CVSS: 6.5EPSS: 1%CPEs: 9EXPL: 0CVE-2020-12418 – Mozilla: Information disclosure due to manipulated URL object
https://notcve.org/view.php?id=CVE-2020-12418
Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. La manipulación de partes individuales de un objeto URL podría haber causado una lectura fuera de límites, filtrando la memoria de proceso a un JavaScript malicioso. Esta vulnerabilidad afecta a Firefox ESR versiones anteriores a 68.10, Firefox versiones anteriores a 78 y Thunderbird versiones anteriores a 68.10.0 The Mozilla Foundation Security Advisory describes this flaw as: Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00026.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html https://bugzilla.mozilla.org/show_bug.cgi?id=1641303 https://security.gentoo.org/glsa/202007-09 https://security.gentoo.org/glsa/202007-10 https://usn.ubuntu.com/4421-1 https://www.mozilla. • CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 1%CPEs: 12EXPL: 0CVE-2020-14303
https://notcve.org/view.php?id=CVE-2020-14303
A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to cause the samba server to crash. Se encontró un fallo en el servidor AD DC NBT en todas las versiones de Samba anteriores a 4.10.17, anteriores a 4.11.11 y anteriores a 4.12.4. Un usuario de samba podría enviar un paquete UDP vacío para hacer que el servidor de samba se bloquee • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.html https://bugzilla.redhat.com/show_bug.cgi?id=1851298%3B https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YLNQ5GRXUKYRUAOFZ4DUBVN4SMTL6Q2 https://security.gentoo.org/glsa/202007- • CWE-834: Excessive Iteration •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-15466
https://notcve.org/view.php?id=CVE-2020-15466
In Wireshark 3.2.0 to 3.2.4, the GVCP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gvcp.c by ensuring that an offset increases in all situations. En Wireshark versiones 3.2.0 hasta 3.2.4, el disector GVCP podría entrar en un bucle infinito. Esto se abordó en el archivo epan/disectors/packet-gvcp.c asegurando que aumente la compensación en todas las situaciones • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00026.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00038.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16029 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=11f40896b696e4e8c7f8b2ad96028404a83a51a4 https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html https://security.gentoo.org/glsa/202007-13 https://www.wireshark.org/security/wnpa-sec-2020-09.html • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.8EPSS: 2%CPEs: 7EXPL: 0CVE-2020-10745
https://notcve.org/view.php?id=CVE-2020-10745
A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. This flaw allows a remote attacker could to cause the Samba server to consume excessive CPU use, resulting in a denial of service. This highest threat from this vulnerability is to system availability. Se encontró un fallo en todas las versiones de Samba anteriores a 4.10.17, anteriores a 4.11.11 y anteriores a 4.12.4 en la manera en que procesaba NetBios sobre TCP/IP. Este fallo permite a un atacante remoto poder causar que el servidor Samba consuma un uso excesivo de la CPU, resultando en una denegación de servicio. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.html https://bugzilla.redhat.com/show_bug.cgi?id=1849491%3B https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YLNQ5GRXUKYRUAOFZ4DUBVN4SMTL6Q2 https://security.gentoo.org/glsa/202007- • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2020-10730 – samba: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results
https://notcve.org/view.php?id=CVE-2020-10730
A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference. The highest threat from this vulnerability is to system availability. Se encontró una desreferencia del puntero NULL, o un posible fallo de uso de la memoria previamente liberada en el servidor LDAP de Samba AD en versiones anteriores a 4.10.17, anteriores a 4.11.11 y anteriores a 4.12.4. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.html https://bugzilla.redhat.com/show_bug.cgi?id=1849489%3B https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org • CWE-416: Use After Free CWE-476: NULL Pointer Dereference •