CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-20781
https://notcve.org/view.php?id=CVE-2018-20781
In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext. En pam/gkr-pam-module.c en GNOME Keyring, en versiones anteriores a la 3.27.2, la contraseña del usuario se mantiene en un proceso hijo de sesión que se genera en el demonio LightDM. Esto puede exponer las credenciales en texto claro. • https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1772919 https://bugzilla.gnome.org/show_bug.cgi?id=781486 https://github.com/huntergregal/mimipenguin https://github.com/huntergregal/mimipenguin/tree/d95f1e08ce79783794f38433bbf7de5abd9792da https://gitlab.gnome.org/GNOME/gnome-keyring/issues/3 https://gitlab.gnome.org/GNOME/gnome-keyring/tags/3.27.2 https://usn.ubuntu.com/3894-1 https://www.oracle.com/security-alerts/cpujan2021.html • CWE-522: Insufficiently Protected Credentials •
CVSS: 6.5EPSS: 1%CPEs: 8EXPL: 1CVE-2019-7663
https://notcve.org/view.php?id=CVE-2019-7663
An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900. Se ha descubierto una desreferencia de dirección inválida en TIFFWriteDirectoryTagTransferfunction en libtiff/tif_dirwrite.c en LibTIFF 4.0.10, que afecta a la función cpSeparateBufToContigBuf en tiffcp.c. Los atacantes remotos podrían aprovechar esta vulnerabilidad para provocar una denegación de servicio (DoS) mediante un archivo tiff manipulado. • http://bugzilla.maptools.org/show_bug.cgi?id=2833 http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.html https://gitlab.com/libtiff/libtiff/commit/802d3cbf3043be5dce5317e140ccb1c17a6a2d39 https://lists.debian.org/debian-lts-announce/2019/02/msg00026.html https://security.gentoo.org/glsa/202003-25 https://usn.ubuntu.com/3906-1 https://usn.ubuntu.com/3906-2 https://www.debian.org/security/2020/dsa-4670 •
CVSS: 8.8EPSS: 0%CPEs: 13EXPL: 1CVE-2019-7637 – SDL: heap-based buffer overflow in SDL_FillRect in video/SDL_surface.c
https://notcve.org/view.php?id=CVE-2019-7637
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in SDL_FillRect in video/SDL_surface.c. SDL (Simple DirectMedia Layer), hasta la versión 1.2.15 y en versiones 2.x hasta la 2.0.9, tiene un desbordamiento de búfer basado en memoria dinámica (heap) en SDL_FillRect en video/SDL_surface.c. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00071.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00081.html https://bugzilla.libsdl.org/show_bug.cgi?id=4497 https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 htt • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 8.4EPSS: 0%CPEs: 12EXPL: 1CVE-2019-7636 – SDL: heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c
https://notcve.org/view.php?id=CVE-2019-7636
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c. SDL (Simple DirectMedia Layer), hasta la versión 1.2.15 y en versiones 2.x hasta la 2.0.9, tiene una sobrelectura de búfer basada en memoria dinámica (heap) en SDL_GetRGB en video/SDL_pixels.c. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html https://bugzilla.libsdl.org/show_bug.cgi?id=4499 https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 https://lists.debian.org/debian-lts-announce/2019/03/msg00015.html https://lists.debian.org/debian-lts-announce/2019/03/msg00016.html https:/& • CWE-122: Heap-based Buffer Overflow CWE-125: Out-of-bounds Read •
CVSS: 8.1EPSS: 0%CPEs: 15EXPL: 1CVE-2019-7635 – SDL: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c
https://notcve.org/view.php?id=CVE-2019-7635
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. SDL (Simple DirectMedia Layer), hasta la versión 1.2.15 y en versiones 2.x hasta la 2.0.9, tiene una sobrelectura de búfer basada en memoria dinámica (heap) en Blit1to4 en video/SDL_blit_1.c. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html https://bugzilla.libsdl.org/show_bug.cgi?id=4498 https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 htt • CWE-122: Heap-based Buffer Overflow CWE-125: Out-of-bounds Read •