CVSS: 7.8EPSS: 83%CPEs: 43EXPL: 29CVE-2019-13272 – Linux Kernel Improper Privilege Management Vulnerability
https://notcve.org/view.php?id=CVE-2019-13272
16 Jul 2019 — In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect mar... • https://packetstorm.news/files/id/165051 • CWE-271: Privilege Dropping / Lowering Errors •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 2CVE-2019-1010301 – Ubuntu Security Notice USN-6098-1
https://notcve.org/view.php?id=CVE-2019-1010301
15 Jul 2019 — jhead 3.03 is affected by: Buffer Overflow. The impact is: Denial of service. The component is: gpsinfo.c Line 151 ProcessGpsInfo(). The attack vector is: Open a specially crafted JPEG file. jhead versión 3.03 se ve afectado por: Desbordamiento de búfer. El impacto es: Denegación de servicio. • https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1838251 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 1CVE-2019-1010302 – Ubuntu Security Notice USN-6098-1
https://notcve.org/view.php?id=CVE-2019-1010302
15 Jul 2019 — jhead 3.03 is affected by: Incorrect Access Control. The impact is: Denial of service. The component is: iptc.c Line 122 show_IPTC(). The attack vector is: the victim must open a specially crafted JPEG file. jhead versión 3.03 se ve afectada por: Control de acceso incorrecto. El impacto es: Denegación de servicio. • https://bugzilla.redhat.com/show_bug.cgi?id=1679978 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 1CVE-2019-1010305 – libmspack: buffer overflow in function chmd_read_headers()
https://notcve.org/view.php?id=CVE-2019-1010305
15 Jul 2019 — libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d. libmspack versión 0.9.1alpha se ve afectado por: Desbordamiento de búfer. • https://github.com/kyz/libmspack/commit/2f084136cfe0d05e5bf5703f3e83c6d955234b4d • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.5EPSS: 1%CPEs: 7EXPL: 1CVE-2019-1010317 – wavpack: Use of uninitialized variable in ParseCaffHeaderConfig leads to DoS
https://notcve.org/view.php?id=CVE-2019-1010317
11 Jul 2019 — WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b. • https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b • CWE-457: Use of Uninitialized Variable CWE-665: Improper Initialization CWE-908: Use of Uninitialized Resource •
CVSS: 5.5EPSS: 1%CPEs: 7EXPL: 1CVE-2019-1010319 – wavpack: Use of uninitialized variable in ParseWave64HeaderConfig leads to DoS
https://notcve.org/view.php?id=CVE-2019-1010319
11 Jul 2019 — WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe. • https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe • CWE-369: Divide By Zero CWE-457: Use of Uninitialized Variable CWE-908: Use of Uninitialized Resource •
CVSS: 5.9EPSS: 19%CPEs: 22EXPL: 0CVE-2019-12529 – squid: Out of bounds read in Proxy-Authorization header causes DoS
https://notcve.org/view.php?id=CVE-2019-12529
11 Jul 2019 — An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as wel... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 61%CPEs: 12EXPL: 0CVE-2019-12525 – squid: parsing of header Proxy-Authentication leads to memory corruption
https://notcve.org/view.php?id=CVE-2019-12525
11 Jul 2019 — An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it performs a memcpy of its length minus 2. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 17%CPEs: 17EXPL: 0CVE-2019-12527 – squid: heap-based buffer overflow in HttpHeader::getAuth
https://notcve.org/view.php?id=CVE-2019-12527
11 Jul 2019 — An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data. Se detectó un problema en Squid versiones 4.0.23 hasta 4.7. Al comprobar la autenticación básica con la función HttpHeader::getAuth, Squid utiliza un búfer global para almacenar los datos descodificado... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 4%CPEs: 10EXPL: 0CVE-2019-12838 – Debian Security Advisory 4572-1
https://notcve.org/view.php?id=CVE-2019-12838
11 Jul 2019 — SchedMD Slurm 17.11.x, 18.08.0 through 18.08.7, and 19.05.0 allows SQL Injection. Slurm versiones 17.11.x, versiones 18.08.0 hasta 18.08.7, y versión 19.05.0 de SchedMD, permite la inyección SQL. It was discovered in the Simple Linux Utility for Resource Management (SLURM), a cluster resource management and job scheduling system did not escape strings when importing an archive file into the accounting_storage/mysql backend, resulting in SQL injection. • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00005.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •