CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-18388
https://notcve.org/view.php?id=CVE-2019-18388
23 Dec 2019 — A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via malformed commands. Una desreferencia del puntero NULL en el archivo vrend_renderer.c en virglrenderer versiones hasta 0.8.0, permite a usuarios invitados del sistema operativo causar una denegación de servicio por medio de comandos malformados. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.html • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-18389
https://notcve.org/view.php?id=CVE-2019-18389
23 Dec 2019 — A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service, or QEMU guest-to-host escape and code execution, via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands. Un desbordamiento de búfer en la región heap de la memoria en la función vrend_renderer_transfer_write_iov en el archivo vrend_renderer.c en virglrenderer versiones hasta 0.8.0, permite a usuarios del SO invitado causar una denegación... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.html • CWE-787: Out-of-bounds Write •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2019-18390
https://notcve.org/view.php?id=CVE-2019-18390
23 Dec 2019 — An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_BLIT commands. Una lectura fuera de límites en la función vrend_blit_need_swizzle en el archivo vrend_renderer.c en virglrenderer versiones hasta 0.8.0, permite a usuarios invitados del sistema operativo causar una denegación de servicio por medio de los comandos VIRGL_CCMD_BLIT. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.html • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2019-18391
https://notcve.org/view.php?id=CVE-2019-18391
23 Dec 2019 — A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands. Un desbordamiento de búfer en la región heap de la memoria en la función vrend_renderer_transfer_write_iov en el archivo vrend_renderer.c en virglrenderer versiones hasta 0.8.0, permite a usuarios invitados del sistema operativo causar una denegación de servicio por medio de los coma... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.html • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 1CVE-2019-19917
https://notcve.org/view.php?id=CVE-2019-19917
20 Dec 2019 — Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c. Lout versión 3.40, presenta un desbordamiento de búfer en la función StringQuotedWord() en el archivo z39.c. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00068.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 1CVE-2019-19918
https://notcve.org/view.php?id=CVE-2019-19918
20 Dec 2019 — Lout 3.40 has a heap-based buffer overflow in the srcnext() function in z02.c. Lout versión 3.40, presenta un desbordamiento de búfer en la región heap de la memoria en la función srcnext() en el archivo z02.c. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00068.html • CWE-787: Out-of-bounds Write •
CVSS: 6.3EPSS: 1%CPEs: 4EXPL: 0CVE-2019-16782 – Possible Information Leak / Session Hijack Vulnerability in Rack
https://notcve.org/view.php?id=CVE-2019-16782
18 Dec 2019 — There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hi... • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00016.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy CWE-208: Observable Timing Discrepancy •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16779 – In RubyGem excon, interrupted Persistent Connections May Leak Response Data
https://notcve.org/view.php?id=CVE-2019-16779
16 Dec 2019 — In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this. En RubyGem excon versiones anteriores a 0.71.0, se presentó una condición de carrera alrededor de conexiones persistentes, donde un... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-664: Improper Control of a Resource Through its Lifetime •
CVSS: 7.5EPSS: 3%CPEs: 13EXPL: 2CVE-2019-18804 – Debian Security Advisory 5032-1
https://notcve.org/view.php?id=CVE-2019-18804
07 Nov 2019 — DjVuLibre 3.5.27 has a NULL pointer dereference in the function DJVU::filter_fv at IW44EncodeCodec.cpp. DjVuLibre versión 3.5.27, presenta una desreferencia del puntero NULL en la función DJVU::filter_fv en el archivo IW44EncodeCodec.cpp. It was discovered that DjVuLibre incorrectly handled certain memory operations. If a user or automated system were tricked into processing a specially crafted DjVu file, a remote attacker could cause applications to hang or crash, resulting in a denial of service, or possi... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00068.html • CWE-476: NULL Pointer Dereference •
CVSS: 9.8EPSS: 4%CPEs: 5EXPL: 1CVE-2015-8980
https://notcve.org/view.php?id=CVE-2015-8980
04 Nov 2019 — The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code. La fórmula de forma plural en la familia de llamadas ngettext en php-gettext versiones anteriores a la versión 1.0.12, permite a atacantes remotos ejecutar código arbitrario. • http://lists.opensuse.org/opensuse-updates/2017-02/msg00015.html • CWE-20: Improper Input Validation •