CVSS: 5.5EPSS: 0%CPEs: 14EXPL: 1CVE-2019-15142 – Debian Security Advisory 5032-1
https://notcve.org/view.php?id=CVE-2019-15142
18 Aug 2019 — In DjVuLibre 3.5.27, DjVmDir.cpp in the DJVU reader component allows attackers to cause a denial-of-service (application crash in GStringRep::strdup in libdjvu/GString.cpp caused by a heap-based buffer over-read) by crafting a DJVU file. En DjVuLibre versión 3.5.27, el archivo DjVmDir.cpp en el componente DJVU reader, permite a atacantes causar una denegación de servicio (bloqueo de aplicación en función GStringRep::strdup en archivo libdjvu/GString.cpp causado por una lectura excesiva del búfer en la regió... • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00086.html • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 14EXPL: 1CVE-2019-15143 – Debian Security Advisory 5032-1
https://notcve.org/view.php?id=CVE-2019-15143
18 Aug 2019 — In DjVuLibre 3.5.27, the bitmap reader component allows attackers to cause a denial-of-service error (resource exhaustion caused by a GBitmap::read_rle_raw infinite loop) by crafting a corrupted image file, related to libdjvu/DjVmDir.cpp and libdjvu/GBitmap.cpp. En DjVuLibre versión 3.5.27, el componente bitmap reader, permite a atacantes causar un error de denegación de servicio (agotamiento de recursos causado por un bucle infinito de la función GBitmap::read_rle_raw) mediante el diseño de un archivo de i... • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00086.html • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 5.5EPSS: 0%CPEs: 14EXPL: 1CVE-2019-15144 – Debian Security Advisory 5032-1
https://notcve.org/view.php?id=CVE-2019-15144
18 Aug 2019 — In DjVuLibre 3.5.27, the sorting functionality (aka GArrayTemplate
CVSS: 5.5EPSS: 0%CPEs: 14EXPL: 1CVE-2019-15145 – Debian Security Advisory 5032-1
https://notcve.org/view.php?id=CVE-2019-15145
18 Aug 2019 — DjVuLibre 3.5.27 allows attackers to cause a denial-of-service attack (application crash via an out-of-bounds read) by crafting a corrupted JB2 image file that is mishandled in JB2Dict::JB2Codec::get_direct_context in libdjvu/JB2Image.h because of a missing zero-bytes check in libdjvu/GBitmap.h. DjVuLibre versión 3.5.27, permite a atacantes causar un ataque de denegación de servicio (bloqueo de aplicación por medio de una lectura fuera de límites) mediante el diseño de un archivo de imagen JB2 corrupto que ... • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00086.html • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 1%CPEs: 8EXPL: 0CVE-2019-15099 – kernel: a NULL pointer dereference in drivers/net/wireless/ath/ath10k/usb.c leads to a crash
https://notcve.org/view.php?id=CVE-2019-15099
16 Aug 2019 — drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpoint descriptor. El archivo drivers/net/wireless/ath/ath10k/usb.c en el kernel de Linux versiones hasta 5.2.8, presenta una desreferencia del puntero NULL por medio de una dirección incompleta en un descriptor de endpoint. A null pointer dereference flaw was discovered in the Linux kernel's implementation of the ath10k USB device driver. The vulnerability requires the at... • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 9.8EPSS: 1%CPEs: 7EXPL: 0CVE-2019-5477 – Gentoo Linux Security Advisory 202006-05
https://notcve.org/view.php?id=CVE-2019-5477
16 Aug 2019 — A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addr... • https://github.com/sparklemotion/nokogiri/issues/1915 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.7EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15090 – kernel: An out-of-bounds read in drivers/scsi/qedi/qedi_dbg.c leading to crash or information disclosure
https://notcve.org/view.php?id=CVE-2019-15090
15 Aug 2019 — An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the qedi_dbg_* family of functions, there is an out-of-bounds read. Se detectó un problema en el archivo drivers/scsi/qedi/qedi_dbg.c en el kernel de Linux versiones anteriores a 5.1.12. En la familia de funciones qedi_dbg_*, se presenta una lectura fuera de límites. An out-of-bounds (OOB) memory access flaw was found in the Qlogic ISCSI module in the Linux kernel's qedi_dbg_* family of functions in drivers/scsi/qe... • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 44%CPEs: 9EXPL: 0CVE-2019-12854 – squid: Denial of service in cachemgr.cgi
https://notcve.org/view.php?id=CVE-2019-12854
15 Aug 2019 — Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it. Debido a una terminación de cadena incorrecta, el archivo cachemgr.cgi de Squid versiones 4.0 hasta 4.7 puede acceder a la memoria no asignada. En sistemas con protecciones de acceso a memoria, esto puede causar que el proceso CGI finalice inesperad... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 0CVE-2019-14981 – ImageMagick: division by zero in MeanShiftImage in MagickCore/feature.c
https://notcve.org/view.php?id=CVE-2019-14981
12 Aug 2019 — In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file. En ImageMagick versiones 7.x anteriores a 7.0.8-41 y versiones 6.x anteriores a 6.9.10-41, hay una vulnerabilidad de división por cero en la función MeanShiftImage. Permite a un atacante causar una denegación de servicio mediante el envío de un archivo especialmente diseñado. An update that fixes 11 ... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html • CWE-369: Divide By Zero •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 1CVE-2019-13454 – ImageMagick: division by zero in RemoveDuplicateLayers in MagickCore/layer.c
https://notcve.org/view.php?id=CVE-2019-13454
09 Jul 2019 — ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c. ImageMagick versión 7.0.8-54 Q16, permite la División por Cero en la función RemoveDuplicateLayers en el archivo MagickCore/layer.c. ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c. It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially cr... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html • CWE-369: Divide By Zero •