CVE-2019-10063

An incomplete fix for CVE-2017-5226 was found in flatpak. A sandbox bypass flaw was found in the way bubblewrap, which is used for sandboxing flatpak applications handled the TIOCSTI ioctl. A malicious flatpak application could use this flaw to inject commands into the controlled terminal of the...

CVE-2019-1010238

A buffer overflow flaw was found in Gnome Pango. When invalid utf-8 strings are passed to functions, a heap-based buffer overflow can occur that could lead to code execution. The highest threat from this vulnerability is data confidentiality and integrity as well as system availability...

PT-2019-5140 · Xen +1 · Xen +1

Name of the Vulnerable Software and Affected Versions: Xen versions prior to 4.12 Description: The issue is related to a race condition in the XENMEM exchange component of the Xen hypervisor, which arose due to improper synchronization when accessing shared resources. This allows an attacker to...

The vulnerability of the SwizzleData function in browsers like Firefox and Firefox ESR, as well as in the Thunderbird email client, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the SwizzleData function in browsers like Firefox and Firefox ESR, as well as in the Thunderbird email client, is caused by a numerical overflow condition. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of t...

The vulnerability of the add_job function (scheduler/ipp.c) in the CUPS printing server allows a attacker to compromise data integrity.

The vulnerability of the addjob function in the scheduler/ipp.c file of the CUPS print server is related to insufficient validation of input data when D-Bus support is enabled. Exploiting this vulnerability could allow a malicious actor to compromise data integrity...

The vulnerability of the DBUS_COOKIE_SHA1 function in the D-Bus library of the process-interaction system allows a perpetrator to compromise data integrity or gain unauthorized access to protected information.

The vulnerability of the DBUSCOOKIESHA1 function in the D-Bus library related to deficiencies in authentication mechanisms. Exploiting this vulnerability could allow an attacker to compromise data integrity by replacing the uid value or gaining unauthorized access to protected information by usin...

The vulnerability of the fly-admin-printer print manager in the FLY operating system of Astra Linux allows a attacker to compromise data integrity, gain unauthorized access to protected information, and cause service failures.

The vulnerability of the fly-admin-printer print manager in the FLY operating system of Astra Linux is related to errors in processing empty tasks, as well as errors in renaming the printer. Exploiting this vulnerability allows a remote attacker to compromise data integrity, gain unauthorized...

The vulnerability of Blink’s web page display mechanism in the Google Chrome web browser allows attackers to compromise data integrity, gain unauthorized access to protected information, and cause service interruptions.

The vulnerability of Blink’s web page rendering mechanism in the Google Chrome browser is related to the reutilization of dynamic memory after it is freed by a “trash collector”. Exploiting this vulnerability can allow an attacker to compromise data integrity, gain unauthorized access to protecte...

The vulnerability of the zlib_decompress_extra function in the VideoLAN VLC media player allows a hacker to access confidential data after decompression, potentially compromising the integrity of those data and causing service failures.

The vulnerability of the zlibdecompressextra function in the VideoLAN VLC media player involves its use after decompression. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of the fly-admin-service-se component in the FLY operating system of Astra Linux allows a attacker to compromise data integrity, gain unauthorized access to protected information, and cause service failures.

The vulnerability of the fly-admin-service-se component in the FLY operating system’s working environment is related to an interpretation error in the DocumentRoot settings of the configuration files for Apache. Additionally, there is a lack of checks for installed mail packages. Exploiting this...

The vulnerability of the RubyGems package management system lies in the incorrect limitation of the path to the restricted access catalog, which allows an attacker to compromise data integrity.

The vulnerability of the RubyGems package management system is related to an incorrect limitation on the path to the restricted-access catalog. Exploiting this vulnerability could allow a malicious actor to compromise data integrity...

The vulnerability of the fly-admin-security-monitor component in the FLY operating system environment of the Astra Linux platform allows a perpetrator to compromise data integrity, gain unauthorized access to protected information, and cause service interruptions.

The vulnerability of the fly-admin-security-monitor component in the FLY operating environment of the Astra Linux system is related to the absence of blocking mechanisms for system commands, as well as the absence of a configuration status for the closed-programming-environment security system...

The vulnerability of the fly-hexedit component in the FLY operating environment of the Astra Linux system allows a perpetrator to compromise data integrity.

The vulnerability of the fly-hexedit component in the FLY environment of the Astra Linux operating system is related to file corruption when saving files with the same name. Exploiting this vulnerability can allow an attacker to compromise data integrity...

The vulnerability of the Rack module in the Ruby programming language allows attackers to compromise data integrity.

The vulnerability of the Rack module in the Ruby programming language is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow an attacker to compromise the integrity of data...

The vulnerability of the fly-admin-local component in the FLY operating system environment of the Astra Linux platform involves incorrect processing of input data. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the fly-admin-local component in the FLY operating system environment of Astra Linux is related to the malfunction of the utility when the network is disconnected. Additionally, there is an incorrect interpretation of parameters in the configuration files for pam-tally and...

The vulnerability of the Java Virtual Machine component in Oracle GraalVM Enterprise Edition allows a perpetrator to trigger a service failure or compromise the integrity of the protected information.

The vulnerability of the Java Virtual Machine component of Oracle GraalVM Enterprise Edition is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to cause service failures or compromise the integrity of the protected information...

The vulnerability of the Customer component of the MICROS Relate CRM Software allows a perpetrator to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Customer component of the MICROS Relate CRM Software lies in the lack of access control mechanisms. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information by sending specially crafted HTTP reques...

PT-2019-5206 · Apache +1 · Netty +1

Name of the Vulnerable Software and Affected Versions: Netty versions prior to 4.1.42.Final Description: The issue is related to the incorrect handling of whitespace before the colon in HTTP headers, such as a "Transfer-Encoding : chunked" line. This can lead to HTTP request smuggling, allowing a...

PT-2019-4749 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 3.16 through 5.3.2 Description: The issue is related to the ax25 create function in the AF AX25 network module, which does not properly enforce the CAP NET RAW capability. This allows unprivileged users to create a raw...

dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass

A flaw was found in dbus. The implementation of DBUSCOOKIESHA1 is susceptible to a symbolic link attack. A malicious client with write access to its own home directory could manipulate a /.dbus-keyrings symlink to cause the DBusServer to read and write in unintended locations resulting in an...