CVSS: 7.0EPSS: 0%CPEs: 6EXPL: 0CVE-2019-11483
https://notcve.org/view.php?id=CVE-2019-11483
30 Oct 2019 — Sander Bos discovered Apport mishandled crash dumps originating from containers. This could be used by a local attacker to generate a crash report for a privileged process that is readable by an unprivileged user. Sander Bos detectó que Apport manejó inapropiadamente los vertederos accidentales procedentes de contenedores. Esto podría ser utilizado por un atacante local para generar un reporte de bloqueo para un proceso privilegiado que pueda ser leído por un usuario no privilegiado. • https://usn.ubuntu.com/usn/usn-4171-1 •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2019-11484 – Integer overflow in bson_ensure_space
https://notcve.org/view.php?id=CVE-2019-11484
30 Oct 2019 — Kevin Backhouse discovered an integer overflow in bson_ensure_space, as used in whoopsie. Kevin Backhouse detectó un desbordamiento de enteros en bson_ensure_space, como es usado en whoopsie. • http://packetstormsecurity.com/files/172858/Ubuntu-Apport-Whoopsie-DoS-Integer-Overflow.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 0%CPEs: 20EXPL: 0CVE-2019-15681
https://notcve.org/view.php?id=CVE-2019-15681
29 Oct 2019 — LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a. LibVNC en el commit anterior a d01e1bb4246323ba6fcee3b82ef1faa9... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00027.html • CWE-665: Improper Initialization •
CVSS: 9.8EPSS: 96%CPEs: 11EXPL: 25CVE-2019-11043 – PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2019-11043
24 Oct 2019 — In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution. En PHP versiones 7.1.x anteriores a la versión 7.1.33, versiones 7.2.x anteriores a la versión 7.2.24 y versiones 7.3.x anteriores a 7.3.11, en ciertas configuraciones del FPM setup, es posible causar que el módulo FPM escrib... • https://www.exploit-db.com/exploits/48182 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 0%CPEs: 7EXPL: 0CVE-2019-18408 – libarchive: use-after-free in archive_read_format_rar_read_data when there is an error in the decompression of an archive entry
https://notcve.org/view.php?id=CVE-2019-18408
24 Oct 2019 — archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol. La función archive_read_format_rar_read_data en el archivo archive_read_support_format_rar.c en libarchive versiones anteriores a 3.4.0, presenta un uso de la memoria previamente liberada en una determinada situación de ARCHIVE_FAILED, relacionada con Ppmd7_DecodeSymbol. A use-after-free vulnerability was discovered in li... • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00012.html • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 15EXPL: 1CVE-2019-18218 – file: heap-based buffer overflow in cdf_read_property_info in cdf.c
https://notcve.org/view.php?id=CVE-2019-18218
21 Oct 2019 — cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write). La función cdf_read_property_info en el archivo cdf.c en file versiones hasta 5.37, no restringe el número de elementos CDF_VECTOR, lo que permite un desbordamiento del búfer en la región heap de la memoria (escritura fuera de límites de 4 bytes). • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00044.html • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2019-18197 – libxslt: use after free in xsltCopyText in transform.c could lead to information disclosure
https://notcve.org/view.php?id=CVE-2019-18197
18 Oct 2019 — In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed. En la función xsltCopyText en el archivo transform.c en libxslt versión 1.1.33, una variable de puntero no se restablece bajo determinadas circunstancias. Si el área de memoria relevante se liberó y reutiliz... • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html • CWE-416: Use After Free CWE-908: Use of Uninitialized Resource •
CVSS: 8.8EPSS: 0%CPEs: 13EXPL: 1CVE-2019-17666 – kernel: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain upper-bound check, leading to a buffer overflow
https://notcve.org/view.php?id=CVE-2019-17666
17 Oct 2019 — rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow. En la función rtl_p2p_noa_ie en el archivo drivers/net/wireless/realtek/rtlwifi/ps.c en el kernel de Linux versiones hasta 5.3.6, carece de una cierta comprobación de límite superior, lo que conlleva a un desbordamiento del búfer. A flaw was found in the Linux kernel's implementation of the RealTek wireless drivers WiFi-direct (or WiFi peer-to-peer) d... • https://github.com/uthrasri/CVE-2019-17666 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.5EPSS: 0%CPEs: 13EXPL: 0CVE-2019-3011 – mysql: Server: C API unspecified vulnerability (CPU Oct 2019)
https://notcve.org/view.php?id=CVE-2019-3011
16 Oct 2019 — Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: C API). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). • http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html •
CVSS: 4.4EPSS: 0%CPEs: 13EXPL: 0CVE-2019-3018 – mysql: InnoDB unspecified vulnerability (CPU Oct 2019)
https://notcve.org/view.php?id=CVE-2019-3018
16 Oct 2019 — Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). • http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html •