CVSS: 9.3EPSS: 0%CPEs: 9EXPL: 0CVE-2020-12419 – Mozilla: Use-after-free in nsGlobalWindowInner
https://notcve.org/view.php?id=CVE-2020-12419
02 Jul 2020 — When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Al procesar devoluciones de llamada que ocurrieron durante el vaciado de la ventana en el proceso principal, la ventana asociada puede terminar; causando una condición de uso de la memoria pre... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-416: Use After Free •
CVSS: 9.3EPSS: 0%CPEs: 9EXPL: 1CVE-2020-12420 – Mozilla: Use-After-Free when trying to connect to a STUN server
https://notcve.org/view.php?id=CVE-2020-12420
02 Jul 2020 — When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Al intentar conectarse a un servidor STUN, una condición de carrera podría haber causado un uso de la memoria previamente liberada de un puntero, conllevando a una corrupción de la memoria y un bloqueo potencialmente explotable. Esta vulnerabilidad a... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2020-12421 – Mozilla: Add-On updates did not respect the same certificate trust rules as software updates
https://notcve.org/view.php?id=CVE-2020-12421
02 Jul 2020 — When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Cuando se llevan a cabo actualizaciones de add-on, las cadenas de certificados que terminan en non-built-in-roots fueron rechazadas (incluso si fueron agregadas legítim... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-295: Improper Certificate Validation CWE-296: Improper Following of a Certificate's Chain of Trust •
CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 0CVE-2017-18922 – libvncserver: websocket decoding buffer overflow
https://notcve.org/view.php?id=CVE-2017-18922
30 Jun 2020 — It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow. Se detectó que el archivo websockets.c en LibVNCServer versiones anteriores a 0.9.12, no decodificaba apropiadamente determinados tramas de WebSocket. Un atacante malicioso podría explotar esto mediante el envío de tramas de WebSocket especialmente diseñada... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00020.html • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2020-15393
https://notcve.org/view.php?id=CVE-2020-15393
29 Jun 2020 — In the Linux kernel 4.4 through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770. En el kernel de Linux versión 4.4 hasta la versión 5.7.6, la función usbtest_disconnect en el archivo drivers/usb/misc/usbtest.c presenta una pérdida de memoria, también se conoce como CID-28ebeb8db770 • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00071.html • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 0CVE-2020-4067 – Improper Initialization in coturn
https://notcve.org/view.php?id=CVE-2020-4067
28 Jun 2020 — In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3. En coturn anterior a la versión 4.5.1.3, se presenta un problema por el cual el búfer de respuesta STUN/TURN no se inicializa apr... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00010.html • CWE-665: Improper Initialization •
CVSS: 4.4EPSS: 0%CPEs: 6EXPL: 0CVE-2020-5973
https://notcve.org/view.php?id=CVE-2020-5973
26 Jun 2020 — NVIDIA Virtual GPU Manager and the guest drivers contain a vulnerability in vGPU plugin, in which there is the potential to execute privileged operations, which may lead to denial of service. This affects vGPU version 8.x (prior to 8.4), version 9.x (prior to 9.4) and version 10.x (prior to 10.3). NVIDIA Virtual GPU Manager y los controladores de invitado contienen una vulnerabilidad en el plugin vGPU, en la que existe el potencial de ejecutar operaciones privilegiadas, lo que puede conllevar a una denegaci... • https://nvidia.custhelp.com/app/answers/detail/a_id/5031 •
CVSS: 5.5EPSS: 0%CPEs: 11EXPL: 0CVE-2020-15305
https://notcve.org/view.php?id=CVE-2020-15305
26 Jun 2020 — An issue was discovered in OpenEXR before 2.5.2. Invalid input could cause a use-after-free in DeepScanLineInputFile::DeepScanLineInputFile() in IlmImf/ImfDeepScanLineInputFile.cpp. Se detectó un problema en OpenEXR versiones anteriores a v2.5.2. La entrada no válida podría causar un uso de la memoria previamente liberada de la función DeepScanLineInputFile::DeepScanLineInputFile() en el archivo IlmImf/ImfDeepScanLineInputFile.cpp • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00025.html • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 11EXPL: 0CVE-2020-15306
https://notcve.org/view.php?id=CVE-2020-15306
26 Jun 2020 — An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp. Se detectó un problema en OpenEXR versiones anteriores a v2.5.2. Los atributos chunkCount no válidos pueden causar un desbordamiento del búfer de la pila en la función getChunkOffsetTableSize() en el archivo IlmImf/ImfMisc.cpp • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00025.html • CWE-787: Out-of-bounds Write •
CVSS: 4.7EPSS: 0%CPEs: 19EXPL: 0CVE-2020-5967
https://notcve.org/view.php?id=CVE-2020-5967
25 Jun 2020 — NVIDIA Linux GPU Display Driver, all versions, contains a vulnerability in the UVM driver, in which a race condition may lead to a denial of service. NVIDIA Linux GPU Display Driver, todas las versiones, contiene una vulnerabilidad en el controlador UVM, en el que una condición de carrera puede conllevar a una denegación de servicio • https://nvidia.custhelp.com/app/answers/detail/a_id/5031 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •