CVE-2020-14347

A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server runs with elevated privileges, this could result in possible ASLR bypass. Xorg-server before version 1.20.9 is vulnerable. Se encontró un fallo en la manera en que la memoria de xserver no fue inicializada apropiadamente. • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00066.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00075.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14347 https://lists.debian.org/debian-lts-announce/2020/08/msg00057.html https://lists.x.org/archives/xorg-announce/2020-July/003051.html https://security.gentoo.org/glsa/202012-01 https://usn.ubuntu.com/4488-1 https://usn.ubuntu.com/4488-2 https://www.debian.org/security&#x • CWE-665: Improper Initialization •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2019-19605

https://notcve.org/view.php?id=CVE-2019-19605

X-Plane before 11.41 allows Arbitrary Memory Write via crafted network packets, which could cause a denial of service or arbitrary code execution. X-Plane en versiones anteriores a la 11.41, permite una Escritura de Memoria Arbitraria mediante paquetes de red diseñados, lo que podría causar una denegación de servicio o una ejecución de código arbitraria. • https://blog.0xlabs.com/2020/03/x-plane-1141-remote-command-execution.html • CWE-787: Out-of-bounds Write •

CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1

CVE-2019-19606

https://notcve.org/view.php?id=CVE-2019-19606

X-Plane before 11.41 has multiple improper path validations that could allow reading and writing files from/to arbitrary paths (or a leak of OS credentials to a remote system) via crafted network packets. This could be used to execute arbitrary commands on the system. X-Plane en versiones anteriores a la 11.41, presenta múltiples comprobaciones de ruta inapropiadas que podrían permitir leer y escribir archivos desde y hacia rutas arbitrarias (o una fuga de credenciales del Sistema Operativo hacia un sistema remoto) mediante paquetes de red diseñados. Esto podría ser usado para ejecutar comandos arbitrarios sobre el sistema. • https://blog.0xlabs.com/2020/03/x-plane-1141-remote-command-execution.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2019-17624 – X.Org X Server 1.20.4 - Local Stack Overflow

https://notcve.org/view.php?id=CVE-2019-17624

"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sending ct.c_char 1000 times, an attacker can cause a denial of service (application crash) or possibly have unspecified other impact. Note: It is disputed if the X.Org X Server is involved or if there is a stack overflow. En X.Org X Server versión 1.20.4, se presenta un desbordamiento de búfer en la región stack de la memoria en la función XQueryKeymap. Por ejemplo, al enviar ct.c_char 1000 veces, un atacante puede causar una denegación de servicio (bloqueo de aplicación) o posiblemente tener otro impacto no especificado. • https://www.exploit-db.com/exploits/47507 http://packetstormsecurity.com/files/154868/X.Org-X-Server-1.20.4-Local-Stack-Overflow.html https://www.x.org/releases/individual/xserver • CWE-787: Out-of-bounds Write •