CVSS: 4.4EPSS: 0%CPEs: 6EXPL: 0CVE-2020-0067
https://notcve.org/view.php?id=CVE-2020-0067
In f2fs_xattr_generic_list of xattr.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not required for exploitation.Product: Android. Versions: Android kernel. Android ID: A-120551147. • http://android.googlesource.com/kernel/common/+/688078e7 http://packetstormsecurity.com/files/159565/Kernel-Live-Patch-Security-Notice-LSN-0072-1.html https://source.android.com/security/bulletin/pixel/2020-04-01 https://usn.ubuntu.com/4387-1 https://usn.ubuntu.com/4388-1 https://usn.ubuntu.com/4389-1 https://usn.ubuntu.com/4390-1 https://usn.ubuntu.com/4527-1 • CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2020-11793 – webkitgtk: use-after-free via crafted web content
https://notcve.org/view.php?id=CVE-2020-11793
A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash). Hay un uso de la memoria previamente liberada en WebKitGTK versiones anteriores a la versión 2.28.1 y WPE WebKit versiones anteriores a la versión 2.28.1, por medio de un contenido web especialmente diseñado que permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de la memoria y bloqueo de aplicación). A use-after-free flaw exists in WebKitGTK. This flaw allows remote attackers to execute arbitrary code or cause a denial of service. • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00008.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3P4YISPE5QX4YD54GDRZIH2X5RCH3QGW https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3MQTRC6ITFTVS5R5Z24PMJS6FXJKGRD https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTKY2MWP6PB6TE3ZKOOMKX7HZUCQNYF6 https://security.gentoo.org/glsa/202006-08 https://usn.ubuntu.com/4331-1 https://webkitg • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 1CVE-2019-7306 – Byobu apport hook uploads user's ~/.screenrc
https://notcve.org/view.php?id=CVE-2019-7306
Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu El hook Byobu Apport puede divulgar información confidencial ya que carga de forma automática la extensión .screenrc de un usuario local que puede contener los nombres de host privados, nombres de usuario y contraseñas. Este problema afecta a: byobu • https://bugs.launchpad.net/ubuntu/+source/byobu/+bug/1827202 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7306 • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 9.8EPSS: 1%CPEs: 10EXPL: 0CVE-2019-12519 – squid: improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow
https://notcve.org/view.php?id=CVE-2019-12519
An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack won't overflow. • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html http://www.openwall.com/lists/oss-security/2020/04/23/1 https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12519.txt https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html https://security.gentoo.org/glsa/202005-05 https://security.netapp.com/advisory/ntap-20210205-0006 https://usn.ubuntu.com/4356-1 https://www.debian.org/security/2020/dsa-4682 https://a • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2019-12520 – squid: Improper input validation in request allows for proxy manipulation
https://notcve.org/view.php?id=CVE-2019-12520
An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. • http://www.squid-cache.org/Versions/v4 http://www.squid-cache.org/Versions/v4/changesets https://github.com/squid-cache/squid/commits/v4 https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12520.txt https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html https://security.netapp.com/advisory/ntap-20210205-0006 https://usn.ubuntu.com/4446-1 https://www.debian.org/security/2020/dsa-4682 https://access.redhat.com/security/cve/CVE-20 • CWE-20: Improper Input Validation •