Vulnerabilidades do Fedoraproject Fedora

CVE-2019-1551 Média · 5.3 CWE-190 06/12/2019

rsaz_512_sqr overflow bug on x86_64

There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).

CVE-2019-5544 Crítica · 9.8 KEV Urgente · 83 Exploit público Ransomware CWE-787 06/12/2019

VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

CVE-2013-4235 Média · 4.7 CWE-367 03/12/2019

shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees

CVE-2019-19126 Baixa · 3.3 CWE-665 19/11/2019

On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the...

On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

CVE-2019-19066 Média · 4.7 CWE-401 18/11/2019

Missing Release of Memory after Effective Lifetime em Linux Linux Kernel

A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering bfa_port_get_stats() failures, aka CID-0e62395da2bd.

CVE-2019-19054 Média · 4.7 CWE-401 18/11/2019

Missing Release of Memory after Effective Lifetime em Linux Linux Kernel

A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering kfifo_alloc() failures, aka CID-a7b2df76b42b.

CVE-2019-11043 Crítica · 9.8 KEV Urgente · 90 Exploit público Ransomware CWE-787 28/10/2019

PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

CVE-2019-17498 Alta · 8.1 CWE-190 21/10/2019

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer...

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

CVE-2019-16943 Crítica · 9.8 CWE-502 01/10/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

CVE-2019-16942 Crítica · 9.8 CWE-502 01/10/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

CVE-2019-16928 Crítica · 9.8 KEV Alta · 63 CWE-787 27/09/2019

Exim Out-of-bounds Write Vulnerability

Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.

CVE-2019-5094 Alta · 7.5 CWE-787 24/09/2019

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1...

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

CVE-2019-5482 Crítica · 9.8 CWE-787 16/09/2019

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

CVE-2019-5481 Crítica · 9.8 CWE-415 16/09/2019

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

CVE-2019-16335 Crítica · 9.8 CWE-502 15/09/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

CVE-2019-14540 Crítica · 9.8 CWE-502 15/09/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

CVE-2019-16168 Média · 6.5 CWE-369 09/09/2019

In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other...

In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."

CVE-2019-16056 Alta · 7.5 CWE-20 06/09/2019

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7...

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

CVE-2019-10086 Alta · 7.3 CWE-502 20/08/2019

Deserialization of Untrusted Data em Apache Software Foundation Commons Beanutils

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

CVE-2019-14439 Alta · 7.5 CWE-502 30/07/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

CVE-2019-14379 Crítica · 9.8 CWE-1321 29/07/2019

Prototype Pollution em Fasterxml Jackson-databind

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

CVE-2019-13272 Alta · 7.8 KEV Urgente · 76 Exploit público 17/07/2019

Linux Kernel Improper Privilege Management Vulnerability

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

CVE-2018-20843 Alta · 7.5 CWE-611 24/06/2019

In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of...

In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).

CVE-2019-10160 Crítica · 9.8 CWE-172 07/06/2019

A security regression of CVE-2019-9636 was discovered in python since commit...

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

CVE-2019-8457 Crítica · 9.8 CWE-125 30/05/2019

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the...

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.