CVSS: 9.8EPSS: 12%CPEs: 12EXPL: 0CVE-2019-12525 – squid: parsing of header Proxy-Authentication leads to memory corruption
https://notcve.org/view.php?id=CVE-2019-12525
An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it performs a memcpy of its length minus 2. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html http://www.squid-cache.org/Versions/v4/changesets http://www.squid-cache.org/Versions/v4/changesets/squid-4-7f73e9c5d17664b882ed32590e6af310c247f320.patch https://github.com/squid-cache/squid/commits/v4 https://lists.debian.org/debian-lts-announce/2019/07/msg00018.html https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html https://lists • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 2%CPEs: 17EXPL: 0CVE-2019-12527 – squid: heap-based buffer overflow in HttpHeader::getAuth
https://notcve.org/view.php?id=CVE-2019-12527
An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data. Se detectó un problema en Squid versiones 4.0.23 hasta 4.7. Al comprobar la autenticación básica con la función HttpHeader::getAuth, Squid utiliza un búfer global para almacenar los datos descodificados. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html http://www.securityfocus.com/bid/109143 http://www.squid-cache.org/Versions/v4/changesets http://www.squid-cache.org/Versions/v4/changesets/squid-4-7f73e9c5d17664b882ed32590e6af310c247f320.patch https://access.redhat.com/errata/RHSA-2019:2593 https://github.com/squid-cache/squid/commits/v4 https://lists.fedoraproject.org/archives/list/package-announce%40li • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 1CVE-2019-13454 – ImageMagick: division by zero in RemoveDuplicateLayers in MagickCore/layer.c
https://notcve.org/view.php?id=CVE-2019-13454
ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c. ImageMagick versión 7.0.8-54 Q16, permite la División por Cero en la función RemoveDuplicateLayers en el archivo MagickCore/layer.c. • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html http://www.securityfocus.com/bid/109099 https://github.com/ImageMagick/ImageMagick/commit/1ddcf2e4f28029a888cadef2e757509ef5047ad8 https://github.com/ImageMagick/ImageMagick/issues/1629 https://github.com/ImageMagick/ImageMagick6/commit/4f31d78716ac94c85c244efcea368fea202e2ed4 https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html https://usn.ubuntu.com/4192-1 https://www.debian.org/security/2020/dsa-4712 https://access.redhat.com • CWE-369: Divide By Zero •
CVSS: 7.0EPSS: 0%CPEs: 10EXPL: 1CVE-2019-7307 – Apport contains a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml
https://notcve.org/view.php?id=CVE-2019-7307
Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on the system and so cause Apport to include the contents of this other file in the resulting crash report. The crash report could then be read by that user either by causing it to be uploaded and reported to Launchpad, or by leveraging some other vulnerability to read the resulting crash report, and so allow the user to read arbitrary files on the system. Apport versiones anteriores a 2.14.1-0ubuntu3.29 + esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contenían una vulnerabilidad TOCTTOU cuando leen los usuarios el archivo ~/.apport-ignore.xml, que permite a un atacante local reemplazar este archivo con un enlace simbólico en cualquier otro archivo sobre el sistema y, por lo tanto, causar que Apport incluya el contenido de este otro archivo en el reporte del bloqueo resultante. El reporte de bloqueo podría ser leído por ese usuario provocando que sea cargado y reportado para Launchpad, o aprovechando alguna otra vulnerabilidad para leer el reporte de bloqueo resultante, y así permitir al usuario leer archivos arbitrarios en el sistema. • http://packetstormsecurity.com/files/172858/Ubuntu-Apport-Whoopsie-DoS-Integer-Overflow.html https://bugs.launchpad.net/ubuntu/%2Bsource/apport/%2Bbug/1830858 https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-7307.html • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 2CVE-2019-11476 – Integer overflow in whoopsie results in out-of-bounds heap write
https://notcve.org/view.php?id=CVE-2019-11476
An integer overflow in whoopsie before versions 0.2.52.5ubuntu0.1, 0.2.62ubuntu0.1, 0.2.64ubuntu0.1, 0.2.66, results in an out-of-bounds write to a heap allocated buffer when processing large crash dumps. This results in a crash or possible code-execution in the context of the whoopsie process. Un desbordamiento de enteros en whoopsie versiones anteriores a 0.2.52.5ubuntu0.1, 0.2.62ubuntu0.1, 0.2.64ubuntu0.1, 0.2.66, lo que resulta en una escritura fuera de límites en un búfer asignado de la pila cuando se procesan volcados por bloqueos largos. Esto resulta en un bloqueo o una posible ejecución de código en el contexto del proceso de whoopsie. • http://packetstormsecurity.com/files/172858/Ubuntu-Apport-Whoopsie-DoS-Integer-Overflow.html https://bugs.launchpad.net/ubuntu/%2Bsource/whoopsie/%2Bbug/1830863 https://usn.ubuntu.com/4052-1 • CWE-190: Integer Overflow or Wraparound •