Vulnerabilidades do Debian Debian Linux

CVE-2019-15807 Média · 4.7 CWE-401 29/08/2019

Missing Release of Memory after Effective Lifetime em Linux Linux Kernel

In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails. This will cause a BUG and denial of service.

CVE-2019-10086 Alta · 7.3 CWE-502 20/08/2019

Deserialization of Untrusted Data em Apache Software Foundation Commons Beanutils

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

CVE-2019-15219 Média · 4.6 CWE-476 19/08/2019

NULL Pointer Dereference em Linux Linux Kernel

An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/sisusbvga/sisusb.c driver.

CVE-2019-15218 Média · 4.6 CWE-476 19/08/2019

NULL Pointer Dereference em Linux Linux Kernel

An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/siano/smsusb.c driver.

CVE-2019-15217 Média · 4.6 CWE-476 19/08/2019

NULL Pointer Dereference em Linux Linux Kernel

An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver.

CVE-2019-0193 Alta · 7.2 KEV Alta · 66 Exploit público CWE-94 01/08/2019

Apache Solr DataImportHandler Code Injection Vulnerability

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.

CVE-2019-14439 Alta · 7.5 CWE-502 30/07/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

CVE-2019-14379 Crítica · 9.8 CWE-1321 29/07/2019

Prototype Pollution em Fasterxml Jackson-databind

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

CVE-2019-13565 Alta · 7.5 26/07/2019

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session...

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.

CVE-2019-13057 Média · 4.9 26/07/2019

An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator...

An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)

CVE-2019-13962 Crítica · 9.8 CWE-125 18/07/2019

Out-of-bounds Read em Videolan Vlc Media Player

lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.

CVE-2019-13272 Alta · 7.8 KEV Urgente · 76 Exploit público 17/07/2019

Linux Kernel Improper Privilege Management Vulnerability

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

CVE-2019-13602 Alta · 7.8 CWE-191 14/07/2019

Integer Underflow em Videolan Vlc Media Player

An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.

CVE-2018-20843 Alta · 7.5 CWE-611 24/06/2019

In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of...

In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).

CVE-2019-12384 Média · 5.9 CWE-502 24/06/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

CVE-2019-12900 Crítica · 9.8 CWE-787 19/06/2019

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are...

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

CVE-2019-10160 Crítica · 9.8 CWE-172 07/06/2019

A security regression of CVE-2019-9636 was discovered in python since commit...

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

CVE-2019-10149 Crítica · 9.8 KEV Urgente · 80 Exploit público CWE-78 05/06/2019

Exim Mail Transfer Agent (MTA) Improper Input Validation

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

CVE-2019-5436 Alta · 7.8 CWE-787 28/05/2019

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in...

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

CVE-2019-12086 Alta · 7.5 CWE-502 17/05/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.

CVE-2019-0211 Alta · 7.8 KEV Urgente · 70 Exploit público CWE-416 08/04/2019

Apache HTTP Server Privilege Escalation Vulnerability

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

CVE-2019-5418 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-22 27/03/2019

Rails Ruby on Rails Path Traversal Vulnerability

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

CVE-2019-3861 Crítica · 9.1 CWE-125 25/03/2019

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a...

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

CVE-2019-3860 Crítica · 9.1 CWE-125 25/03/2019

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with...

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

CVE-2019-3857 Alta · 8.8 CWE-190 25/03/2019

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2...

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.