CVSS: 4.3EPSS: 0%CPEs: 17EXPL: 0CVE-2018-12374 – thunderbird: Using form to exfiltrate encrypted mail part by pressing enter in form field
https://notcve.org/view.php?id=CVE-2018-12374
Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird < 52.9. El texto plano de los emails descifrados puede ser filtrado por usuarios que envían un formulario embebido al presionar la tecla enter en un campo de introducción de texto. La vulnerabilidad afecta a Thunderbird en versiones anteriores a la 52.9. • http://www.securityfocus.com/bid/104613 https://access.redhat.com/errata/RHSA-2018:2251 https://access.redhat.com/errata/RHSA-2018:2252 https://bugzilla.mozilla.org/show_bug.cgi?id=1462910 https://lists.debian.org/debian-lts-announce/2018/07/msg00013.html https://security.gentoo.org/glsa/201811-13 https://usn.ubuntu.com/3714-1 https://www.debian.org/security/2018/dsa-4244 https://www.mozilla.org/security/advisories/mfsa2018-18 https://access.redhat.com/security/cve/ • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-356: Product UI does not Warn User of Unsafe Actions •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2018-4180 – cups: Local privilege escalation to root due to insecure environment variable handling
https://notcve.org/view.php?id=CVE-2018-4180
In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions. En macOS High Sierra en versiones anteriores a la 10.13.5, existía un problema en CUPS. Este problema se abordó mediante la mejora de las restricciones de acceso. It was discovered that CUPS allows non-root users to pass environment variables to CUPS backends. • https://lists.debian.org/debian-lts-announce/2018/07/msg00014.html https://security.gentoo.org/glsa/201908-08 https://support.apple.com/HT208849 https://usn.ubuntu.com/3713-1 https://www.debian.org/security/2018/dsa-4243 https://access.redhat.com/security/cve/CVE-2018-4180 https://bugzilla.redhat.com/show_bug.cgi?id=1607282 • CWE-642: External Control of Critical State Data •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2018-6553 – AppArmor cupsd Sandbox Bypass Due to Use of Hard Links
https://notcve.org/view.php?id=CVE-2018-6553
The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. A local attacker could possibly use this issue to escape confinement. This flaw affects versions prior to 2.2.7-1ubuntu2.1 in Ubuntu 18.04 LTS, prior to 2.2.4-7ubuntu3.1 in Ubuntu 17.10, prior to 2.1.3-4ubuntu0.5 in Ubuntu 16.04 LTS, and prior to 1.7.2-0ubuntu1.10 in Ubuntu 14.04 LTS. El perfil CUPS AppArmor confinó incorrectamente la puerta trasera dnssd debido al uso de enlaces físicos. Un atacante local podría emplear este problema para escapar del confinamiento. • https://lists.debian.org/debian-lts-announce/2018/07/msg00014.html https://security.gentoo.org/glsa/201908-08 https://usn.ubuntu.com/usn/usn-3713-1 https://www.debian.org/security/2018/dsa-4243 •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2018-4181 – cups: Manipulation of cupsd.conf by a local attacker resulting in limited reads of arbitrary files as root
https://notcve.org/view.php?id=CVE-2018-4181
In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions. En macOS High Sierra en versiones anteriores a la 10.13.5, existía un problema en CUPS. Este problema se abordó mediante la mejora de las restricciones de acceso. • https://lists.debian.org/debian-lts-announce/2018/07/msg00014.html https://security.gentoo.org/glsa/201908-08 https://support.apple.com/HT208849 https://usn.ubuntu.com/3713-1 https://www.debian.org/security/2018/dsa-4243 https://access.redhat.com/security/cve/CVE-2018-4181 https://bugzilla.redhat.com/show_bug.cgi?id=1607291 • CWE-266: Incorrect Privilege Assignment •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-0360
https://notcve.org/view.php?id=CVE-2018-0360
ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parsehwp3_paragraph() in libclamav/hwp.c. ClamAV en versiones anteriores a la 0.100.1 tiene un desbordamiento de enteros HWP con un bucle infinito resultante mediante un archivo Hangul Word Processor manipulado. Esto es en parsehwp3_paragraph() en libclamav/hwp.c. • http://www.securitytracker.com/id/1041367 https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html https://lists.debian.org/debian-lts-announce/2018/08/msg00020.html https://secuniaresearch.flexerasoftware.com/secunia_research/2018-12 https://security.gentoo.org/glsa/201904-12 https://usn.ubuntu.com/3722-1 https://usn.ubuntu.com/3722-2 • CWE-190: Integer Overflow or Wraparound •