CVSS: 10.0EPSS: 0%CPEs: 18EXPL: 0CVE-2018-18505 – Mozilla: Privilege escalation through IPC channel messages
https://notcve.org/view.php?id=CVE-2018-18505
An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC process creation. This authentication is insufficient for channels created after the IPC process is started, leading to the authentication not being correctly applied to later channels. This could allow for a sandbox escape through IPC channels due to lack of message validation in the listener process. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65. Una solución anterior para la vulnerabilidad de comunicación entre procesos (IPC), CVE-2011-3079, añadía una autenticación para comunicaciones entre endpoints de IPC y servidores padres durante la creación de procesos IPC. • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html http://www.securityfocus.com/bid/106781 https://access.redhat.com/errata/RHSA-2019:0218 https://access.redhat.com/errata/RHSA-2019:0219 https://access.redhat.com/errata/RHSA-2019:0269 https://access.redhat.com/errata/RHSA-2019:0270 https://bugzilla.mozilla.org/show_bug.cgi?id=1087565 https://lists.debian.org/debian-lts-announce/2019/01/msg00025.html https://lists.debian.org/debian-lts-announce/2019/02&# • CWE-287: Improper Authentication •
CVSS: 8.0EPSS: 0%CPEs: 16EXPL: 0CVE-2019-3813 – spice: Off-by-one error in array access in spice/server/memslot.c
https://notcve.org/view.php?id=CVE-2019-3813
Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers. Spice, desde la versión 0.5.2 hasta la 0.14.1, son vulnerables a una lectura fuera de límites debido a un error por un paso en memslot_get_virt. Esto podría conducir a una denegación de servicio (DoS) o, en el peor de los casos, la ejecución de código por parte de atacantes no autenticados. • http://www.securityfocus.com/bid/106801 https://access.redhat.com/errata/RHSA-2019:0231 https://access.redhat.com/errata/RHSA-2019:0232 https://access.redhat.com/errata/RHSA-2019:0457 https://bugzilla.redhat.com/show_bug.cgi?id=1665371 https://lists.debian.org/debian-lts-announce/2019/01/msg00026.html https://security.gentoo.org/glsa/202007-30 https://usn.ubuntu.com/3870-1 https://www.debian.org/security/2019/dsa-4375 https://access.redhat.com/security/cve/CVE-2 • CWE-193: Off-by-one Error •
CVSS: 5.5EPSS: 0%CPEs: 19EXPL: 1CVE-2019-7150 – elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c
https://notcve.org/view.php?id=CVE-2019-7150
An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack. Se ha descubierto un problema en la versión 0.175 de elfutils. Podría ocurrir un fallo de segmentación en la función elf64_xlatetom en libelf/elf32_xlatetom.c, debido a que "dwfl_segment_report_module" no comprueba si la lectura de datos dyn desde un archivo core está truncada. • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html https://access.redhat.com/errata/RHSA-2019:2197 https://access.redhat.com/errata/RHSA-2019:3575 https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html https://sourceware.org/bugzilla/show_bug.cgi?id=24103 https://sourceware.org/ml/elfutils-devel/2019-q1/msg00070.html https://usn.ubuntu.com/4012-1 https://access.redhat.com&#x • CWE-125: Out-of-bounds Read •
CVSS: 3.3EPSS: 0%CPEs: 7EXPL: 0CVE-2019-3815 – systemd: memory leak in journald-server.c introduced by fix for CVE-2018-16864
https://notcve.org/view.php?id=CVE-2019-3815
A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c does not free the memory allocated by set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-journald crash. This issue only affects versions shipped with Red Hat Enterprise since v219-62.2. Se descubrió una fuga de memoria en el "backport" de soluciones para CVE-2018-16864 en Red Hat Enterprise Linux. • http://www.securityfocus.com/bid/106632 https://access.redhat.com/errata/RHBA-2019:0327 https://access.redhat.com/errata/RHSA-2019:0201 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3815 https://lists.debian.org/debian-lts-announce/2019/03/msg00013.html https://access.redhat.com/security/cve/CVE-2019-3815 https://bugzilla.redhat.com/show_bug.cgi?id=1666690 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.8EPSS: 2%CPEs: 18EXPL: 4CVE-2019-6116 – Ghostscript 9.26 - Pseudo-Operator Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-6116
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution. En Artifex Ghostscript hasta la versión 9.26, los procedimientos ephemeral o transient pueden permitir el acceso a los operadores del sistema, lo que conduce a la ejecución remota de código. It was found that ghostscript could leak sensitive operators on the operand stack when a pseudo-operator pushes a subroutine. A specially crafted PostScript file could use this flaw to escape the -dSAFER protection in order to, for example, have access to the file system outside of the SAFER constraints. Ghostscript has an issue with pseudo-operators that can lead to remote code execution. • https://www.exploit-db.com/exploits/46242 http://lists.opensuse.org/opensuse-security-announce/2019-01/msg00047.html http://lists.opensuse.org/opensuse-security-announce/2019-01/msg00048.html http://packetstormsecurity.com/files/151307/Ghostscript-Pseudo-Operator-Remote-Code-Execution.html http://packetstormsecurity.com/files/152367/Slackware-Security-Advisory-ghostscript-Updates.html http://www.openwall.com/lists/oss-security/2019/01/23/5 http://www.openwall.com/lists/oss-security/2019/03/21/1 http: •