CVSS: 5.5EPSS: 0%CPEs: 43EXPL: 1CVE-2020-13434 – sqlite: integer overflow in sqlite3_str_vappendf function in printf.c
https://notcve.org/view.php?id=CVE-2020-13434
24 May 2020 — SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. SQLite versiones hasta 3.32.0, presenta un desbordamiento de enteros en la función sqlite3_str_vappendf en el archivo printf.c. An integer overflow flaw was found in the SQLite implementation of the printf() function. This flaw allows an attacker who can control the precision of floating-point conversions, to crash the application, resulting in a denial of service. Red Hat Advanced Cluster Management for Kubernetes 2.3.0 imag... • http://seclists.org/fulldisclosure/2020/Dec/32 • CWE-121: Stack-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2019-15880
https://notcve.org/view.php?id=CVE-2019-15880
13 May 2020 — In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocated the size of a kernel buffer based on a user-supplied length allowing an unprivileged process to trigger a kernel panic. En FreeBSD versiones 12.1-STABLE anteriores a r356911 y versiones 12.1-RELEASE anteriores a p5, una comprobación insuficiente en el módulo cryptodev asignó el tamaño de un búfer del kernel basado en una longitud suministrada por el usuario permitiendo a un proceso no p... • https://security.FreeBSD.org/advisories/FreeBSD-SA-20:16.cryptodev.asc • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.4EPSS: 0%CPEs: 14EXPL: 0CVE-2019-15879
https://notcve.org/view.php?id=CVE-2019-15879
13 May 2020 — In FreeBSD 12.1-STABLE before r356908, 12.1-RELEASE before p5, 11.3-STABLE before r356908, and 11.3-RELEASE before p9, a race condition in the cryptodev module permitted a data structure in the kernel to be used after it was freed, allowing an unprivileged process can overwrite arbitrary kernel memory. En FreeBSD versiones 12.1-STABLE anteriores a r352509, versiones 11.3-STABLE anteriores a r352509 y versiones 11.3-RELEASE anteriores a p9, una condición de carrera en el módulo cryptodev permitía utilizar un... • https://security.FreeBSD.org/advisories/FreeBSD-SA-20:15.cryptodev.asc • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2019-15878
https://notcve.org/view.php?id=CVE-2019-15878
13 May 2020 — In FreeBSD 12.1-STABLE before r352509, 11.3-STABLE before r352509, and 11.3-RELEASE before p9, an unprivileged local user can trigger a use-after-free situation due to improper checking in SCTP when an application tries to update an SCTP-AUTH shared key. En FreeBSD versiones 12.1-STABLE anteriores a r352509, versiones 11.3-STABLE anteriores a r352509 y versiones 11.3-RELEASE anteriores a p9, un usuario local no privilegiado puede desencadenar una situación de uso de la memoria previamente liberada debido a ... • https://security.FreeBSD.org/advisories/FreeBSD-SA-20:14.sctp.asc • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 16EXPL: 0CVE-2020-7455 – FreeBSD Kernel NAT Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-7455
13 May 2020 — In FreeBSD 12.1-STABLE before r360973, 12.1-RELEASE before p5, 11.4-STABLE before r360973, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, the FTP packet handler in libalias incorrectly calculates some packet length allowing disclosure of small amounts of kernel (for kernel NAT) or natd process space (for userspace natd). En FreeBSD versiones 12.1-STABLE anteriores a r360973, versiones 12.1-RELEASE anteriores a p5, versiones 11.4-STABLE anteriores a r360973, versiones 11.4-BETA1 anteriores a p1 y versiones... • https://security.FreeBSD.org/advisories/FreeBSD-SA-20:13.libalias.asc • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 9.8EPSS: 4%CPEs: 16EXPL: 0CVE-2020-7454 – FreeBSD Kernel NAT Out-Of-Bounds Access Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-7454
13 May 2020 — In FreeBSD 12.1-STABLE before r360971, 12.1-RELEASE before p5, 11.4-STABLE before r360971, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, libalias does not properly validate packet length resulting in modules causing an out of bounds read/write condition if no checking was built into the module. En FreeBSD versiones 12.1-STABLE anteriores a r360971, versiones 12.1-RELEASE anteriores a p5, versiones 11.4-STABLE anteriores a r360971, versiones 11.4-BETA1 anteriores a p1 y versiones 11.3-RELEASE anteriores p... • https://security.FreeBSD.org/advisories/FreeBSD-SA-20:12.libalias.asc • CWE-20: Improper Input Validation CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 13EXPL: 0CVE-2019-5614
https://notcve.org/view.php?id=CVE-2019-5614
28 Apr 2020 — In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE-p8, incomplete packet data validation may result in accessing out-of-bounds memory leading to a kernel panic or other unpredictable results. En FreeBSD versiones 12.1-ESTABLE anteriores a r356035, versiones 12.1-RELEASE anteriores a 12.1-RELEASE-p4, versiones 11.3-ESTABLE anteriores a r356036 y versiones 11.3-RELEASE anteriores a 11.3-RELEASE-p8, la comprobación incomp... • https://security.FreeBSD.org/advisories/FreeBSD-SA-20:10.ipfw.asc • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 13EXPL: 0CVE-2019-15874
https://notcve.org/view.php?id=CVE-2019-15874
28 Apr 2020 — In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE-p8, incomplete packet data validation may result in memory access after it has been freed leading to a kernel panic or other unpredictable results. En FreeBSD versiones 12.1-ESTABLE anteriores a r356035, versiones 12.1-RELEASE anteriores a 12.1-RELEASE-p4, versiones 11.3-ESTABLE anteriores a r356036 y versiones 11.3-RELEASE anteriores a 11.3-RELEASE-p8, la comprobación... • https://security.FreeBSD.org/advisories/FreeBSD-SA-20:10.ipfw.asc • CWE-20: Improper Input Validation CWE-416: Use After Free •
CVSS: 9.1EPSS: 1%CPEs: 10EXPL: 0CVE-2020-7452
https://notcve.org/view.php?id=CVE-2020-7452
28 Apr 2020 — In FreeBSD 12.1-STABLE before r357490, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r357489, and 11.3-RELEASE before 11.3-RELEASE-p7, incorrect use of a user-controlled pointer in the epair virtual network module allowed vnet jailed privileged users to panic the host system and potentially execute arbitrary code in the kernel. En FreeBSD versiones 12.1-ESTABLE anteriores a r357490, versiones 12.1-RELEASE anteriores a 12.1-RELEASE-p3, versiones 11.3-ESTABLE anteriores a r357489 y versiones 11.3-RE... • https://security.FreeBSD.org/advisories/FreeBSD-SA-20:07.epair.asc • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.0EPSS: 0%CPEs: 10EXPL: 0CVE-2020-7453
https://notcve.org/view.php?id=CVE-2020-7453
28 Apr 2020 — In FreeBSD 12.1-STABLE before r359021, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r359020, and 11.3-RELEASE before 11.3-RELEASE-p7, a missing null termination check in the jail_set configuration option "osrelease" may return more bytes with a subsequent jail_get system call allowing a malicious jail superuser with permission to create nested jails to read kernel memory. En FreeBSD versiones 12.1-ESTABLE anteriores a r359021, versiones 12.1-RELEASE anteriores a 12.1-RELEASE-p3, versiones 11.3-ES... • https://security.FreeBSD.org/advisories/FreeBSD-SA-20:08.jail.asc • CWE-754: Improper Check for Unusual or Exceptional Conditions •