CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-20216
https://notcve.org/view.php?id=CVE-2018-20216
QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled). QEMU puede tener un bucle infinito en hw/rdma/vmw/pvrdma_dev_ring.c debido a que no se comprueban los valores de retorno (y -1 se gestiona de manera incorrecta). • http://www.openwall.com/lists/oss-security/2018/12/19/2 http://www.securityfocus.com/bid/106291 https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg03052.html https://usn.ubuntu.com/3923-1 • CWE-252: Unchecked Return Value CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2018-20126
https://notcve.org/view.php?id=CVE-2018-20126
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled. hw/rdma/vmw/pvrdma_cmd.c en QEMU permite filtrados de memoria en create_cq y create_qp debido a la gestión incorrecta de los errores. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00034.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00038.html http://www.openwall.com/lists/oss-security/2018/12/19/4 http://www.securityfocus.com/bid/106298 https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg02824.html https://usn.ubuntu.com/3923-1 • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-20125
https://notcve.org/view.php?id=CVE-2018-20125
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in create_cq_ring or create_qp_rings. hw/rdma/vmw/pvrdma_cmd.c en QEMU permite que los atacantes provoquen una denegación de servicio (desreferencia de puntero NULL o asignación de memoria excesiva) en create_cq_ring o create_qp_rings. • http://www.openwall.com/lists/oss-security/2018/12/19/3 http://www.securityfocus.com/bid/106298 https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg02823.html https://usn.ubuntu.com/3923-1 • CWE-476: NULL Pointer Dereference •
CVSS: 8.8EPSS: 0%CPEs: 13EXPL: 0CVE-2018-1000877 – libarchive: Double free in RAR decoder resulting in a denial of service
https://notcve.org/view.php?id=CVE-2018-1000877
libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar->lzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive. libarchive, con el commit con ID 416694915449219d505531b1096384f3237dd6cc y siguientes (desde la v3.1.0) contiene una vulnerabilidad CWE-415: doble liberación (double free) en el descodificador RAR; libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar->lzss.window, new_size) con new_size = 0, lo que puede resultar en un cierre inesperado/denegación de servicio (DoS). El ataque parece ser explotable si una víctima abre un archivo RAR especialmente manipulado. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00015.html http://www.securityfocus.com/bid/106324 https://access.redhat.com/errata/RHSA-2019:2298 https://access.redhat.com/errata/RHSA-2019:3698 https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909 https://github.com/libarchive/libarchive/pull/1105 https://gith • CWE-415: Double Free CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2018-1000880
https://notcve.org/view.php?id=CVE-2018-1000880
libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file. libarchive, con el commit con ID 9693801580c0cf7c70e862d305270a16b52826a7 y siguientes (desde la v3.2.0) contiene una vulnerabilidad CWE-20: validación de entradas incorrecta en el analizador WARC (), en _warc_read(), que puede resultar en una denegación de servicio (DoS) en tiempo de ejecución casi infinito y uso de disco desde un archivo muy pequeño. El ataque parece ser explotable si una víctima abre un archivo WARC especialmente manipulado. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html http://www.securityfocus.com/bid/106324 https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909 https://github.com/libarchive/libarchive/pull/1105 https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedor • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •