CVSS: 6.5EPSS: 0%CPEs: 17EXPL: 0CVE-2019-13753 – sqlite: fts3: incorrectly removed corruption check
https://notcve.org/view.php?id=CVE-2019-13753
10 Dec 2019 — Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Una lectura fuera de límites en SQLite en Google Chrome versiones anteriores a la versión 79.0.3945.79, permitió a un atacante remoto conseguir información potencialmente confidencial desde la memoria del proceso por medio de una página HTML especialmente diseñada. • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 17EXPL: 0CVE-2019-13752 – sqlite: fts3: improve shadow table corruption detection
https://notcve.org/view.php?id=CVE-2019-13752
10 Dec 2019 — Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Una lectura fuera de límites en SQLite en Google Chrome versiones anteriores a la versión 79.0.3945.79, permitió a un atacante remoto conseguir información potencialmente confidencial desde la memoria del proceso por medio de una página HTML especialmente diseñada. • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 17EXPL: 0CVE-2019-13750 – sqlite: dropping of shadow tables not restricted in defensive mode
https://notcve.org/view.php?id=CVE-2019-13750
10 Dec 2019 — Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page. Una comprobación de datos insuficiente en SQLite en Google Chrome versiones anteriores a la versión 79.0.3945.79, permitió a un atacante remoto omitir las medidas de defensa en profundidad por medio de una página HTML especialmente diseñada. • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 1%CPEs: 17EXPL: 0CVE-2019-13751 – sqlite: fts3: improve detection of corrupted records
https://notcve.org/view.php?id=CVE-2019-13751
10 Dec 2019 — Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Datos no inicializados en SQLite en Google Chrome versiones anteriores a la versión 79.0.3945.79, permitió a un atacante remoto conseguir información potencialmente confidencial desde la memoria del proceso por medio de una página HTML especialmente diseñada. • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html • CWE-908: Use of Uninitialized Resource •
CVSS: 8.8EPSS: 0%CPEs: 32EXPL: 0CVE-2019-13734 – sqlite: fts3: improve shadow table corruption detection
https://notcve.org/view.php?id=CVE-2019-13734
10 Dec 2019 — Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Una escritura fuera de limites en SQLite en Google Chrome versiones anteriores a la versión 79.0.3945.79, permitió a un atacante remoto explotar potencialmente una corrupción de la pila por medio de una página HTML especialmente diseñada. • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html • CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 1%CPEs: 12EXPL: 0CVE-2019-14861
https://notcve.org/view.php?id=CVE-2019-14861
10 Dec 2019 — All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authenticated users. This is used for example to allow machines to self-register in DNS. If a DNS record was created that case-insensitively matched the ... • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.html • CWE-276: Incorrect Default Permissions •
CVSS: 9.3EPSS: 1%CPEs: 11EXPL: 0CVE-2019-14889 – libssh: unsanitized location in scp could lead to unwanted command execution
https://notcve.org/view.php?id=CVE-2019-14889
10 Dec 2019 — A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target. Se detectó un fallo con la función ssh_scp_new() de la AP... • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00033.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.4EPSS: 0%CPEs: 13EXPL: 0CVE-2019-14870
https://notcve.org/view.php?id=CVE-2019-14870
10 Dec 2019 — All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However... • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.html • CWE-285: Improper Authorization CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 1%CPEs: 18EXPL: 0CVE-2019-1551 – rsaz_512_sqr overflow bug on x86_64
https://notcve.org/view.php?id=CVE-2019-1551
06 Dec 2019 — There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 2CVE-2019-19602 – kernel: cached use of fpu_fpregs_owner_ctx in arch/x86/include/asm/fpu/internal.h can lead to DoS
https://notcve.org/view.php?id=CVE-2019-19602
05 Dec 2019 — fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact because of incorrect fpu_fpregs_owner_ctx caching, as demonstrated by mishandling of signal-based non-cooperative preemption in Go 1.14 prereleases on amd64, aka CID-59c4bd853abc. La función fpregs_state_valid en el archivo arch/x86/include/asm/fpu/internal.h en el kernel d... • https://bugzilla.kernel.org/show_bug.cgi?id=205663 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-672: Operation on a Resource after Expiration or Release •