CVSS: 7.5EPSS: 1%CPEs: 11EXPL: 0CVE-2019-9232 – libvpx: Out of bounds read in vp8_norm table
https://notcve.org/view.php?id=CVE-2019-9232
In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-122675483 En libvpx, se presenta una posible lectura fuera de límites debido a una falta de comprobación de límites. Esto podría conllevar a una divulgación de información remota sin ser necesarios privilegios de ejecución adicionales. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00049.html http://www.openwall.com/lists/oss-security/2019/10/25/17 http://www.openwall.com/lists/oss-security/2019/10/27/1 http://www.openwall.com/lists/oss-security/2019/11/07/1 https://lists.debian.org/debian-lts-announce/2019/11/msg00030.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQSTK442ATWJOR4TU3MR6C3N5A6NDFFN https://lists.fedoraproject.org/archives/list/package-an • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2019-14844
https://notcve.org/view.php?id=CVE-2019-14844
A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes". A remote unauthenticated user could use this flaw to crash the KDC. Se encontró un fallo en Fedora versiones de krb5 desde 1.16.1 hasta 1.17.x (incluyéndola), en la manera en que un cliente de Kerberos podría bloquear el KDC mediante el envío de uno de los "enctypes" 4556 de RFC. Un usuario no autenticado remoto podría utilizar este fallo para bloquear el KDC. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14844 https://github.com/krb5/krb5/pull/981 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/54ZYKEJZ77BXZWGF4NEVKC33ESVROEYC https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4LS5PIJOCNOUZGLO2OBT6GY334PUOSW https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TDE2QOKK4I4TV4WV74ZQWICZ4HJN2MOK https://security.netapp.com/advisory/ntap-20220325-0003 • CWE-628: Function Call with Incorrectly Specified Arguments •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 1CVE-2019-16738
https://notcve.org/view.php?id=CVE-2019-16738
In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup. En MediaWiki versiones hasta 1.33.0, Special:Redirect permite la divulgación de información de nombres de usuario suprimidos por medio de una Búsqueda de ID de Usuario. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OMG3BMUHGWTAPYTK2NXM6CXF6FYLOUO https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QBAOLXETM5BOYQG6OQVHGB2LNLZUXVN6 https://phabricator.wikimedia.org/T230402 https://seclists.org/bugtraq/2019/Oct/32 https://www.debian.org/security/2019/dsa-4545 • CWE-862: Missing Authorization •
CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0CVE-2019-16910
https://notcve.org/view.php?id=CVE-2019-16910
Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. (For Mbed TLS, the fix is also available in versions 2.7.12 and 2.16.3.) Arm Mbed TLS versiones anteriores a 2.19.0 y Arm Mbed Crypto versiones anteriores a 2.0.0, cuando el ECDSA determinista está habilitado, usa un RNG con entropía insuficiente para el cegamiento, lo que podría permitir a un atacante recuperar una clave privada por medio de ataques de canal lateral si una víctima firma el mismo mensaje muchas veces. (Para Mbed TLS, la corrección también está disponible en las versiones 2.7.12 y 2.16.3.) • https://github.com/ARMmbed/mbedtls/commit/298a43a77ec0ed2c19a8c924ddd8571ef3e65dfd https://github.com/ARMmbed/mbedtls/commit/33f66ba6fd234114aa37f0209dac031bb2870a9b https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CGSKQSGR5SOBRBXDSSPTCDSBB5K3GMPF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSFFOROD6IVLADZHNJC2LPDV7FQRP7XB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproje •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 1CVE-2019-16892 – cfme: rubygem-rubyzip denial of service via crafted ZIP file
https://notcve.org/view.php?id=CVE-2019-16892
In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption). En Rubyzip versiones anteriores a 1.3.0, un archivo ZIP diseñado puede omitir las comprobaciones de la aplicación en los tamaños de entrada ZIP porque los datos sobre el tamaño sin comprimir pueden ser falsificados. Esto permite a atacantes causar una denegación de servicio (consumo de disco). A vulnerability in Rubyzip, versions prior to 1.3.0, allows a crafted ZIP file to bypass application checks on ZIP entry sizes. • https://access.redhat.com/errata/RHBA-2019:4047 https://access.redhat.com/errata/RHSA-2019:4201 https://github.com/rubyzip/rubyzip/commit/d65fe7bd283ec94f9d6dc7605f61a6b0dd00f55e https://github.com/rubyzip/rubyzip/pull/403 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO6 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWWPORMSBHZTMP4PGF4DQD22TTKBQMMC https://lists.fedoraproject.org/archives/list/package-announce%40l • CWE-400: Uncontrolled Resource Consumption •