CVSS: 2.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-8757
https://notcve.org/view.php?id=CVE-2019-8757
A race condition existed when reading and writing user preferences. This was addressed with improved state handling. This issue is fixed in macOS Catalina 10.15. The "Share Mac Analytics" setting may not be disabled when a user deselects the switch to share analytics. Se presentó una condición de carrera cuando se lee y escribe las preferencias del usuario. • https://support.apple.com/HT210634 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2019-8745 – Apple macOS CFFromShiftJISLen Out-Of-Bounds Read Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-8745
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15, tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing a maliciously crafted text file may lead to arbitrary code execution. Un desbordamiento del búfer fue abordado mejorando la comprobación de límites. Este problema es corregido en macOS Catalina versión 10.15, tvOS versión 13, iTunes para Windows versión 12.10.1, iCloud para Windows versión 10.7, iCloud para Windows versión 7.14. • https://support.apple.com/HT210634 https://support.apple.com/HT210635 https://support.apple.com/HT210636 https://support.apple.com/HT210637 https://support.apple.com/kb/HT210722 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2019-8717 – XNU - Remote Double-Free via Data Race in IPComp Input Path
https://notcve.org/view.php?id=CVE-2019-8717
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15, tvOS 13. An application may be able to execute arbitrary code with kernel privileges. Un problema de corrupción de memoria fue abordado mejorando el manejo de la memoria. Este problema es corregido en macOS Catalina versión 10.15, tvOS versión 13. • https://www.exploit-db.com/exploits/47479 https://support.apple.com/HT210634 https://support.apple.com/kb/HT210722 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2018-16227 – tcpdump: Buffer over-read in print-802_11.c
https://notcve.org/view.php?id=CVE-2018-16227
The IEEE 802.11 parser in tcpdump before 4.9.3 has a buffer over-read in print-802_11.c for the Mesh Flags subfield. El analizador IEEE 802.11 en tcpdump versiones anteriores a 4.9.3, presenta una lectura excesiva del búfer en el archivo print-802_11.c para el subcampo Mesh Flags. An out-of-bounds read vulnerability was discovered in tcpdump while printing IEEE 802.11 packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application. • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html http://seclists.org/fulldisclosure/2019/Dec/26 https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES https://github.com/the-tcpdump-group/tcpdump/commit/4846b3c5d0a850e860baf4f07340495d29837d09 https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/ • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2018-14464 – tcpdump: Buffer over-read in lmp_print_data_link_subobjs() function in print-lmp.c
https://notcve.org/view.php?id=CVE-2018-14464
The LMP parser in tcpdump before 4.9.3 has a buffer over-read in print-lmp.c:lmp_print_data_link_subobjs(). El analizador LMP en tcpdump versiones anteriores a 4.9.3, presenta una lectura excesiva del búfer en print-lmp.c:lmp_print_data_link_subobjs(). An out-of-bounds read vulnerability was discovered in tcpdump while printing LMP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application. • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html http://seclists.org/fulldisclosure/2019/Dec/26 https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES https://github.com/the-tcpdump-group/tcpdump/commit/d97e94223720684c6aa740ff219e0d19426c2220 https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/ • CWE-125: Out-of-bounds Read •