CVSS: 5.0EPSS: 0%CPEs: 15EXPL: 2CVE-2020-14364 – QEMU: usb: out-of-bounds r/w access issue while processing usb packets
https://notcve.org/view.php?id=CVE-2020-14364
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host. Se encontró un fallo de acceso de lectura/escritura fuera de límites en el emulador USB de QEMU en versiones anteriores a la 5.2.0. Este problema ocurre mientras se procesan paquetes USB de un invitado cuando USBDevice "setup_len" excede su "data_buf [4096]" en las rutinas do_token_in, do_token_out. • https://github.com/gejian-iscas/CVE-2020-14364 https://github.com/y-f00l/CVE-2020-14364 http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00024.html https://bugzilla.redhat.com/show_bug.cgi?id=1869201 https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTZQUQ6ZBPMFMNAUQBVJFELYNMUZLL6P https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M52WIRMZL6T • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 8.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-14352 – librepo: missing path validation in repomd.xml may lead to directory traversal
https://notcve.org/view.php?id=CVE-2020-14352
A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories. • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00072.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00055.html https://bugzilla.redhat.com/show_bug.cgi?id=1866498 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33RX4P5R5YL4NZSFSE4NOX37X6YCXAS4 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OOMDEQBRJ7SO2QWL7H23G3VV2VSCUYOY https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org&# • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.6EPSS: 0%CPEs: 12EXPL: 0CVE-2020-15810 – squid: HTTP Request Smuggling could result in cache poisoning
https://notcve.org/view.php?id=CVE-2020-15810
An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html https://github.com/squid-cache/squid/security/advisories/GHSA-3365-q9qx-f98m https://lists.debian.org/debian-lts-announce/2020/10/msg00005.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BE6FKUN7IGTIR2MEEMWYDT7N5EJJLZI2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMTFLVB7GLRF2C • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 9.6EPSS: 0%CPEs: 12EXPL: 0CVE-2020-15811 – squid: HTTP Request Splitting could result in cache poisoning
https://notcve.org/view.php?id=CVE-2020-15811
An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html https://github.com/squid-cache/squid/security/advisories/GHSA-c7p8-xqhm-49wv https://lists.debian.org/debian-lts-announce/2020/10/msg00005.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BE6FKUN7IGTIR2MEEMWYDT7N5EJJLZI2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMTFLVB7GLRF2C • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CWE-697: Incorrect Comparison •
CVSS: 5.9EPSS: 0%CPEs: 3EXPL: 1CVE-2020-24661
https://notcve.org/view.php?id=CVE-2020-24661
GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificates) when the client system is not configured to use a system-provided PKCS#11 store. This allows a meddler in the middle to present a different invalid certificate to intercept incoming and outgoing mail. GNOME Geary versiones anteriores a 3.36.3, maneja inapropiadamente la verificación del certificado TLS anclado para servicios IMAP y SMTP usando certificados TLS no válidos (por ejemplo, certificados autofirmados) cuando el sistema cliente no está configurado para usar una tienda PKCS#11 proporcionada por el sistema. Esto permite a un atacante de tipo meddler in the middle presentar un certificado no válido diferente para interceptar el correo entrante y saliente • https://gitlab.gnome.org/GNOME/geary/-/issues/866 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G7OTYTGND6EFOKNQJWCHKKXKSN7SM73Y https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS6CSTOBVO5HSAR3X5CT6DS6QDHXDB26 https://tools.cisco.com/security/center/content/CiscoSeg/message/NS6CSTOBVO5HSAR3X5CT6DS6QDHXDB26 • CWE-295: Improper Certificate Validation •