CVSS: 8.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-9503 – Broadcom brcmfmac driver is vulnerable to a frame validation bypass
https://notcve.org/view.php?id=CVE-2019-9503
The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver receives the firmware event frame from the host, the appropriate handler is called. This frame validation can be bypassed if the bus used is USB (for instance by a wifi dongle). This can allow firmware event frames from a remote source to be processed. • https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html https://bugzilla.redhat.com/show_bug.cgi?id=1701842 https://bugzilla.suse.com/show_bug.cgi?id=1132828 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4176ec356c73a46c07c181c6d04039fafa34a9f https://kb.cert.org/vuls/id/166939 https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-9503.html https://security-tracker.debian.org/tracker/CVE-2019-9503 https://access.redhat.com&# • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 3%CPEs: 16EXPL: 0CVE-2019-7837 – Adobe Flash Player PSDK Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-7837
Adobe Flash Player versions 32.0.0.171 and earlier, 32.0.0.171 and earlier, and 32.0.0.171 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. Adobe Flash Player versiones 32.0.0.171 y anteriores, versiones 32.0.0.171 y anteriores, y versiones 32.0.0.171 y anteriores, tienen una vulnerabilidad de uso de memoria después de liberada. Su explotación exitosa podría llevar a la ejecución de código arbitrario. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash Player. • http://www.securityfocus.com/bid/108312 https://access.redhat.com/errata/RHSA-2019:1234 https://helpx.adobe.com/security/products/flash-player/apsb19-26.html https://www.zerodayinitiative.com/advisories/ZDI-19-498 https://access.redhat.com/security/cve/CVE-2019-7837 https://bugzilla.redhat.com/show_bug.cgi?id=1710045 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 0CVE-2019-3839 – ghostscript: missing attack vector protections for CVE-2019-6116
https://notcve.org/view.php?id=CVE-2019-3839
It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.27 are vulnerable. Se econtró una vulnerabilidad en ghostscript, algunos operadores privilegiados permanecían accesibles desde varios lugares después de la corrección CVE-2019-6116. Un archivo especialmente creado de PostScript podría usar este defecto para, por ejemplo, tener acceso al sistema de archivos fuera de las restricciones impuestas por -dSAFER. • http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=4ec9ca74bed49f2a82acb4bf430eae0d8b3b75c9 http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html https://access.redhat.com/errata/RHSA-2019:0971 https://access.redhat.com/errata/RHSA-2019:1017 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3839 https://lists.debian.org/debian-lts-announce/2019/05/msg00023.html https://lists.fedoraproject.or • CWE-648: Incorrect Use of Privileged APIs •
CVSS: 7.7EPSS: 0%CPEs: 29EXPL: 0CVE-2019-3900 – Kernel: vhost_net: infinite loop while receiving packets leads to DoS
https://notcve.org/view.php?id=CVE-2019-3900
An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario. Se encontró un problema de bucle infinito en el módulo del núcleo vhost_net en el kernel de Linux versiones anteriores a 5.1-rc6 inclusive, mientras manejaba los paquetes entrantes en handle_rx(). Puede ocurrir cuando un extremo envía los paquetes más rápido de lo que el otro extremo los procesa. • http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html http://www.securityfocus.com/bid/108076 https://access.redhat.com/errata/RHSA-2019:1973 https://access.redhat.com/errata/RHSA-2019:2029 https://access.redhat.com/errata/RHSA-2019:2043 https://access.redhat.com/errata/RHSA-2019:3220 https://access.redhat.com/errata/RHSA-2019:3309 https://access.redhat.com/errata/RHSA-2019:3517 https://access.redhat.com/errata/RHSA-2019:3836 http • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.4EPSS: 0%CPEs: 33EXPL: 0CVE-2019-0223 – qpid-proton: TLS Man in the Middle Vulnerability
https://notcve.org/view.php?id=CVE-2019-0223
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic. Mientras investigábamos el error PROTON-2014, descubrimos que en algunas circunstancias las versiones de Apache Qpid Proton 0.9 a 0.27.0 (librería de C y sus adaptaciones de lenguaje) pueden conectarse a un peer de forma anónima utilizando TLS *incluso cuando está configurado para verificar el certificado del peer* mientras se utiliza con versiones de OpenSSL anteriores a la 1.1.0. Esto significa que un ataque man in the middle podría ser construido si un atacante puede interceptar el tráfico TLS. A cryptographic weakness was discovered in qpid-proton's use of TLS. • http://www.openwall.com/lists/oss-security/2019/04/23/4 http://www.securityfocus.com/bid/108044 https://access.redhat.com/errata/RHSA-2019:0886 https://access.redhat.com/errata/RHSA-2019:1398 https://access.redhat.com/errata/RHSA-2019:1399 https://access.redhat.com/errata/RHSA-2019:1400 https://access.redhat.com/errata/RHSA-2019:2777 https://access.redhat.com/errata/RHSA-2019:2778 https://access.redhat.com/errata/RHSA-2019:2779 https://access.redhat.com/errata/ • CWE-300: Channel Accessible by Non-Endpoint •