CVSS: 5.1EPSS: 0%CPEs: 23EXPL: 0CVE-2019-2739 – mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019)
https://notcve.org/view.php?id=CVE-2019-2739
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.1 (Integrity and Availability impacts). • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00037.html http://packetstormsecurity.com/files/153862/Slackware-Security-Advisory-mariadb-Updates.html http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html https://access.redhat.com/errata/RHSA-2019:2484 https://access.redhat.com/errata/RHSA-2019:2511 https://access.redhat.com/errata/RHSA-2019:3708 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A55N3HZ3JZBXHQMGTUHY63FVTDU5ILEV https:/ •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 1CVE-2019-1010228
https://notcve.org/view.php?id=CVE-2019-1010228
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQOAULR72EYJQ4HS6YGLK2S6YNEXY2ET https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBKP2O24CTYIANEJTP4TVEPYEVSYV2RX https://support.dcmtk.org/redmine/issues/858 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 17EXPL: 0CVE-2019-9959 – poppler: integer overflow in JPXStream::init function leading to memory consumption
https://notcve.org/view.php?id=CVE-2019-9959
The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo. La función JPXStream::init en Poppler versión 0.78.0 y anteriores, no comprueba los valores negativos de la longitud de la transmisión, lo que conlleva a un Desbordamiento de Enteros, y por lo tanto hace posible asignar una gran fragmento de memoria en la pila, con un tamaño controlado por un atacante, como es demostrado por pdftocairo. • http://www.securityfocus.com/bid/109342 https://access.redhat.com/errata/RHSA-2019:2713 https://gitlab.freedesktop.org/poppler/poppler/blob/master/NEWS https://lists.debian.org/debian-lts-announce/2019/10/msg00024.html https://lists.debian.org/debian-lts-announce/2020/11/msg00014.html https://lists.debian.org/debian-lts-announce/2022/09/msg00030.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5ZOYOZTGU4RGZW4E63OZ7LW4SMPEWGBV https://lists.fedoraproject • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 92%CPEs: 11EXPL: 2CVE-2019-12815
https://notcve.org/view.php?id=CVE-2019-12815
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306. Una vulnerabilidad de copia de archivo arbitraria en mod_copy en ProFTPD hasta versión 1.3.5b, permite la ejecución de código remota y la divulgación de información sin autenticación, un problema relacionado con CVE-2015-3306. • https://github.com/KTN1990/CVE-2019-12815 http://bugs.proftpd.org/show_bug.cgi?id=4372 http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00022.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html http://www.securityfocus.com/bid/109339 https://cert-portal.siemens.com/productcert/pdf/ssa-940889.pdf https://github.com/proftpd/proftpd/pull/816 https://lists.debian.org/ • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 9.8EPSS: 2%CPEs: 28EXPL: 1CVE-2019-1010238 – pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow
https://notcve.org/view.php?id=CVE-2019-1010238
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize. Pango versión 1.42 y posterior de Gnome, está afectada por: Desbordamiento de Búfer. • https://access.redhat.com/errata/RHBA-2019:2824 https://access.redhat.com/errata/RHSA-2019:2571 https://access.redhat.com/errata/RHSA-2019:2582 https://access.redhat.com/errata/RHSA-2019:2594 https://access.redhat.com/errata/RHSA-2019:3234 https://gitlab.gnome.org/GNOME/pango/-/commits/main/pango/pango-bidi-type.c https://gitlab.gnome.org/GNOME/pango/-/issues/342 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D6HWAHXJ2ZXINYMANHPFDD • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •