Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-35457 State: PUBLISHED Published: 2020-12-14T22:25:09 Last Updated: 2024-08-04T17:02:07.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is "Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries()." The researcher states that this pattern is undocumented Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/glib/-/commit/63c5b62f0a984fac9a9700b12
yst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/glib/-/commit/63c5b62f0a984fac9a9700b12f54fe878e016a5d - https://gitlab.gnome.org/GNOME/glib/-/issues/2197 - https://gitlab.gnome.org/GNOME/glib/-/releases/2.65.3
CVE ID: CVE-2020-35458 State: PUBLISHED Published: 2021-01-12T14:21:23 Last Updated: 2024-08-04T17:02:07.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1179998 - https://github.com/ClusterLabs/hawk/releases - https://www.openwall.com/lists/oss-security/2021/01/12/3 - http://www.openwall.com/list
.com/ClusterLabs/hawk/releases - https://www.openwall.com/lists/oss-security/2021/01/12/3 - http://www.openwall.com/lists/oss-security/2021/01/12/3
CVE ID: CVE-2020-35459 State: PUBLISHED Published: 2021-01-12T14:32:23 Last Updated: 2024-08-04T17:02:08.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1179999 - https://github.com/ClusterLabs/crmsh/releases - https://www.openwall.com/lists/oss-security/2021/01/12/3 - https://github.com/ClusterLabs/crmsh/blob/a403aa15
releases - https://www.openwall.com/lists/oss-security/2021/01/12/3 - https://github.com/ClusterLabs/crmsh/blob/a403aa15f3ea575adfe5e43bf2a31c9f9094fcda/crmsh/history.py#L476 - http://www.openwall.com/lists/oss-security/2021/01/12/3 - https://lists.debian.org/debian-lts-announce/2021/01/msg00021.html
CVE ID: CVE-2020-35460 State: PUBLISHED Published: 2020-12-14T22:48:19.000Z Last Updated: 2025-05-05T17:07:21.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/joniles/mpxj/commit/8eaf4225048ea5ba7e59ef4556dab2098fcc4a1d - https://www.oracle.com/security-alerts/cpujan2021.html - http://www.mpxj.org/changes-report.html#a8.3.5
CVE ID: CVE-2020-35462 State: PUBLISHED Published: 2020-12-15T22:35:40 Last Updated: 2024-08-04T17:02:08.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user. Systems deployed using affected versions of the CoScale agent container may allow a remote attacker to achieve root access with a blank password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/donghyunlee00/CVE/blob/main/CVE-2020-35462
CVE ID: CVE-2020-35463 State: PUBLISHED Published: 2020-12-15T22:40:20 Last Updated: 2024-08-04T17:02:08.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user. Systems deployed using affected versions of the Instana Dynamic APM container may allow a remote attacker to achieve root access with a blank password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/donghyunlee00/CVE/blob/main/CVE-2020-35463
CVE ID: CVE-2020-35464 State: PUBLISHED Published: 2020-12-15T22:45:44 Last Updated: 2024-08-04T17:02:08.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user. Systems deployed using affected versions of the Weave Cloud Agent container may allow a remote attacker to achieve root access with a blank password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/donghyunlee00/CVE/blob/main/CVE-2020-35464
CVE ID: CVE-2020-35465 State: REJECTED Published: N/A Last Updated: 2024-05-03T21:10:03.771317 Description: No description available.
CVE ID: CVE-2020-35466 State: PUBLISHED Published: 2020-12-15T22:56:56 Last Updated: 2024-08-04T17:02:08.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Blackfire Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the Blackfire container may allow a remote attacker to achieve root access with a blank password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/donghyunlee00/CVE/blob/main/CVE-2020-35466
CVE ID: CVE-2020-35467 State: PUBLISHED Published: 2020-12-15T22:59:54 Last Updated: 2024-08-04T17:02:08.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the Docker Docs container may allow a remote attacker to achieve root access with a blank password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/donghyunlee00/CVE/blob/main/CVE-2020-35467
CVE ID: CVE-2020-35468 State: PUBLISHED Published: 2020-12-15T23:03:10 Last Updated: 2024-08-04T17:02:08.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Appbase streams Docker image 2.1.2 contains a blank password for the root user. Systems deployed using affected versions of the streams container may allow a remote attacker to achieve root access with a blank password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/donghyunlee00/CVE/blob/main/CVE-2020-35468
CVE ID: CVE-2020-35469 State: PUBLISHED Published: 2020-12-15T23:08:37 Last Updated: 2024-08-04T17:02:07.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user. Systems deployed using affected versions of the Terracotta Server OSS container may allow a remote attacker to achieve root access with a blank password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/donghyunlee00/CVE/blob/main/CVE-2020-35469
CVE ID: CVE-2020-35470 State: PUBLISHED Published: 2020-12-15T00:48:35 Last Updated: 2024-08-04T17:02:08.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/envoyproxy/envoy/issues/14087 - https://github.com/envoyproxy/envoy/pull/14131 - https://github.com/envoyproxy/envoy/compare/v1.16.0...v1.16.1
CVE ID: CVE-2020-35471 State: PUBLISHED Published: 2020-12-15T00:48:24 Last Updated: 2024-08-04T17:02:07.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: Envoy before 1.16.1 mishandles dropped and truncated datagrams, as demonstrated by a segmentation fault for a UDP packet size larger than 1500. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/envoyproxy/envoy/compare/v1.16.0...v1.16.1 - https://github.com/envoyproxy/envoy/issues/14113 - https://github.com/envoyproxy/envoy/pull/14122
CVE ID: CVE-2020-35473 State: PUBLISHED Published: 2022-11-08T00:00:00.000Z Last Updated: 2025-05-01T17:28:19.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended scan response in Bluetooth Core Specifications 5.0 through 5.2, may be used to identify devices using Resolvable Private Addressing (RPA) by their response or non-response to specific scan requests from remote addresses. RPAs that have been associated with a specific remote device may also be used to identify a peer in the same manner by using its reaction to an activ
d with a specific remote device may also be used to identify a peer in the same manner by using its reaction to an active scan request. This has also been called an allowlist-based side channel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://dl.acm.org/doi/10.1145/3548606.3559372 - https://www.sigsac.org/ccs/CCS2022/proceedings/ccs-proceedings.html
CVE ID: CVE-2020-35474 State: PUBLISHED Published: 2020-12-18T07:30:48 Last Updated: 2024-08-04T17:02:08.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS because the definition of MediaWiki:recentchanges-legend-watchlistexpiry can be changed onwiki so that the output is raw HTML. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T268894 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPI
ml - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC/
CVE ID: CVE-2020-35475 State: PUBLISHED Published: 2020-12-18T07:32:34 Last Updated: 2024-08-04T17:02:08.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:UserRights but does not have rights to change all userrights, and the table on the left side has unchangeable groups in it. (The right column with the changeable groups is not affected and is escaped correctly.) Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T268917 - https://lists.wikimedia.org/pipermail/mediawiki-anno
ontainer: References: - https://phabricator.wikimedia.org/T268917 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.html - https://www.debian.org/security/2020/dsa-4816 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC/
CVE ID: CVE-2020-35476 State: PUBLISHED Published: 2020-12-16T00:00:00 Last Updated: 2024-08-04T17:02:08.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenTSDB/opentsdb/issues/2051 - http://packetstormsecurity.com/files/170331/OpenTSDB-2
References: - https://github.com/OpenTSDB/opentsdb/issues/2051 - http://packetstormsecurity.com/files/170331/OpenTSDB-2.4.0-Command-Injection.html
CVE ID: CVE-2020-35477 State: PUBLISHED Published: 2020-12-18T07:37:24 Last Updated: 2024-08-04T17:02:08.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visits a log entry on Special:Log, and toggles the "Change visibility of selected log entries" checkbox (or a tags checkbox) next to it, there is a redirection to the main page's action=historysubmit (instead of the desired behavior in which a revision-deletion form appears). Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/
etion form appears). Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T205908 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.html - https://www.debian.org/security/2020/dsa-4816 - https://lists.debian.org/debian-lts-announce/2020/12/msg00034.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC/
CVE ID: CVE-2020-35478 State: PUBLISHED Published: 2020-12-18T07:33:43 Last Updated: 2024-08-04T17:02:08.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace potentially can be output as raw HTML with SCRIPT tags via LogFormatter::makePageLink(). This affects MediaWiki 1.33.0 and later. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T268938 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2F
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC/
CVE ID: CVE-2020-35479 State: PUBLISHED Published: 2020-12-18T07:42:25 Last Updated: 2024-08-04T17:02:08.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in all code paths. For example, the return of Language::userTimeAndDate is is always unsafe for HTML in a month value. This affects MediaWiki 1.12.0 and later. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T268938 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.html - https://www.debian.org/security/2020/dsa-4816 - https://lists
g/pipermail/mediawiki-announce/2020-December/000268.html - https://www.debian.org/security/2020/dsa-4816 - https://lists.debian.org/debian-lts-announce/2020/12/msg00034.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC/
CVE ID: CVE-2020-35480 State: PUBLISHED Published: 2020-12-18T07:40:38 Last Updated: 2024-08-04T17:02:08.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (accounts that have been explicitly hidden due to being abusive, or similar) that the viewer cannot see are handled differently, exposing sensitive information about the hidden status to unprivileged viewers. This exists on various code paths. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T120883 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-Decem
ences: - https://phabricator.wikimedia.org/T120883 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.html - https://www.debian.org/security/2020/dsa-4816 - https://lists.debian.org/debian-lts-announce/2020/12/msg00034.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC/
CVE ID: CVE-2020-35481 State: PUBLISHED Published: 2021-02-03T15:47:59 Last Updated: 2024-08-04T17:02:07.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-2_release_notes.htm
CVE ID: CVE-2020-35482 State: PUBLISHED Published: 2021-02-03T15:49:44 Last Updated: 2024-08-04T17:02:08.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-2_release_notes.htm
CVE ID: CVE-2020-35483 State: PUBLISHED Published: 2021-01-11T14:33:43 Last Updated: 2024-08-04T17:02:07.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: AnyDesk before 6.1.0 on Windows, when run in portable mode on a system where the attacker has write access to the application directory, allows this attacker to compromise a local user account via a read-only setting for a Trojan horse gcapi.dll file. Additional Analyst Notes: - CVE Program Container: References: - https://anydesk.com/cve/2020-35483/
CVE ID: CVE-2020-35488 State: PUBLISHED Published: 2021-01-05T14:03:44 Last Updated: 2024-08-04T17:02:08.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted Syslog payload to the Syslog service. This attack requires a specific configuration. Also, the name of the directory created must use a Syslog field. (For example, on Linux it is not possible to create a .. directory. On Windows, it is not possible to create a CON directory.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GuillaumePet
reate a CON directory.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GuillaumePetit84/CVE-2020-35488 - https://gitlab.com/nxlog-public/nxlog-ce/-/blob/master/ChangeLog.txt#L2
CVE ID: CVE-2020-35489 State: PUBLISHED Published: 2020-12-17T18:16:00 Last Updated: 2024-08-04T17:02:08.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/contact-form-7/#developers - https://www.getastra.com/blog/911/plugin-exploit/contact-form-7-unrestricted-file-upload/ - https://contactform7.com/2020/12/17/contact-form-7-532/ - https://wpscan.com/vulnerability/10508 - https://www.jinsonvarghese.com/un
actform7.com/2020/12/17/contact-form-7-532/ - https://wpscan.com/vulnerability/10508 - https://www.jinsonvarghese.com/unrestricted-file-upload-in-contact-form-7/
CVE ID: CVE-2020-35490 State: PUBLISHED Published: 2020-12-17T18:43:51 Last Updated: 2024-08-04T17:02:08.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource. Additional Analyst Notes: - CVE Program Container: References: - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/2986 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2
86 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210122-0005/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-35491 State: PUBLISHED Published: 2020-12-17T18:43:41 Last Updated: 2024-08-04T17:02:08.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource. Additional Analyst Notes: - CVE Program Container: References: - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/2986 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr20
6 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210122-0005/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-35492 State: PUBLISHED Published: 2021-03-18T18:59:41.000Z Last Updated: 2025-02-13T16:27:43.741Z Vendors: n/a Products: cairo Problem Types: CWE-121 Description: A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -> out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability. Additional Analyst Notes: - CVE Program Contain
bility is to confidentiality, integrity, as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1898396 - https://security.gentoo.org/glsa/202305-21
CVE ID: CVE-2020-35493 State: PUBLISHED Published: 2021-01-04T14:22:55 Last Updated: 2024-08-04T17:02:08.087Z Vendors: n/a Products: binutils Problem Types: CWE-20 Description: A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1911437 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KOK3QWSVOUJWJ54HVGIFWNL
ttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KOK3QWSVOUJWJ54HVGIFWNLWQ5ZY4S6/ - https://security.netapp.com/advisory/ntap-20210212-0007/ - https://security.gentoo.org/glsa/202107-24
CVE ID: CVE-2020-35494 State: PUBLISHED Published: 2021-01-04T14:23:23 Last Updated: 2024-08-04T17:02:08.273Z Vendors: n/a Products: binutils Problem Types: CWE-908 Description: There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1911439 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproje