CVE-2018-16228

CVE-2018-16228 affects tcpdump prior to version 4.9.3. The HNCP parser (print-hncp.c:print_prefix) may read beyond the allocated buffer, exposing a buffer over-read vulnerability with potential impact on availability. The vulnerability is confirmed by multiple sources (e.g., tcpdump advisories an...

CVE-2018-16837

CVE-2018-16837 affects Ansible; the User module leaks data passed to ssh-keygen, enabling potential exposure of credentials (e.g., passphrases) visible in a process list for users with access. The connected documents confirm this information disclosure issue and note multiple vendor advisories/pa...

CVE-2018-2790

CVE-2018-2790 affects Oracle Java SE/Java SE Embedded (OpenJDK in Linux distributions) with a JAR manifest handling flaw. Public sources in Debian and CentOS advisories cite it among OpenJDK issues for multiple Java versions (6u181, 7u171, 8u162, 10; Embedded 8u161). The connected docs identify t...

CVE-2019-17539

CVE-2019-17539 affects FFmpeg prior to 4.2, where avcodec_open2 in libavcodec/utils.c dereferences a NULL close function pointer, leading to a NULL pointer dereference and possibly unspecified other impact. Affected software is FFmpeg’s libavcodec component; root cause is a NULL pointer dereferen...

CVE-2019-17596

CVE-2019-17596 affects Go (Go before 1.12.11 and 1.3.x before 1.13.2) and can cause a panic when processing network traffic that contains an invalid DSA public key, e.g., traffic between clients and servers that verify client certificates. Connected advisories show affected Go versions and explic...

CVE-2019-5818

CVE-2019-5818 affects Chromium/Google Chrome’s media reader component before version 74.0.3729.108. The root cause is an uninitialized value in media processing, which can allow a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. Public advi...

CVE-2020-11521

CVE-2020-11521: In FreeRDP, an Out-of-bounds Write was reported in libfreerdp/codec/planar.c affecting FreeRDP versions >1.0 through 2.0.0-rc4. The impact is memory corruption (as described as an OOB write). Remediation in provided documents is via security advisories/updates from Debian, Cent...

CVE-2020-11761

CVE-2020-11761 involves an out-of-bounds read during Huffman uncompression in OpenEXR before 2.4.1 (CVE-2020-11761). Amazon Linux 2 advisory ALAS2-2020-1499 documents OpenEXR issues including CVE-2020-11761 and notes the fix in OpenEXR 1.7.1 packages for AL2 and provides upgrade guidance. Red Hat...

CVE-2020-36185

CVE-2020-36185 is a Jackson Databind v2.x vulnerability (pre-2.9.10.8) where deserialization gadgets interact with typing, linked to SharedPoolDataSource/JNDI-related classes. Affected: jackson-databind 2.x before 2.9.10.8. Impact includes potential remote code execution via gadget chains. Remedi...

CVE-2020-6456

CVE-2020-6456 affects the chromium/chrome browser family. The vulnerability is caused by insufficient validation of untrusted input in the clipboard, enabling a local attacker to bypass site isolation via crafted clipboard contents in affected builds prior to 81.0.4044.92. Public records in multi...

CVE-2020-6479

CVE-2020-6479 affects Chromium/Google Chrome before 83.0.4103.61. Root cause: an inappropriate implementation in the sharing component could allow a remote attacker to spoof the security UI via a crafted HTML page. Impact: spoofed security UI and potential circumvention of security checks, as des...

CVE-2021-30952

CVE-2021-30952 is an Apple WebKit/WebKitGTK-affected integer overflow in processing malicious web content that can lead to arbitrary code execution. The issue is addressed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2, iPadOS 15.2, and watchOS 8.3, with fixes via input validation impro...

CVE-2021-4149

CVE-2021-4149: Local privilege escalation via Linux kernel btrfs deadlock. Affects btrfs_alloc_tree_b in fs/btrfs/extent-tree.c where an improper lock operation can deadlock, enabling a local user to cause a denial-of-service. Debian LTS advisory DLA-3065-1 lists CVE-2021-4149 and notes the patch...

CVE-2017-17805

CVE-2017-17805 affects the Linux kernel prior to 4.14.8. The Salsa20 cipher implementation (crypto/salsa20_generic.c and arch/x86/crypto/salsa20_glue.c) mishandles zero-length inputs, allowing a local attacker to use the AF_ALG-based skcipher interface to trigger uninitialized memory free and ker...

CVE-2018-16451

CVE-2018-16451 is a buffer over-read in tcpdump's SMB parser (print-smb.c:print_trans) for SMB slots; Debian/AlmaLinux advisories show it alongside other tcpdump issues fixed by upgrading to tcpdump 4.9.3 (and libpcap 1.9.1). The available connected documents confirm the vulnerability and the fix...

CVE-2018-18492

CVE-2018-18492 is a use-after-free in the Firefox/ Thunderbird codebase: after deleting a selection element, a weak reference in the options collection can lead to a potentially exploitable crash. Affected products include Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox

CVE-2018-7740

CVE-2018-7740 affects the Linux kernel, where the resv_map_release function in mm/hugetlb.c up to version 4.15.7 is vulnerable. A local attacker can cause a denial of service by crafting an app that uses mmap and a large pgoff with remap_file_pages, triggering a BUG. The connected Nessus reports ...

CVE-2019-1010315

CVE-2019-1010315 affects WavPack 5.1 and earlier. The vulnerability is a CWE-369 divide-by-zero in ParseDsdiffHeaderConfig (dsdiff.c:282) when parsing a malicious .wav file, which can cause the application to crash. The attack vector is a crafted WAV file. The fixed version is the code commit htt...

CVE-2019-3823

CVE-2019-3823 affects curl/libcurl from version 7.34.0 through before 7.64.0. The issue is a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to smtp_endofresp() isn’t NUL terminated and contains no character ending the parsed number, and len is 5, a...

CVE-2020-28036

WordPress vulnerability CVE-2020-28036: wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows privilege escalation via XML-RPC comment actions. Root cause: XML-RPC handling enables elevated privileges when commenting on a post. Affected: WordPress core prior to 5.5.2. Impact: po...

CVE-2020-6392

CVE-2020-6392 describes an insufficient policy enforcement in the Extensions component of Chromium/Google Chrome, allowing an attacker who lures a user to install a crafted malicious extension to bypass navigation restrictions. Public advisories in connected documents indicate the issue affects C...

CVE-2020-6510

CVE-2020-6510 describes a heap buffer overflow in Chrome/Chromium’s background fetch path (prior to 84.0.4147.89). A remote attacker could exploit this via a crafted HTML page to achieve heap corruption. The issue is publicly acknowledged across multiple advisories; remediation is to upgrade to C...

CVE-2022-0318

CVE-2022-0318 affects Vim and is described in connected bulletins as a Heap-based Buffer Overflow in Vim prior to 8.2. Debian’s DLA-3204-1 notes the Vim fix as part of a security update for Vim 2:8.1.0875-5+deb10u4, addressing CVE-2022-0318 among others. AstraLinux bulletin reiterates the Vim hea...

CVE-2023-38403

CVE-2023-38403 affects iperf3 builds prior to 3.14 (versions < 3.14). The vulnerability arises from a memory/length handling issue that can cause an integer overflow and heap corruption, with the potential for crash or arbitrary code execution as described in the reports. Exploitation status i...

CVE-2015-2301

Summary of CVE-2015-2301 Affected software: PHP before 5.5.22 and 5.6.x before 5.6.6 (phar extension). Root cause: Use-after-free in phar_rename_archive function within phar_object.c. Impact: Remote attackers may cause a denial of service or potentially other unspecified effects by triggering an ...

CVE-2017-17741

CVE-2017-17741 affects the Linux kernel KVM implementation through 4.14.7, enabling a write_mmio stack-based out-of-bounds read that can reveal potentially sensitive information from kernel memory. Affected code paths are in arch/x86/kvm/x86.c and include/trace/events/kvm.h. The supplied document...

CVE-2019-25042

CVE-2019-25042 concerns Unbound, where an out-of-bounds write can occur in the rdata_copy path when handling compressed names. The descriptor consistently cites Unbound versions before 1.9.5 as affected, with the root cause listed as an out-of-bounds write via compressed names. The vendor dispute...

CVE-2019-5820

CVE-2019-5820 is a PDFium-based integer overflow in Chromium/Google Chrome prior to 74.0.3729.108 that could allow a remote attacker to potentially trigger heap corruption via a crafted PDF. The issue is documented across multiple advisories (Debian DSA-4500, Arch Linux ASA-201904-12, Gentoo GLSA...

CVE-2020-10650

CVE-2020-10650 is a deserialization vulnerability in FasterXML jackson-databind up to 2.9.10.4 that allowed unauthenticated code execution via Ignite-JTA or Quartz-core gadgets (e.g., CacheJndiTmLookup/CacheJndiTmFactory; JNDIConnectionProvider). Technical details across connected sources confirm...

CVE-2020-11987

CVE-2020-11987 – SSRF in Apache Batik 1.13 . The initial description confirms a server-side request forgery via improper input validation in NodePickerPanel, enabling an attacker to make arbitrary GET requests from the server. Connected documents corroborate concrete remediation actions across ve...

CVE-2020-24750

CVE-2020-24750 affects FasterXML jackson-databind 2.x prior to 2.9.10.6, where the interaction between serialization gadgets and typing is mishandled (CWE-502). This deserialization flaw could enable exploitation via untrusted data; the connected IBM/Cloudera doc confirms the CVE entry but does n...

CVE-2020-26570

OpenSC CVE-2020-26570 involves a heap-based buffer overflow in the Oberthur smart card driver (sc_oberthur_read_file). Affected OpenSC versions are before 0.21.0-rc1; multiple advisories recommend upgrading to 0.21.0-1 or newer. Impact is a potential compromise via crafted card data; remediation ...

CVE-2020-36182

CVE-2020-36182 affects FasterXML jackson-databind 2.x before 2.9.10.8, due to mishandling of serialization gadgets and typing involving DriverAdapterCPDS (org.apache.tomcat.dbcp.dbcp2.cpdsadapter). Do not speculate on exploitability beyond what is stated; some sources (e.g., Debian LTS advisory) ...

CVE-2020-6433

CVE-2020-6433 describes an insufficient policy enforcement vulnerability in the extensions component of Chromium/Google Chrome, allowing a remote attacker to bypass navigation restrictions via crafted HTML. This is part of a broader set of policy enforcement issues in Chromium 81.x. Debian/Arch/F...

CVE-2021-3930

CVE-2021-3930 concerns an off-by-one error in the SCSI device emulation of QEMU during MODE SELECT handling in mode_sense_page() when page is MODE_PAGE_ALLS (0x3f). The vulnerability can allow a malicious guest to crash QEMU, causing a denial of service. Affected software is QEMU (various release...

CVE-2021-43543

CVE-2021-43543 is a CSP sandbox bypass where documents loaded with the CSP sandbox directive could escape restrictions by embedding additional content. Affected products include Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox

CVE-2023-1380

CVE-2023-1380 is referenced in the Connected documents as a slab-out-of-bounds read vulnerability in the Linux kernel, specifically in brcmf_get_assoc_ies() within the brcmfmac CFG80211 path. The underlying issue is when assoc_info->req_len exceeds the buffer size (WL_EXTRA_BUF_MAX), enabling ...

CVE-2023-4244

CVE-2023-4244 is a Linux kernel use-after-free in nf_tables/netfilter. A race between the netlink control plane transaction and nft_set element garbage collection can underflow a reference counter, enabling local privilege escalation. Affected: Linux kernel nf_tables/netfilter. Root cause: refere...

CVE-2018-1000122

CVE-2018-1000122 is a vulnerability in curl/libcurl affecting RTSP+RTP processing. A buffer over-read exists in curl versions 7.20.0 through 7.58.0 that can cause denial of service or information leakage. Related issues include CVE-2018-1000120 (FTP path trickery) and CVE-2018-1000121 (LDAP NULL ...

CVE-2018-6927

CVE-2018-6927 concerns the Linux kernel futex_requeue implementation in kernel/futex.c. Multiple connected documents confirm a flaw where triggering a negative wake or requeue value can cause a denial of service via an integer overflow. Affected are kernel versions prior to 4.14.15 (and related u...

CVE-2019-12817

CVE-2019-12817 affects the PowerPC Linux kernel: a bug in arch/powerpc/mm/mmu_context_book3s64.c before 5.1.15 can allow unrelated processes to read/write each other’s memory via an mmap above 512 TB on a subset of PowerPC systems. The issue is limited to those platforms; impact is memory confide...

CVE-2019-16276

CVE-2019-16276 affects the Go programming language’s net/http handling, allowing HTTP Request Smuggling when an HTTP header contains spaces before the colon. The issue is publicly documented across multiple advisories; Go versions prior to fixes described in the connected documents are affected. ...

CVE-2019-16680

CVE-2019-16680 concerns GNOME file-roller prior to 3.29.91. Affected component: file extraction from TAR archives. Root cause: a single ./../ path traversal via a filename inside the archive can lead to overwriting an existing file during extraction. Impact stated in sources: potential file overw...

CVE-2019-3839

Ghostscript (Artifex) is affected by CVE-2019-3839: after the CVE-2019-6116 fix, some privileged operators remain accessible from various PostScript contexts, allowing a crafted PostScript file to access the filesystem outside -dSAFER constraints. The issue affects Ghostscript versions before 9.2...

CVE-2020-11522

CVE-2020-11522 is an out-of-bounds read in libfreerdp/gdi/gdi.c affecting FreeRDP versions >1.0 through 2.0.0-rc4. Advisories indicate fixes in later releases (up to 2.1.1); remediation: upgrade to FreeRDP 2.1.1 or newer. The connected documents confirm the vulnerability and its remediation pa...

CVE-2020-15673

CVE-2020-15673 refers to memory-safety bugs reported in Mozilla Firefox (including ESR) and Thunderbird. Affected products and versions include Firefox <81, Firefox ESR <78.3, and Thunderbird

CVE-2020-4048

CVE-2020-4048 affects WordPress and is caused by inadequate URL sanitization in wp_validate_redirect(), allowing an open redirect via a crafted external link. The issue has been fixed in WordPress 5.4.2 and also in earlier affected versions via minor releases (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15,...

CVE-2020-6459

Affected software: Google Chrome (payments implementation). Issue: a use-after-free in payments leads to potential heap corruption. Root cause: use-after-free in the payments code path as described in CVE-2020-6459. Impact: remote attacker could trigger arbitrary behavior via a crafted HTML page;...

CVE-2022-3435

CVE-2022-3435 affects the Linux kernel: an out-of-bounds read in fib_nh_match (net/ipv4/fib_semantics.c) could be exploited remotely by a remote, unauthenticated/partially privileged actor per the CVSS vector. The issue is rated CVSS v3.1 base 4.3 (Medium) with low impact to confidentiality and n...

CVE-2014-3480

The CVE-2014-3480 entry concerns a flaw in the cdf_count_chain function of cdf.c used by PHP’s Fileinfo component. The issue stems from inadequate validation of sector-count data in CDF files, enabling a remote attacker to trigger a denial of service (application crash) by supplying a crafted CDF...