CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2019-19043
https://notcve.org/view.php?id=CVE-2019-19043
A memory leak in the i40e_setup_macvlans() function in drivers/net/ethernet/intel/i40e/i40e_main.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering i40e_setup_channel() failures, aka CID-27d461333459. Una pérdida de memoria en la función i40e_setup_macvlans() en el archivo drivers/net/ethernet/intel/i40e/i40e_main.c en el kernel de Linux versiones hasta 5.3.11, permite a atacantes causar una denegación de servicio (consumo de memoria) al desencadenar fallos de la función i40e_setup_channel(), también se conoce como CID-27d461333459. • https://github.com/torvalds/linux/commit/27d461333459d282ffa4a2bdb6b215a59d493a8f https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3PSDE6PTOTVBK2YTKB2TFQP2SUBVSNF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PY7LJMSPAGRIKABJPDKQDTXYW3L5RX2T https://security.netapp.com/advisory/ntap-20191205-0001 https://usn.ubuntu.com/4300-1 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 9.8EPSS: 1%CPEs: 6EXPL: 3CVE-2019-19012 – oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read
https://notcve.org/view.php?id=CVE-2019-19012
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression. Un desbordamiento de enteros en la función search_in_range en el archivo regexec.c en Oniguruma versiones 6.x anteriores a 6.9.4_rc2, conduce a una lectura fuera de límites, en la que el desplazamiento de esta lectura está bajo el control de un atacante. (Esto solo afecta a la versión compilada de 32 bits). • https://github.com/ManhNDd/CVE-2019-19012 https://github.com/tarantula-team/CVE-2019-19012 https://github.com/kkos/oniguruma/issues/164 https://github.com/kkos/oniguruma/releases/tag/v6.9.4_rc2 https://lists.debian.org/debian-lts-announce/2019/12/msg00002.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NO267PLHGYZSWX3XTRPKYBKD4J3YOU5V https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3MBNW6Z4DOXSCNWGBLQ7OA3OGUJ44WL ht • CWE-125: Out-of-bounds Read CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-19010
https://notcve.org/view.php?id=CVE-2019-19010
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands. Una inyección eval en el plugin Math de Limnoria (versiones anteriores a 2019.11.09) y Supybot (hasta el 09-05-2018) permite a atacantes remotos no privilegiados revelar información o posiblemente tener otro impacto no especificado por medio de los comandos calc e icalc IRC. • https://github.com/ProgVal/Limnoria/commit/3848ae78de45b35c029cc333963d436b9d2f0a35 https://github.com/ProgVal/Limnoria/wiki/math-eval-vulnerability https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/54CQM2TEXRADLE77VOMCPHL5PBHR3ZWJ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P2AGND54UIJV3WHOYO2YINIXSDGAAPO https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRNOUHFEN75QAIKT4Y3HDN3TT5LSIWN2 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-14869 – ghostscript: -dSAFER escape in .charkeys (701841)
https://notcve.org/view.php?id=CVE-2019-14869
A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands. Se detectó un fallo en todas las versiones de ghostscript 9.x en versiones anteriores a la 9.50, donde el procedimiento ".charkeys", donde no aseguraba apropiadamente sus llamadas privilegiadas, permitiendo que los scripts omitieran las restricciones "-dSAFER". Un atacante podría abusar de este fallo mediante la creación de un archivo PostScript especialmente diseñado que podría aumentar los privilegios dentro de Ghostscript y acceder a archivos fuera de áreas restringidas o ejecutar comandos. A flaw was found in the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. • http://jvn.jp/en/jp/JVN52486659/index.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00049.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00050.html http://www.openwall.com/lists/oss-security/2019/11/15/1 https://access.redhat.com/errata/RHSA-2020:0222 https://bugs.ghostscript.com/show_bug.cgi?id=701841 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14869 https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=48590477 • CWE-648: Incorrect Use of Privileged APIs CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2019-18928 – cyrus-imapd: privilege escalation in HTTP request
https://notcve.org/view.php?id=CVE-2019-18928
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection. Cyrus IMAP versiones 2.5.x anteriores a la versión 2.5.14 y versiones 3.x anteriores a la versión 3.0.12, permite una escalada de privilegios porque una petición HTTP puede ser interpretada en el contexto de autenticación de una petición anterior no relacionada que llegó por medio de la misma conexión. • https://lists.debian.org/debian-lts-announce/2022/06/msg00013.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAGKPZDXQ6KRUGQVRAO6N4PCINP6KS5F https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHV3TUU53WCKJ3BBRK2EHAF44MSZEFK6 https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.14.html https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.12.html https://access.redhat.com/security/cve/CVE-2 • CWE-287: Improper Authentication •