CVSS: 6.7EPSS: 0%CPEs: 6EXPL: 0CVE-2020-13754 – QEMU: msix: OOB access during mmio operations may lead to DoS
https://notcve.org/view.php?id=CVE-2020-13754
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation. En el archivo hw/pci/msix.c en QEMU versión 4.2.0, permite a usuarios invitados del SO desencadenar un acceso fuera de límites por medio de una dirección diseñada en una operación msi-x mmio. An out-of-bounds access flaw was found in the Message Signalled Interrupt (MSI-X) device support of QEMU. This issue occurs while performing MSI-X mmio operations when a guest sent address goes beyond the mmio region. A guest user or process may use this flaw to crash the QEMU process resulting in a denial of service. • http://www.openwall.com/lists/oss-security/2020/06/01/6 http://www.openwall.com/lists/oss-security/2020/06/15/8 https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00004.html https://security.gentoo.org/glsa/202011-09 https://security.netapp.com/advisory/ntap-20200608-0007 https://usn.ubuntu.com/4467-1 https://www.debian.org/security/2020/dsa-4728 https://access.redhat.com/security/cve&#x • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 2.5EPSS: 0%CPEs: 7EXPL: 0CVE-2020-13659
https://notcve.org/view.php?id=CVE-2020-13659
address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer. La función address_space_map en el archivo exec.c en QEMU versión 4.2.0, puede desencadenar una desreferencia del puntero NULL relacionada a BounceBuffer. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html http://www.openwall.com/lists/oss-security/2020/06/01/3 https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg07313.html https://security.gentoo.org/glsa/202011-09 https://security.netapp.com/advisory/ntap-20200608-0007 https://usn.ubuntu.com/4467-1 https://www.debian.org/security/2020/dsa-4728 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2020-13757 – python-rsa: decryption of ciphertext leads to DoS
https://notcve.org/view.php?id=CVE-2020-13757
Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation). Python-RSA versión 4.1, ignora bytes '\0' principales durante la desencriptación del texto cifrado. Esto podría tener un impacto relevante para la seguridad, por ejemplo, al ayudar a un atacante a inferir que una aplicación utiliza Python-RSA, o si la longitud del texto cifrado aceptado afecta al comportamiento de la aplicación (por ejemplo, al causar una asignación excesiva de memoria) A flaw was found in the python-rsa package, where it does not explicitly check the ciphertext length against the key size and ignores the leading 0 bytes during the decryption of the ciphertext. This flaw allows an attacker to perform a ciphertext attack, leading to a denial of service. • https://github.com/sybrenstuvel/python-rsa/issues/146 https://github.com/sybrenstuvel/python-rsa/issues/146#issuecomment-641845667 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2KILTHBHNSDUCYV22ODLOKTICJJ7JQIQ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZYB65VNILRBTXL6EITQTH2PZPK7I23MW https://usn.ubuntu.com/4478-1 https://access.redhat.com/security/cve/CVE-2020-13757 https://bugzilla.redhat.com/show_bug.cgi?id=1848507 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 5.7EPSS: 0%CPEs: 9EXPL: 1CVE-2020-12867 – sane-backends: NULL pointer dereference in sanei_epson_net_read function
https://notcve.org/view.php?id=CVE-2020-12867
A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075. Una desreferencia del puntero NULL en la función sanei_epson_net_read en SANE Backends versiones anteriores a la 1.0.30, permite a un dispositivo malicioso conectado a la misma red local que la víctima causar una denegación de servicio, también se conoce como GHSL-2020-075 • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00079.html http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00003.html https://alioth-lists.debian.net/pipermail/sane-announce/2020/000041.html https://gitlab.com/sane-project/backends/-/issues/279#issue-1-ghsl-2020-075-null-pointer-dereference-in-sanei_epson_net_read https://lists.debian.org/debian-lts-announce/2020/08/msg00029.html https://lists.debian.org/debian-lts-announce/2020/10/msg00010.html https://l • CWE-476: NULL Pointer Dereference •
CVSS: 3.2EPSS: 0%CPEs: 8EXPL: 0CVE-2020-13362
https://notcve.org/view.php?id=CVE-2020-13362
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user. En QEMU versión 5.0.0 y versiones anteriores, la función megasas_lookup_frame en el archivo hw/scsi/megasas.c presenta una lectura fuera de límites mediante el campo reply_queue_head desde un usuario invitado del Sistema Operativo. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html http://www.openwall.com/lists/oss-security/2020/05/28/2 https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03131.html https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06250.html https://security-tracker.debian.org/tracker/CVE-2020-13362 https://security • CWE-125: Out-of-bounds Read •