CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25041 – unbound: assertion failure via a compressed name in dname_pkt_copy
https://notcve.org/view.php?id=CVE-2019-25041
27 Apr 2021 — Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5, permite un fallo de aserción por medio de un nombre comprimido en la función dname_pkt_copy. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una instalaci... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-617: Reachable Assertion •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25042 – unbound: out-of-bounds write via a compressed name in rdata_copy
https://notcve.org/view.php?id=CVE-2019-25042
27 Apr 2021 — Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5 permite una escritura fuera de límites por medio de un nombre comprimido en la función rdata_copy. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una instal... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2020-15078 – Gentoo Linux Security Advisory 202105-25
https://notcve.org/view.php?id=CVE-2020-15078
26 Apr 2021 — OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks. OpenVPN versiones 2.5.1 y anteriores, permiten a atacantes remotos omitir la autenticación y los datos del canal de control de acceso en servidores configurados con autenticación diferida, que pueden ser usados para desencadenar potencialmente más fugas de información It wa... • https://community.openvpn.net/openvpn/wiki/CVE-2020-15078 • CWE-305: Authentication Bypass by Primary Weakness CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2021-29473 – Out-of-bounds read in Exiv2::Jp2Image::doWriteMetadata
https://notcve.org/view.php?id=CVE-2021-29473
26 Apr 2021 — Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashi... • https://github.com/Exiv2/exiv2/security/advisories/GHSA-7569-phvm-vwc2 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-31598 – openSUSE Security Advisory - openSUSE-SU-2021:3804-1
https://notcve.org/view.php?id=CVE-2021-31598
24 Apr 2021 — An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_decode() performs incorrect memory handling while parsing crafted XML files, leading to a heap-based buffer overflow. Se detectó un problema en la biblioteca libezxml.a en ezXML versión 0.8.6. La función ezxml_decode() lleva a cabo un manejo incorrecto de la memoria mientras analiza archivos XML diseñados, conllevando a un desbordamiento del búfer en la región heap de la memoria An update that fixes 16 vulnerabilities is now avail... • https://lists.debian.org/debian-lts-announce/2021/07/msg00005.html • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 1CVE-2021-22207 – Gentoo Linux Security Advisory 202107-21
https://notcve.org/view.php?id=CVE-2021-22207
23 Apr 2021 — Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injection or crafted capture file Un consumo excesivo de la memoria en el disector MS-WSP en Wireshark versiones 3.4.0 hasta 3.4.4 y versiones 3.2.0 hasta 3.2.12, permite una denegación de servicio por medio de una inyección de paquetes o archivo de captura diseñado An update that solves 9 vulnerabilities and has two fixes is now available. This update for wireshark, libvirt, ... • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22207.json • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 93%CPEs: 6EXPL: 25CVE-2021-22204 – ExifTool Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-22204
23 Apr 2021 — Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image Una neutralización inapropiada de los datos del usuario en el formato de archivo DjVu en ExifTool versiones 7.44 y posteriores, permite una ejecución de código arbitrario cuando se analiza la imagen maliciosa A vulnerability was discovered in libimage-exiftool-perl, a library and program to read and write meta information in multimedia files, which ma... • https://packetstorm.news/files/id/162558 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-20312 – Ubuntu Security Notice USN-5736-1
https://notcve.org/view.php?id=CVE-2021-20312
23 Apr 2021 — A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability. Se encontró un fallo en ImageMagick en versiones 7.0.11, donde un desbordamiento de enteros en la función WriteTHUMBNAILImage del archivo coders/humbnail.c puede desencadenar un c... • https://bugzilla.redhat.com/show_bug.cgi?id=1946742 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-20309 – Ubuntu Security Notice USN-5736-1
https://notcve.org/view.php?id=CVE-2021-20309
23 Apr 2021 — A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The highest threat from this vulnerability is to system availability. Se encontró un fallo en ImageMagick en versiones anteriores a 7.0.11 y versiones anteriores a 6.9.12, donde una división por cero en la función WaveImage() del archivo MagickCore/visual-effec... • https://bugzilla.redhat.com/show_bug.cgi?id=1946722 • CWE-369: Divide By Zero •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-20313 – Ubuntu Security Notice USN-5736-1
https://notcve.org/view.php?id=CVE-2021-20313
23 Apr 2021 — A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible. The highest threat from this vulnerability is to data confidentiality. Se encontró un fallo en ImageMagick en versiones anteriores a 7.0.11. Una potencial pérdida de cifrado cuando es posible calcular firmas en la función TransformSignature. • https://bugzilla.redhat.com/show_bug.cgi?id=1947019 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •