CVSS: 9.1EPSS: 0%CPEs: 8EXPL: 1CVE-2019-20367
https://notcve.org/view.php?id=CVE-2019-20367
nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab). El archivo nlist.c en libbsd versiones anteriores a la versión 0.10.0, tiene una lectura fuera de límites durante una comparación de un nombre de símbolo de la tabla de cadenas (strtab). • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00043.html https://gitlab.freedesktop.org/libbsd/libbsd/commit/9d917aad37778a9f4a96ba358415f077f3f36f3b https://lists.apache.org/thread.html/r0e913668380f59bcbd14fdd8ae8d24f95f99995e290cd18a7822c6e5%40%3Cdev.tomee.apache.org%3E https://lists.apache.org/thread.html/ra781e51cf1ec40381c98cddc073b3576fb56c3978f4564d2fa431550%40%3Cdev.tomee.apache.org%3E https://lists.debian.org/debian-lts-announce/2021/02/msg00027.html https://lists.freedesktop.org/archives/libbsd/2019-August/000229.html http • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 1CVE-2019-5188 – e2fsprogs: Out-of-bounds write in e2fsck/rehash.c
https://notcve.org/view.php?id=CVE-2019-5188
A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. Existe una vulnerabilidad de ejecución de código en la funcionalidad directory rehashing de E2fsprogs e2fsck versión 1.45.4. Un directorio ext4 especialmente diseñado puede causar una escritura fuera de límites en la pila, resultando en una ejecución de código. • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00004.html https://lists.debian.org/debian-lts-announce/2020/03/msg00030.html https://lists.debian.org/debian-lts-announce/2020/07/msg00021.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY https://security.netapp.com/advisory/ntap-20220506-0001 https://ta • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2019-19911 – python-pillow: uncontrolled resource consumption in FpxImagePlugin.py
https://notcve.org/view.php?id=CVE-2019-19911
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer. Hay una vulnerabilidad DoS en Pillow versiones anteriores a la versión 6.2.2, causada por el archivo FpxImagePlugin.py llamando a la función range en un entero de 32 bits sin validar si el número de bandas es grande. En Windows ejecutando Python de 32 bits, esto resulta en un OverflowError o MemoryError debido al límite de 2 GB. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html https://usn.ubuntu.com/4272-1 https://www.debian.org/security/2020/dsa-4631 https://access.redhat.com/security/cve/CVE-2019-19911 https://bugzilla.redhat.com/show_bug.cgi?id=1789540 • CWE-190: Integer Overflow or Wraparound CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2019-19959 – sqlite: mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames
https://notcve.org/view.php?id=CVE-2019-19959
ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind. El archivo ext/misc/zipfile.c en SQLite versión 3.30.1, maneja inapropiadamente ciertos usos de INSERT INTO en situaciones que involucran caracteres "\0" insertados en los nombres de archivo, conllevando a un error de administración de memoria que puede ser detectado por valgrind (por ejemplo). • https://github.com/sqlite/sqlite/commit/1e490c4ca6b43a9cf8637d695907888349f69bec https://github.com/sqlite/sqlite/commit/d8f2d46cbc9925e034a68aaaf60aad788d9373c1 https://security.netapp.com/advisory/ntap-20200204-0001 https://usn.ubuntu.com/4298-1 https://www.oracle.com/security-alerts/cpuapr2020.html https://access.redhat.com/security/cve/CVE-2019-19959 https://bugzilla.redhat.com/show_bug.cgi?id=1789595 • CWE-626: Null Byte Interaction Error (Poison Null Byte) •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2020-5310 – python-pillow: Integer overflow leading to buffer overflow in ImagingLibTiffDecode
https://notcve.org/view.php?id=CVE-2020-5310
libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc. El archivo libImaging/TiffDecode.c en Pillow versiones anteriores a la versión 6.2.2, tiene un desbordamiento de enteros de la decodificación TIFF, relacionado con realloc. • https://github.com/python-pillow/Pillow/commit/4e2def2539ec13e53a82e06c4b3daf00454100c4 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html https://usn.ubuntu.com/4272-1 https://access.redhat.com/security/cve/CVE-2020-5310 https://bugzilla.redhat.com/show_bug.cgi?id& • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •