Vulnerabilidades do Fedoraproject Fedora

CVE-2020-8286 Alta · 7.5 CWE-295 14/12/2020

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to...

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

CVE-2020-8285 Alta · 7.5 CWE-674 14/12/2020

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack...

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

CVE-2020-8284 Baixa · 3.7 CWE-200 14/12/2020

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting...

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

CVE-2020-29562 Média · 4.8 CWE-617 04/12/2020

The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4...

The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

CVE-2020-25649 Alta · 7.5 CWE-611 03/12/2020

XML External Entity (XXE) em Fasterxml Jackson-databind

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

CVE-2020-13671 Alta · 8.8 KEV Alta · 62 Exploit público CWE-434 20/11/2020

Drupal core Un-restricted Upload of File

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

CVE-2020-28949 Alta · 7.8 KEV Alta · 68 Exploit público 19/11/2020

PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

CVE-2020-28196 Alta · 7.5 CWE-674 06/11/2020

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via...

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

CVE-2020-16846 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-78 06/11/2020

SaltStack Salt Shell Injection Vulnerability

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

CVE-2020-16009 Alta · 8.8 KEV Alta · 56 CWE-787 03/11/2020

Google Chromium V8 Type Confusion Vulnerability

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2020-15999 Crítica · 9.6 KEV Alta · 66 Exploit público CWE-787 03/11/2020

Google Chrome FreeType Heap Buffer Overflow Vulnerability

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2020-27619 Crítica · 9.8 22/10/2020

In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call…

In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.

CVE-2020-11979 Alta · 7.5 CWE-379 01/10/2020

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary…

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

CVE-2020-26116 Alta · 7.2 CWE-74 27/09/2020

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x...

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

CVE-2020-24659 Alta · 7.5 CWE-476 04/09/2020

NULL Pointer Dereference em Gnu Gnutls

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.

CVE-2020-24977 Média · 6.5 CWE-125 03/09/2020

GNOME project libxml2 v2.9.10 and earlier have a global Buffer Overflow vulnerability in...

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

CVE-2020-1472 Média · 5.5 KEV Urgente · 96 Exploit público Ransomware 17/08/2020

Microsoft Netlogon Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

CVE-2019-20907 Alta · 7.5 CWE-835 13/07/2020

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to...

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CVE-2020-14422 Média · 5.9 CWE-330 18/06/2020

Incorrect Calculation and Use of Insufficiently Random Values in Python

Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.

CVE-2020-13965 Média · 6.1 KEV Alta · 59 Exploit público CWE-79 09/06/2020

Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.

CVE-2020-13871 Alta · 7.5 CWE-416 06/06/2020

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite...

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

CVE-2020-12723 Alta · 7.5 CWE-120 05/06/2020

Classic Buffer Overflow em Perl

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 Alta · 8.6 CWE-190 05/06/2020

Integer Overflow or Wraparound em Perl

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2020-10543 Alta · 8.2 CWE-190 05/06/2020

Integer Overflow or Wraparound em Perl

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2020-13777 Alta · 7.4 CWE-327 04/06/2020

GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of...

GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.