CVSS: 6.3EPSS: 0%CPEs: 5EXPL: 0CVE-2018-1000204 – kernel: Infoleak caused by incorrect handling of the SG_IO ioctl
https://notcve.org/view.php?id=CVE-2018-1000204
Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html http://www.openwall.com/lists/oss-security/2018/06/26/3 https://access.redhat.com/errata/RHSA-2018:2948 https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html https://usn.ubuntu.com/3696-1& • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 10%CPEs: 7EXPL: 2CVE-2018-12617 – QEMU Guest Agent 2.12.50 - Denial of Service
https://notcve.org/view.php?id=CVE-2018-12617
qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket. qmp_guest_file_read en qga/commands-posix.c y qga/commands-win32.c en qemu-ga (también conocido como QEMU Guest Agent) en QEMU 2.12.50 tiene un desbordamiento de enteros que provoca que una llamada g_malloc0() desencadene un fallo de segmentación al intentar asignar un gran fragmento de memoria. La vulnerabilidad puede ser explotada mediante el envío de un comando QMP manipulado (incluyendo guest-file-read con un valor largo de conteo) al agente mediante el socket en escucha. QEMU Guest Agent version 2.12.50 suffers from a denial of service vulnerability. • https://www.exploit-db.com/exploits/44925 http://www.securityfocus.com/bid/104531 https://gist.github.com/fakhrizulkifli/c7740d28efa07dafee66d4da5d857ef6 https://lists.debian.org/debian-lts-announce/2019/02/msg00041.html https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg03385.html https://seclists.org/bugtraq/2019/May/76 https://usn.ubuntu.com/3826-1 https://www.debian.org/security/2019/dsa-4454 • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 1CVE-2018-12599 – ImageMagick: out of bounds write in ReadBMPImage and WriteBMPImage in coders/bmp.c
https://notcve.org/view.php?id=CVE-2018-12599
In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out of bounds write via a crafted file. En ImageMagick 7.0.8-3 Q16, ReadBMPImage y WriteBMPImage en coders/bmp.c permiten que los atacantes provoquen una escritura fuera de límites mediante un archivo manipulado. • https://github.com/ImageMagick/ImageMagick/issues/1177 https://lists.debian.org/debian-lts-announce/2018/06/msg00004.html https://usn.ubuntu.com/3711-1 https://www.debian.org/security/2018/dsa-4245 https://access.redhat.com/security/cve/CVE-2018-12599 https://bugzilla.redhat.com/show_bug.cgi?id=1594338 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 1CVE-2018-12600 – ImageMagick: out of bounds write ReadDIBImage and WriteDIBImage in coders/dib.c
https://notcve.org/view.php?id=CVE-2018-12600
In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out of bounds write via a crafted file. En ImageMagick 7.0.8-3 Q16, ReadDIBImage y WriteDIBImage en coders/dib.c permiten que los atacantes provoquen una escritura fuera de límites mediante un archivo manipulado. • https://github.com/ImageMagick/ImageMagick/issues/1178 https://lists.debian.org/debian-lts-announce/2018/06/msg00004.html https://usn.ubuntu.com/3711-1 https://www.debian.org/security/2018/dsa-4245 https://access.redhat.com/security/cve/CVE-2018-12600 https://bugzilla.redhat.com/show_bug.cgi?id=1594339 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2018-1152
https://notcve.org/view.php?id=CVE-2018-1152
libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image. libjpeg-turbo 1.5.90 es vulnerable a una denegación de servicio (DoS) provocada por una división entre cero al procesar una imagen BMP manipulada. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00015.html http://www.securityfocus.com/bid/104543 https://github.com/libjpeg-turbo/libjpeg-turbo/commit/43e84cff1bb2bd8293066f6ac4eb0df61ddddbc6 https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html https://usn.ubuntu.com/3706-1 https://usn.ubuntu.com/3706-2 https://www.tenab • CWE-369: Divide By Zero •