CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 1CVE-2020-15193 – Memory corruption in Tensorflow
https://notcve.org/view.php?id=CVE-2020-15193
25 Sep 2020 — In Tensorflow before versions 2.2.1 and 2.3.1, the implementation of `dlpack.to_dlpack` can be made to use uninitialized memory resulting in further memory corruption. This is because the pybind11 glue code assumes that the argument is a tensor. However, there is nothing stopping users from passing in a Python object instead of a tensor. The uninitialized memory address is due to a `reinterpret_cast` Since the `PyObject` is a Python object, not a TensorFlow Tensor, the cast to `EagerTensor` fails. The issue... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html • CWE-908: Use of Uninitialized Resource •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 1CVE-2020-15194 – Denial of Service in Tensorflow
https://notcve.org/view.php?id=CVE-2020-15194
25 Sep 2020 — In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `SparseFillEmptyRowsGrad` implementation has incomplete validation of the shapes of its arguments. Although `reverse_index_map_t` and `grad_values_t` are accessed in a similar pattern, only `reverse_index_map_t` is validated to be of proper shape. Hence, malicious users can pass a bad `grad_values_t` to trigger an assertion failure in `vec`, causing denial of service in serving installations. The issue is patched in commit 390611e0d45c... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html • CWE-20: Improper Input Validation CWE-617: Reachable Assertion •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 1CVE-2020-15195 – Heap buffer overflow in Tensorflow
https://notcve.org/view.php?id=CVE-2020-15195
25 Sep 2020 — In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the implementation of `SparseFillEmptyRowsGrad` uses a double indexing pattern. It is possible for `reverse_index_map(i)` to be an index outside of bounds of `grad_values`, thus resulting in a heap buffer overflow. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. En Tensorflow versiones anteriores a 1.15.4, 2.0.3, 2.1.2, 2.2.1 y 2.3.1, la ... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 1CVE-2020-15190 – Segfault in Tensorflow
https://notcve.org/view.php?id=CVE-2020-15190
25 Sep 2020 — In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. However, the eager runtime traverses all tensors in the output. Since only one of the tensors is defined, the other one is `nullptr`, hence we are binding a reference to `nullptr`. This is undefined behavior and report... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2020-26088 – Ubuntu Security Notice USN-4578-1
https://notcve.org/view.php?id=CVE-2020-26088
24 Sep 2020 — A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a. Una falta de comprobación de CAP_NET_RAW en la creación de sockets NFC en el archivo net/nfc/rawsock.c en el Kernel de Linux versiones anteriores a 5.8.2, podría ser usada por unos atacantes locales para crear sockets sin procesar, omitiendo los mecanismos de seguridad, también se conoce como CID-... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.html • CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 1%CPEs: 7EXPL: 0CVE-2020-15673 – Mozilla: Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3
https://notcve.org/view.php?id=CVE-2020-15673
24 Sep 2020 — Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. Los desarrolladores de Mozilla reportaron unos bugs de seguridad de la memoria presentes en Firefox versión 80 y Firefox ESR versión 78.2. Algunos de estos bugs han mostrado... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-416: Use After Free •
CVSS: 6.1EPSS: 1%CPEs: 7EXPL: 0CVE-2020-15676 – Mozilla: XSS when pasting attacker-controlled data into a contenteditable element
https://notcve.org/view.php?id=CVE-2020-15676
24 Sep 2020 — Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. Firefox a veces ejecutaba el manejador de carga para elementos SVG que el saneador DOM decidió eliminar, resultando en que el JavaScript sea ejecutado después de pegar los datos controlados por el atacante en un eleme... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2020-15677 – Mozilla: Download origin spoofing via redirect
https://notcve.org/view.php?id=CVE-2020-15677
24 Sep 2020 — By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. Al explotar una vulnerabilidad de Redireccionamiento Abierto en un sitio web, un atacante podría haber falsificado el sitio que es mostrado en el cuadro de diálo... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2020-15678 – Mozilla: When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free scenario
https://notcve.org/view.php?id=CVE-2020-15678
24 Sep 2020 — When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. Al volver a recorrer las capas gráficas mientras se desplaza, es posible que un iterador pueda convertirse en no válido, resultando en un potencial uso de la memoria ... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.html • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2020-25603 – Ubuntu Security Notice USN-5617-1
https://notcve.org/view.php?id=CVE-2020-25603
23 Sep 2020 — An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00008.html • CWE-670: Always-Incorrect Control Flow Implementation •