CVSS: 7.5EPSS: 1%CPEs: 22EXPL: 0CVE-2019-20839 – libvncserver: buffer overflow in ConnectClientToUnixSock()
https://notcve.org/view.php?id=CVE-2019-20839
libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename. La biblioteca libvncclient/sockets.c en LibVNCServer versiones anteriores a 0.9.13, presenta un desbordamiento de búfer por medio de un nombre de archivo socket largo • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf https://github.com/LibVNC/libvncserver/commit/3fd03977c9b35800d73a865f167338cb4d05b0c1 https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13 https://lists.debian.org/debian-lts-announce/2020&#x • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 0%CPEs: 22EXPL: 0CVE-2019-20840
https://notcve.org/view.php?id=CVE-2019-20840
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode. Se detectó un problema en LibVNCServer versiones anteriores a 0.9.13. La biblioteca libvncserver/ws_decode.c puede conllevar a un bloqueo debido a accesos no alineados en la función hybiReadAndDecode • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76 https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13 https://lists.fedoraproject.org/archives/list/package&# • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 21EXPL: 0CVE-2018-21247 – libvncserver: uninitialized memory contents are vulnerable to Information Leak
https://notcve.org/view.php?id=CVE-2018-21247
An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function. Se detectó un problema en LibVNCServer versiones anteriores a 0.9.13. Se presenta una pérdida de memoria en la biblioteca libvncclient/rfbproto.c en la función ConnectToRFBRepeater • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13 https://github.com/LibVNC/libvncserver/issues/253 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-909: Missing Initialization of Resource •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2020-12398 – Mozilla: Security downgrade with IMAP STARTTLS leads to information leakage
https://notcve.org/view.php?id=CVE-2020-12398
If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection. This vulnerability affects Thunderbird < 68.9.0. Si Thunderbird está configurado para usar STARTTLS para un servidor IMAP, y el servidor envía una respuesta PREAUTH, entonces Thunderbird continuará con una conexión sin cifrar, causando que unos datos de correo electrónico sean enviados sin protección. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a 68.9.0 The Mozilla Foundation Security Advisory describes this flaw as: If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection. • https://bugzilla.mozilla.org/show_bug.cgi?id=1613623 https://usn.ubuntu.com/4421-1 https://www.mozilla.org/security/advisories/mfsa2020-22 https://access.redhat.com/security/cve/CVE-2020-12398 https://bugzilla.redhat.com/show_bug.cgi?id=1846556 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 5.8EPSS: 0%CPEs: 6EXPL: 0CVE-2020-14154
https://notcve.org/view.php?id=CVE-2020-14154
Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate. Mutt versiones anteriores a 1.14.3, procede con una conexión incluso si, en respuesta a un aviso de certificado GnuTLS, el usuario rechaza un certificado intermedio expirado • http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20200608/000022.html http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00064.html http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00070.html http://www.mutt.org https://bugs.gentoo.org/728300 https://security.gentoo.org/glsa/202007-57 https://usn.ubuntu.com/4401-1 •