Fedoraproject : Security Vulnerabilities Published In 2019

2019 : January February March April May June July August September October November December

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2019-1010305	119	Overflow	2019-07-15	2019-08-23	4.3	None	Remote	Medium	Not required	Partial	None	None
libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d.
2	CVE-2019-1000020	400		2019-02-04	2019-04-12	4.3	None	Remote	Medium	Not required	None	None	Partial
libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file.
3	CVE-2019-1000019	125	DoS	2019-02-04	2019-04-12	4.3	None	Remote	Medium	Not required	None	None	Partial
libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.
4	CVE-2019-16910	200	+Info	2019-09-26	2019-10-03	2.6	None	Remote	High	Not required	Partial	None	None
Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. (For Mbed TLS, the fix is also available in versions 2.7.12 and 2.16.3.)
5	CVE-2019-16239	120	Overflow	2019-09-17	2019-09-19	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.
6	CVE-2019-15718	284		2019-09-04	2019-09-19	2.1	None	Local	Low	Not required	None	Partial	None
In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.
7	CVE-2019-14844	20		2019-09-26	2019-10-09	5.0	None	Remote	Low	Not required	None	None	Partial
A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes". A remote unauthenticated user could use this flaw to crash the KDC.
8	CVE-2019-14234	89	Sql	2019-08-09	2019-08-28	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
9	CVE-2019-13377	200	+Info	2019-08-15	2019-09-29	4.3	None	Remote	Medium	Not required	Partial	None	None
The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of observable timing differences and cache access patterns when Brainpool curves are used. An attacker may be able to gain leaked information from a side-channel attack that can be used for full password recovery.
10	CVE-2019-13272	264		2019-07-17	2019-07-25	7.2	None	Local	Low	Not required	Complete	Complete	Complete
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
11	CVE-2019-12854	119	DoS Overflow	2019-08-15	2019-08-28	5.0	None	Remote	Low	Not required	None	None	Partial
Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.
12	CVE-2019-12449	269		2019-05-29	2019-09-20	3.5	None	Remote	Medium	Single system	Partial	None	None
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations from admin:// to file:// URIs, because root privileges are unavailable.
13	CVE-2019-12447	269		2019-05-29	2019-09-20	4.9	None	Remote	Medium	Single system	Partial	Partial	None
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used.
14	CVE-2019-11500	787	Exec Code	2019-08-29	2019-09-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.
15	CVE-2019-11373	125		2019-04-20	2019-05-25	4.3	None	Remote	Medium	Not required	None	None	Partial
An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
16	CVE-2019-11372	125		2019-04-20	2019-05-25	4.3	None	Remote	Medium	Not required	None	None	Partial
An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
17	CVE-2019-11235	345		2019-04-22	2019-05-13	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.
18	CVE-2019-11234	287		2019-04-22	2019-05-13	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
19	CVE-2019-11091	200	Exec Code +Info	2019-05-30	2019-06-11	4.7	None	Local	Medium	Not required	Complete	None	None
Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf
20	CVE-2019-11065	254		2019-04-09	2019-05-21	4.3	None	Remote	Medium	Not required	Partial	None	None
Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.
21	CVE-2019-11026	400		2019-04-08	2019-05-07	4.3	None	Remote	Medium	Not required	None	None	Partial
FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc.
22	CVE-2019-10906	264		2019-04-06	2019-06-06	5.0	None	Remote	Low	Not required	Partial	None	None
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
23	CVE-2019-10903	399		2019-04-09	2019-05-25	5.0	None	Remote	Low	Not required	None	None	Partial
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DCERPC SPOOLSS dissector could crash. This was addressed in epan/dissectors/packet-dcerpc-spoolss.c by adding a boundary check.
24	CVE-2019-10902	399		2019-04-09	2019-04-23	5.0	None	Remote	Low	Not required	None	None	Partial
In Wireshark 3.0.0, the TSDNS dissector could crash. This was addressed in epan/dissectors/packet-tsdns.c by splitting strings safely.
25	CVE-2019-10901	476		2019-04-09	2019-05-25	5.0	None	Remote	Low	Not required	None	None	Partial
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by handling file digests properly.
26	CVE-2019-10900	399		2019-04-09	2019-04-23	5.0	None	Remote	Low	Not required	None	None	Partial
In Wireshark 3.0.0, the Rbm dissector could go into an infinite loop. This was addressed in epan/dissectors/file-rbm.c by handling unknown object types safely.
27	CVE-2019-10899	119	Overflow	2019-04-09	2019-05-25	5.0	None	Remote	Low	Not required	None	None	Partial
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash. This was addressed in epan/dissectors/packet-srvloc.c by preventing a heap-based buffer under-read.
28	CVE-2019-10898	399		2019-04-09	2019-04-23	5.0	None	Remote	Low	Not required	None	None	Partial
In Wireshark 3.0.0, the GSUP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gsm_gsup.c by rejecting an invalid Information Element length.
29	CVE-2019-10897	399		2019-04-09	2019-04-23	5.0	None	Remote	Low	Not required	None	None	Partial
In Wireshark 3.0.0, the IEEE 802.11 dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-ieee80211.c by detecting cases in which the bit offset does not advance.
30	CVE-2019-10896	399		2019-04-09	2019-05-16	5.0	None	Remote	Low	Not required	None	None	Partial
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes.
31	CVE-2019-10895	20		2019-04-09	2019-05-25	5.0	None	Remote	Low	Not required	None	None	Partial
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.
32	CVE-2019-10894	399		2019-04-09	2019-05-25	5.0	None	Remote	Low	Not required	None	None	Partial
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the GSS-API dissector could crash. This was addressed in epan/dissectors/packet-gssapi.c by ensuring that a valid dissector is called.
33	CVE-2019-10191	20		2019-07-16	2019-10-09	5.0	None	Remote	Low	Not required	None	Partial	None
A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol.
34	CVE-2019-10171	400	DoS	2019-08-02	2019-10-09	7.8	None	Remote	Low	Not required	None	None	Complete
It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacker would still be able to provoke excessive CPU consumption leading to a denial of service.
35	CVE-2019-10155	20		2019-06-12	2019-07-29	3.5	None	Remote	Medium	Single system	None	None	Partial
The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.
36	CVE-2019-10143	264	+Priv	2019-05-24	2019-07-09	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
DISPUTED It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue."
37	CVE-2019-10132	264		2019-05-22	2019-06-11	6.5	None	Remote	Low	Single system	Partial	Partial	Partial
A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons.
38	CVE-2019-9917	20	DoS	2019-03-27	2019-06-14	4.0	None	Remote	Low	Single system	None	None	Partial
ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.
39	CVE-2019-9903	400	Bypass	2019-03-21	2019-05-07	4.3	None	Remote	Medium	Not required	None	None	Partial
PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.
40	CVE-2019-9898	327		2019-03-21	2019-04-26	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71.
41	CVE-2019-9897	20		2019-03-21	2019-04-26	5.0	None	Remote	Low	Not required	None	None	Partial
Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.
42	CVE-2019-9895	119	Overflow	2019-03-21	2019-04-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding.
43	CVE-2019-9894	320		2019-03-21	2019-04-26	6.4	None	Remote	Low	Not required	None	Partial	Partial
A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.
44	CVE-2019-9852	22	Exec Code Dir. Trav. Bypass	2019-08-15	2019-09-02	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
45	CVE-2019-9851	20	Exec Code	2019-08-15	2019-09-02	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over. However LibreOffice also has a separate feature where documents can specify that pre-installed scripts can be executed on various global script events such as document-open, etc. In the fixed versions, global script event handlers are validated equivalently to document script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
46	CVE-2019-9850	20	Exec Code Bypass	2019-08-15	2019-09-02	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from script event handers. However an insufficient url validation vulnerability in LibreOffice allowed malicious to bypass that protection and again trigger calling LibreLogo from script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
47	CVE-2019-9849	200	+Info	2019-07-17	2019-08-15	4.0	None	Remote	Low	Single system	Partial	None	None
LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where bullet graphics were omitted from this protection prior to version 6.2.5. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.
48	CVE-2019-9848	20	Exec Code	2019-07-17	2019-08-15	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning. In the fixed versions, LibreLogo cannot be called from a document event handler. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.
49	CVE-2019-9844	79	XSS	2019-04-08	2019-04-15	4.3	None	Remote	Medium	Not required	None	Partial	None
simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI.
50	CVE-2019-9705	400	DoS	2019-03-11	2019-03-29	2.1	None	Local	Low	Not required	None	None	Partial
Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (memory consumption) via a large crontab file because an unlimited number of lines is accepted.

Total number of vulnerabilities : 187 Page : 1 (This Page)2 3 4