CVE-2020-2590

CVE-2020-2590 is an OpenJDK/Oracle Java SE vulnerability in the Security component (Kerberos interop) affecting Java SE and Java SE Embedded across multiple versions. Public descriptions indicate unauthenticated remote access via network and potential unauthorized data updates/deletes; CVSS 3.0 b...

CVE-2020-6447

CVE-2020-6447 describes an inappropriate implementation in the developer tools of Chromium/Google Chrome prior to 81.0.4044.92, which could allow a remote attacker who convinces a user to use DevTools to potentially exploit heap corruption via a crafted HTML page. Public sources (Arch Linux secur...

CVE-2020-8608

In libslirp 4.1.0 (as used in QEMU 4.2.0), tcp_subr.c misuses snprintf return values, causing a buffer overflow in later code. Debian advisories state this can lead to denial of service or potentially arbitrary code execution; upstream and distribution advisories (e.g., Debian DSA-4733-1, ALAS-20...

CVE-2020-2754

CVE-2020-2754 affects Oracle Java SE/Embedded (Scripting) with affected versions Java SE 8u241, 11.0.6 and 14; Java SE Embedded 8u241. Root cause: a parsing/validation weakness in the Scripting component allows an unauthenticated, network-based attacker to cause a partial Denial of Service on Jav...

CVE-2020-14779

CVE-2020-14779 affects Oracle Java SE SE/Embedded with Serialization and can enable an unauthenticated network-based attacker to cause partial denial of service. Affected versions include Java SE 7u271, 8u261, 11.0.8, 15 and Java SE Embedded 8u261; attack surface covers client and server deployme...

CVE-2020-14803

CVE-2020-14803 affects Oracle Java SE Libraries in Java SE 11.0.8 and 15. The vulnerability allows an unauthenticated attacker over network to read a subset of Java SE data due to an issue in Libraries handling, per the CVSS base score 5.3 (CONF). Affected advisories across platforms corroborate ...

CVE-2020-2803

CVE-2020-2803 affects OpenJDK (Libraries component, Java SE/OpenJDK). The connected document confirms a vulnerability in boundary checks of java.nio buffer classes that allows an untrusted Java applet/application to bypass Java sandbox restrictions. Affected versions align with the original descr...

CVE-2019-13627

CVE-2019-13627 concerns a timing attack in the libgcrypt20 cryptographic library. Affected versions include 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. The issue is mitigated by fixes in 1.8.5-2 and 1.6.3-2+deb8u7. Connected advisories from AlmaLinux and Debian/LTS notes confirm the vulnerabilit...

CVE-2020-8647

Summary of CVE-2020-8647: A use-after-free? No — it is an MMIO out-of-bounds access in the vgacon driver (vt.c, vc_do_resize) of the Linux kernel, reported in the Debian/AlmaLinux advisories as CVE-2020-8647. Impact stated in Debian entries includes potential denial of service, memory corruption,...

CVE-2017-13077

CVE-2017-13077 is a KRACK-related vulnerability affecting Wi‑Fi (WPA/WPA2) where an attacker within radio range can force PTK nonce reuse during the four‑way handshake, enabling replay, decryption, or spoofing of frames. The initial description confirms the vulnerability and impact. Connected doc...

CVE-2019-14274

CVE-2019-14274 affects MCPP 2.7.2, with a heap-based buffer overflow in do_msg() in support.c. This is shown across multiple connected advisories (e.g., MARINER, Red Hat, Gentoo GLSA). Impact cited as potential denial of service; no explicit exploit details provided. Remediation exists: upgrade t...

CVE-2018-11212

CVE-2018-11212 affects libjpeg/libjpeg-turbo: the alloc_sarray function in jmemmgr.c allows a remote attacker to cause a denial of service via a crafted file due to a divide-by-zero error. Public advisories (e.g., ALAS2-2019-1198, ALAS-2019-1286, AL2/ALSA-centos/CESA-2019:2052, Debian DLA-1638-1)...

CVE-2019-14902

CVE-2019-14902 affects Samba: all 4.11.x before 4.11.5, all 4.10.x before 4.10.12, and all 4.9.x before 4.9.18. The issue is that removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers. Impact is exposure of ACL/permission state across A...

CVE-2019-19948

CVE-2019-19948 — ImageMagick heap-based buffer overflow in the SGI writer. Root cause: WriteSGIImage in coders/sgi.c overruns the heap when handling SGI images. Affected software: ImageMagick 7.0.8-43 Q16 (and related entries in advisory history). Impact: the vulnerability is described as a heap-...

CVE-2020-0093

CVE-2020-0093 is a libexif vulnerability affecting Android 8.x–10, where a missing bounds check in exif_data_save_data_entry can cause an out-of-bounds read, leading to local information disclosure. The issue arises from an insufficient bounds check in exif-data.c; exploit requires user interacti...

CVE-2019-8936

CVE-2019-8936 concerns NTP (ntpd) up to version 4.2.8p12. The vulnerability arises from a NULL pointer dereference in mode 6 handling, which can cause ntpd to crash and thus a denial of service. Public documents describe authenticated-mode mode-6 packet exploitation and a crash vector, with multi...

CVE-2020-11494

The CVE-2020-11494 issue affects the Linux kernel slcan (serial line CAN) driver: in slcan.c, CAN headers for received packets may not be fully initialised when receiving data, enabling local attackers to read uninitialised can_frame data from kernel memory (information leak). Root cause is incom...

CVE-2019-15220

CVE-2019-15220 affects the Linux kernel prior to 5.2.1 and involves a use-after-free in the p54usb.c driver caused by a malicious USB device. The issue can lead to a denial of service via kernel memory corruption when a vulnerable USB device is connected to drivers/net/wireless/intersil/p54. The ...

CVE-2020-25637

CVE-2020-25637 affects libvirt API used to fetch network interfaces for running QEMU domains. A double-free in the polkit-enabled read-write socket handling can crash the libvirt daemon, causing denial of service and potential privilege escalation. The vulnerability affects versions before 6.8.0;...

CVE-2020-2800

CVE-2020-2800 affects Oracle Java SE/Java SE Embedded, specifically the Lightweight HTTP Server component. Affected versions include Java SE 7u251, 8u241, 11.0.6, 14 and Java SE Embedded 8u241. The vulnerability can be exploited over a network with unauthenticated access via multiple protocols, p...

CVE-2018-14553

CVE-2018-14553 affects libgd2’s gdImageClone in gd.c (libgd versions 2.1.0-rc2 through 2.2.5). The vulnerability is a NULL pointer dereference that can crash an application; impact is a denial of service and it occurs when PHP is linked against an external libgd (not the bundled one). Affected ad...

CVE-2019-12528

Squid is affected by CVE-2019-12528 (pre-4.10). A crafted FTP server can trigger disclosure of sensitive data from heap memory, including data from other sessions or non-Squid processes. Remediation in affected advisories involves upgrading Squid to a later version (at least 4.10+; many advisorie...

CVE-2020-10700

CVE-2020-10700 describes a use-after-free in Samba AD DC LDAP servers when the Paged Results control is combined with the ASQ control, enabling a malicious user to trigger denial of service. Affected products include Samba versions prior to 4.10.15, 4.11.8, and 4.12.2. Public disclosures in conne...

CVE-2020-14303

CVE-2020-14303 affects Samba’s AD DC NBT server: an empty UDP packet to port 137 can cause a CPU spin and denial of service in Samba versions before the patched releases. The public documents identify Samba AD DC NBT as the vulnerable component and list fixed versions in downstream advisories: Sa...

CVE-2019-2786

CVE-2019-2786 affects Oracle Java SE/Java SE Embedded Security component (and related Utilities) with affected Java versions including Java 7/8/11 lines and embedded variants. The CVE describes an unauthenticated network-based vulnerability that can lead to read access to a subset of Java data, w...

CVE-2019-9850

CVE-2019-9850 affects Document Foundation LibreOffice prior to 6.2.6 and is caused by an insufficient URL validation vulnerability that allows triggering LibreLogo from document script events, bypassing prior protections that blocked LibreLogo calls. This enables execution of arbitrary Python cod...

CVE-2020-25643

CVE-2020-25643 affects the Linux kernel HDLC_PPP module via improper input validation in ppp_cp_parse_cr, causing memory corruption and a read overflow that can lead to system crash or DoS. Public advisories confirm this vulnerability and reference the same root cause, with mitigations proposed a...

CVE-2020-2757

CVE-2020-2757 affects Oracle Java SE/SE Embedded (Serialization). Vulnerable: Java SE: 7u251, 8u241, 11.0.6, 14; SE Embedded: 8u241. Impact: unauthenticated network access leading to partial DoS on Java SE/SE Embedded. Root cause: serialization-related handling in the affected component; sandboxe...

CVE-2020-2830

CVE-2020-2830 affects Oracle Java SE/Java SE Embedded (Concurrency component) with Java SE versions 7u251, 8u241, 11.0.6 and 14; Java SE Embedded 8u241. The vulnerability allows unauthenticated network-based exploitation via multiple protocols, potentially enabling partial denial of service on Ja...

CVE-2019-19060

CVE-2019-19060 is a memory-leak vulnerability in the Linux kernel (discovered in adis_buffer.c: adis_update_scan_mode()) that can lead to memory exhaustion and DoS. Affected: Linux kernel versions before 5.3.9 (drivers/iio/imu/adis_buffer.c). Exploitation details are not provided in the documents...

CVE-2019-19604

Git before 2.24.1 is vulnerable to arbitrary command execution via recursive submodule updates because a malicious .gitmodules can cause commands to be run. Affected ranges include 2.20.2, 2.21.x, 2.22.x, 2.23.x, and 2.24.x prior to 2.24.1. Remediation: upgrade to Git 2.24.1 or later (UPC/ALAS re...

CVE-2020-10878

Perl before 5.30.3 contains an integer overflow in the regular expression compiler (related to PL_regkind[OP(n)] == NOTHING). A crafted regex can produce malformed bytecode with a possibility of instruction injection, as documented by multiple advisories and CVEs (e.g., CVE-2020-10878). Public re...

CVE-2019-19949

CVE-2019-19949 affects ImageMagick (7.0.8-43 Q16 and earlier). It is a heap-based buffer over-read in WritePNGImage (coders/png.c), related to Magick_png_write_raw_profile and LocaleNCompare. Impact: attacker-supplied PNGs may cause denial of service via a crash and may potentially disclose memor...

CVE-2019-3860

Summary of CVE-2019-3860 (libssh2) : An out-of-bounds read flaw in how SFTP packets with empty payloads are parsed can allow a remote attacker who compromises an SSH server to cause a Denial of Service or read memory on the client. The issue affects libssh2 versions before 1.8.1. Impact : DoS and...

CVE-2020-10135

The CVE-2020-10135 entry describes a vulnerability in Bluetooth BR/EDR authentication where legacy pairing and secure-connections pairing for Core Specification v5.2 and earlier may allow an unauthenticated, adjacent attacker to complete the authentication procedure without requiring pairing cred...

CVE-2020-10760

CVE-2020-10760 affects the Samba LDAP AD DC: a use-after-free in the Global Catalog LDAP server when paged_results or VLV are used can cause a crash. Vulnerable in all Samba LDAP server versions before 4.10.17, before 4.11.11, and before 4.12.4 in AC/DC configurations. Remediation is to upgrade t...

CVE-2020-13113

The CVE-2020-13113 issue affects libexif up to version 0.6.22. The root cause is use of uninitialized memory in EXIF Makernote handling, which could cause crashes and potential use-after-free conditions. The connected advisories confirm this as a vulnerability in libexif with impacts including cr...

CVE-2019-13050

CVE-2019-13050: Describes a DoS risk arising from the interaction between SKS keyserver network code (through SKS 1.2.0) and GNU Privacy Guard (GnuPG) up to 2.2.16, where a keyserver host reference on the SKS network may trigger a Certificate Spamming Attack leading to a persistent denial-of-serv...

CVE-2019-9213

CVE-2019-9213 : Linux kernel mmap minimum address check in mm/mmap.c is insufficient, enabling a NULL pointer dereference exploit on platforms without SMAP/PAN. Affected: kernels before 4.20.14. Mitigation: upgrade to 4.20.14 or later (see ChangeLog-4.20.14; USN-3931-2).

CVE-2019-11815

The CVE-2019-11815 issue affects Linux kernels with net/rds/tcp.c: rds_tcp_kill_sock contains a race that can cause a use-after-free during net namespace cleanup (pre-5.0.8). A fix was committed and released in 5.0.8; upgrading to 5.0.8+ (or applying the patch) is the advised remediation. The Uni...

CVE-2019-19045

CVE-2019-19045 affects the Linux kernel prior to 5.3.11 due to a memory leak in mlx5_fpga_conn_create_cq() (drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c). The issue allows local attackers to cause memory DoS by triggering mlx5_vector2eqn() failures. Ubuntu/Unity/SUSE advisories cite the sa...

CVE-2019-20446

The CVE concerns librsvg, GNOME's SVG rendering library. In lib/svg processing (specifically xml.rs), a crafted SVG with nested patterns can trigger denial of service by making the number of final rendered objects explode exponentially, consuming CPU/memory. Affected versions are librsvg up to 2....

CVE-2019-2945

CVE-2019-2945 affects Oracle Java SE/Java SE Embedded (Networking) with affected Java SE versions 7u231, 8u221, 11.0.4, 13 and Java SE Embedded 8u221. The vulnerability can be exploited over the network by unauthenticated attackers; some vectors require user interaction and may lead to a partial ...

CVE-2020-0556

Concretely, CVE-2020-0556 affects BlueZ HID/HOGP handling. The vulnerability arises from improper access control: BlueZ before 5.54 does not require bonding between HID devices and hosts, enabling an unauthenticated attacker with adjacent access to impersonate an HID device, establish encrypted l...

CVE-2020-2781

CVE-2020-2781 concerns Oracle/OpenJDK Java SE JSSE vulnerability that allows unauthenticated network access to degrade availability in Java SE and Java SE Embedded (client/server deployment). The Chainguard data confirms affected OpenJDK JSSE components and versions, aligning with the CVE descrip...

CVE-2020-10543

CVE-2020-10543 affects Perl before 5.30.3 on 32-bit platforms, where nested regular expression quantifiers cause a heap-based buffer overflow (integer overflow) in the regex compiler. The connected advisories confirm fixes/updates for Perl (e.g., CloudLinux, AlmaLinux, ALAS2), indicating remediat...

CVE-2020-2604

CVE-2020-2604 affects Oracle Java SE/Java SE Embedded Serialization. Affected: Java SE 7u241, 8u231, 11.0.5, 13.0.1; Java SE Embedded 8u231. Described impact: unauthenticated, network-based attacker can take over the Java environment; high confidentiality, integrity, and availability impact (CVSS...

CVE-2020-12769

CVE-2020-12769 affects the Linux kernel prior to 5.4.17. The issue is in drivers/spi/spi-dw.c, where concurrent calls to dw_spi_irq and dw_spi_transfer_one can trigger a kernel panic (local exploit). The vulnerability is fixed in Linux kernel 5.4.17 (see ChangeLog-5.4.17). No exploit details are ...

CVE-2020-14583

CVE-2020-14583 affects Oracle Java SE/Java SE Embedded (Libraries component). Affected: Java SE 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded 8u251. Exploitation requires network access with user interaction and can lead to takeover of Java SE/Embedded with high impact on confidentiality, int...

CVE-2020-25212

CVE-2020-25212 affects the NFSv4 client in the Linux kernel and is caused by a TOCTOU mismatch where a size check is performed in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c. This can allow a local attacker to corrupt memory or cause unspecified impacts. The issue is addressed in the upstream k...