CVSS: 10.0EPSS: 0%CPEs: 8EXPL: 0CVE-2020-13753
https://notcve.org/view.php?id=CVE-2020-13753
The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226. El sandbox bubblewrap de WebKitGTK y WPE WebKit, versiones anteriores a 2.28.3, no pudo bloquear apropiadamente el acceso a CLONE_NEWUSER y al ioctl TIOCSTI. CLONE_NEWUSER podría ser usada potencialmente para confundir xdg-desktop-portal, que permite el acceso fuera del sandbox. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00074.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GER2ATKZXDHM7FFYJH67ZPNZZX5VOUVM https://security.gentoo.org/glsa/202007-11 https://trac.webkit.org/changeset/262368/webkit https://usn.ubuntu.com/4422-1 https://www.debian.org/security/2020/dsa-4724 https://www.openwall.com/lists/oss-security/2020/07/10/1 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 17EXPL: 0CVE-2019-20907 – python: infinite loop in the tarfile module via crafted TAR archive
https://notcve.org/view.php?id=CVE-2019-20907
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. En la biblioteca Lib/tarfile.py en Python versiones hasta 3.8.3, un atacante puede diseñar un archivo TAR conllevando a un bucle infinito cuando se abrió mediante tarfile.open, porque la función _proc_pax carece de comprobación de encabezado A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html https://bugs.python.org/issue39017 https://github.com/python/cpython/pull/21454 https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html https://lists.debian.org/debian-lts-announce/2020/ • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.5EPSS: 0%CPEs: 12EXPL: 0CVE-2020-10756 – QEMU SLiRP Networking Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-10756
An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1. Se encontró una vulnerabilidad de lectura fuera de límites en la implementación de red SLiRP del emulador QEMU. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00035.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00040.html https://bugzilla.redhat.com/show_bug.cgi?id=1835986 https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYTZ32P67PZER6P7TW6FQK3SZRKQLVEI https://security.netapp.com/advisory/ntap-20201001-0001 https://usn.ubuntu.com/4437-1 https://usn.ubuntu.com/ • CWE-125: Out-of-bounds Read •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 1CVE-2020-12416
https://notcve.org/view.php?id=CVE-2020-12416
A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 78. Un VideoStreamEncoder puede haberse liberado en una condición de carrera con la función VideoBroadcaster::AddOrUpdateSink, resultando en un uso de la memoria previamente liberada, una corrupción de la memoria y un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Firefox versiones anteriores a 78 • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html https://bugzilla.mozilla.org/show_bug.cgi?id=1639734 https://security.gentoo.org/glsa/202007-10 https://www.mozilla.org/security/advisories/mfsa2020-24 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12422 – Mozilla: Integer overflow in nsJPEGEncoder::emptyOutputBuffer
https://notcve.org/view.php?id=CVE-2020-12422
In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, resulting in an out of bounds write, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 78. En configuraciones no estándar, una imagen JPEG creada por JavaScript podría haber causado un desbordamiento de una variable interna, resultando en una escritura fuera de límites, corrupción de la memoria y un bloqueo explotable potencialmente. Esta vulnerabilidad afecta a Firefox versiones anteriores a 78 • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html https://bugzilla.mozilla.org/show_bug.cgi?id=1450353 https://security.gentoo.org/glsa/202007-10 https://www.mozilla.org/security/advisories/mfsa2020-24 https://access.redhat.com/security/cve/CVE-2020-12422 https://bugzilla.redhat.com/show_bug.cgi?id=1872538 • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •