Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-17012 State: PUBLISHED Published: 2020-01-08T21:24:43 Last Updated: 2024-08-05T01:24:48.674Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 Description: Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?b
irefox < 71. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1449736%2C1533957%2C1560667%2C1567209%2C1580288%2C1585760%2C1592502 - https://www.mozilla.org/security/advisories/mfsa2019-36/ - https://www.mozilla.org/security/advisories/mfsa2019-38/ - https://www.mozilla.org/security/advisories/mfsa2019-37/ - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html - https://usn.ubuntu.com/4241-1/ - https://access.redhat.com/errata/RHSA-2020:0292 - https://access.redhat.com/errata/RHSA-2020:0295 - https://security.gentoo.org/glsa/202003-
t.com/errata/RHSA-2020:0292 - https://access.redhat.com/errata/RHSA-2020:0295 - https://security.gentoo.org/glsa/202003-02 - https://security.gentoo.org/glsa/202003-10 - https://usn.ubuntu.com/4335-1/
CVE ID: CVE-2019-17013 State: PUBLISHED Published: 2020-01-08T21:25:08 Last Updated: 2024-08-05T01:24:48.751Z Vendors: Mozilla Products: Firefox Problem Types: Memory safety bugs fixed in Firefox 71 Description: Mozilla developers reported memory safety bugs present in Firefox 70. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 71. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1298509%2C1472328%2C1577439%2C1577937%2C1580320%2C1584195%2C1585106%2C1586293%2C1593865%2C1594181 - https:
st.cgi?bug_id=1298509%2C1472328%2C1577439%2C1577937%2C1580320%2C1584195%2C1585106%2C1586293%2C1593865%2C1594181 - https://www.mozilla.org/security/advisories/mfsa2019-36/
CVE ID: CVE-2019-17014 State: PUBLISHED Published: 2020-01-08T21:25:39 Last Updated: 2024-08-05T01:24:48.675Z Vendors: Mozilla Products: Firefox Problem Types: Dragging and dropping a cross-origin resource, incorrectly loaded as an image, could result in information disclosure Description: If an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in a cross-origin information leak. This vulnerability affects Firefox < 71. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1322864 - https://www.mozilla.org/security/advisories/mfsa2019-36/
CVE ID: CVE-2019-17015 State: PUBLISHED Published: 2020-01-08T21:26:15 Last Updated: 2024-08-05T01:24:48.689Z Vendors: Mozilla Products: Firefox ESR, Firefox Problem Types: Memory corruption in parent process during new content process initialization on Windows Description: During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bu
and Firefox < 72. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1599005 - https://www.mozilla.org/security/advisories/mfsa2020-01/ - https://www.mozilla.org/security/advisories/mfsa2020-02/ - https://seclists.org/bugtraq/2020/Jan/18 - http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html
CVE ID: CVE-2019-17016 State: PUBLISHED Published: 2020-01-08T21:27:03 Last Updated: 2024-08-05T01:24:48.588Z Vendors: Mozilla Products: Firefox ESR, Firefox Problem Types: Bypass of @namespace CSS sanitization during pasting Description: When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1599181 - https://www.mozilla.org/security/advisories/mfsa
r: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1599181 - https://www.mozilla.org/security/advisories/mfsa2020-01/ - https://www.mozilla.org/security/advisories/mfsa2020-02/ - https://seclists.org/bugtraq/2020/Jan/12 - https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html - https://www.debian.org/security/2020/dsa-4600 - https://usn.ubuntu.com/4234-1/ - https://seclists.org/bugtraq/2020/Jan/18 - https://access.redhat.com/errata/RHSA-2020:0085 - https://access.redhat.com/errata/RHSA-2020:0086 - http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html - https://access.redhat.com/errata/RHSA-2020:0111 - http://lists.open
Security-Advisory-mozilla-thunderbird-Updates.html - https://access.redhat.com/errata/RHSA-2020:0111 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html - https://access.redhat.com/errata/RHSA-2020:0120 - https://access.redhat.com/errata/RHSA-2020:0123 - https://access.redhat.com/errata/RHSA-2020:0127 - https://usn.ubuntu.com/4241-1/ - https://www.debian.org/security/2020/dsa-4603 - https://seclists.org/bugtraq/2020/Jan/26 - https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html - https://access.redhat.com/errata/RHSA-2020:0292 - https://access.redhat.com/errata/RHSA-2020:0295 -
-01/msg00043.html - https://access.redhat.com/errata/RHSA-2020:0292 - https://access.redhat.com/errata/RHSA-2020:0295 - https://security.gentoo.org/glsa/202003-02 - https://usn.ubuntu.com/4335-1/
CVE ID: CVE-2019-17017 State: PUBLISHED Published: 2020-01-08T21:27:36 Last Updated: 2024-08-05T01:24:48.752Z Vendors: Mozilla Products: Firefox ESR, Firefox Problem Types: Type Confusion in XPCVariant.cpp Description: Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1603055 - https://www.mozilla.org/security/advisories/mfsa2020-01/ - https://www.mozilla.org/security/advisorie
g.cgi?id=1603055 - https://www.mozilla.org/security/advisories/mfsa2020-01/ - https://www.mozilla.org/security/advisories/mfsa2020-02/ - https://seclists.org/bugtraq/2020/Jan/12 - https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html - https://www.debian.org/security/2020/dsa-4600 - https://usn.ubuntu.com/4234-1/ - https://seclists.org/bugtraq/2020/Jan/18 - https://access.redhat.com/errata/RHSA-2020:0085 - https://access.redhat.com/errata/RHSA-2020:0086 - http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html - https://access.redhat.com/errata/RHSA-2020:0111 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.
https://access.redhat.com/errata/RHSA-2020:0111 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html - https://access.redhat.com/errata/RHSA-2020:0120 - https://access.redhat.com/errata/RHSA-2020:0123 - https://access.redhat.com/errata/RHSA-2020:0127 - https://usn.ubuntu.com/4241-1/ - https://www.debian.org/security/2020/dsa-4603 - https://seclists.org/bugtraq/2020/Jan/26 - https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html - https://access.redhat.com/errata/RHSA-2020:0292 - https://access.redhat.com/errata/RHSA-2020:0295 - https://security.gentoo.org/glsa/202003-02 - https://
RHSA-2020:0292 - https://access.redhat.com/errata/RHSA-2020:0295 - https://security.gentoo.org/glsa/202003-02 - https://usn.ubuntu.com/4335-1/
CVE ID: CVE-2019-17018 State: PUBLISHED Published: 2020-01-08T21:28:09 Last Updated: 2024-08-05T01:24:48.756Z Vendors: Mozilla Products: Firefox Problem Types: Windows Keyboard in Private Browsing Mode may retain word suggestions Description: When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard. This vulnerability affects Firefox < 72. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1549394 - https://www.mozilla.org/security/advisories/mfsa2020-01/
CVE ID: CVE-2019-17019 State: PUBLISHED Published: 2020-01-08T21:28:47 Last Updated: 2024-08-05T01:24:48.672Z Vendors: Mozilla Products: Firefox Problem Types: Python files could be inadvertently executed upon opening a download Description: When Python was installed on Windows, a python file being served with the MIME type of text/plain could be executed by Python instead of being opened as a text file when the Open option was selected upon download. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 72. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1568003 -
Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1568003 - https://www.mozilla.org/security/advisories/mfsa2020-01/
CVE ID: CVE-2019-17020 State: PUBLISHED Published: 2020-01-08T21:29:16 Last Updated: 2024-08-05T01:24:48.668Z Vendors: Mozilla Products: Firefox Problem Types: Content Security Policy not applied to XSL stylesheets applied to XML documents Description: If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document. This vulnerability affects Firefox < 72. Additional Analyst Notes: - CVE Program Container: References: - https://bu
nt. This vulnerability affects Firefox < 72. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1597645 - https://www.mozilla.org/security/advisories/mfsa2020-01/ - https://usn.ubuntu.com/4234-1/
CVE ID: CVE-2019-17021 State: PUBLISHED Published: 2020-01-08T21:29:40 Last Updated: 2024-08-05T01:24:48.727Z Vendors: Mozilla Products: Firefox ESR, Firefox Problem Types: Heap address disclosure in parent process during content process initialization on Windows Description: During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1599
< 72. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1599008 - https://www.mozilla.org/security/advisories/mfsa2020-01/ - https://www.mozilla.org/security/advisories/mfsa2020-02/ - https://seclists.org/bugtraq/2020/Jan/18 - http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html
CVE ID: CVE-2019-17022 State: PUBLISHED Published: 2020-01-08T21:30:09 Last Updated: 2024-08-05T01:24:48.712Z Vendors: Mozilla Products: Firefox ESR, Firefox Problem Types: CSS sanitization does not escape HTML tags Description: When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape &lt; and &gt; characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this beh
ng it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1602843 - https://www.mozilla.org/security/advisories/mfsa2020-01/ - https://www.mozilla.org/security/advisories/mfsa2020-02/ - https://seclists.org/bugtraq/2020/Jan/12 - https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html - https://www.debian.org/security/2020/dsa-4600 - https://usn.ubuntu.com/4234-1/ - https://seclists.org/bugtraq/2020/Jan/18 - https://access.redh
security/2020/dsa-4600 - https://usn.ubuntu.com/4234-1/ - https://seclists.org/bugtraq/2020/Jan/18 - https://access.redhat.com/errata/RHSA-2020:0085 - https://access.redhat.com/errata/RHSA-2020:0086 - http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html - https://access.redhat.com/errata/RHSA-2020:0111 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html - https://access.redhat.com/errata/RHSA-2020:0120 - https://access.redhat.com/errata/RHSA-2020:0123 - https://access.redhat.com/errata/RHSA-2020:0127 - https://usn.ubuntu.com/4241-1/ - https://www.debian.org/security/2020/dsa-4603 - https://seclists.org/bugtraq/2020/
27 - https://usn.ubuntu.com/4241-1/ - https://www.debian.org/security/2020/dsa-4603 - https://seclists.org/bugtraq/2020/Jan/26 - https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html - https://access.redhat.com/errata/RHSA-2020:0292 - https://access.redhat.com/errata/RHSA-2020:0295 - https://security.gentoo.org/glsa/202003-02 - https://usn.ubuntu.com/4335-1/
CVE ID: CVE-2019-17023 State: PUBLISHED Published: 2020-01-08T21:30:29 Last Updated: 2024-08-05T01:24:48.748Z Vendors: Mozilla Products: Firefox Problem Types: NSS may negotiate TLS 1.2 or below after a TLS 1.3 HelloRetryRequest had been sent Description: After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1590001 - https://www.mozilla.org/security
Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1590001 - https://www.mozilla.org/security/advisories/mfsa2020-01/ - https://usn.ubuntu.com/4234-1/ - https://usn.ubuntu.com/4397-1/ - https://www.debian.org/security/2020/dsa-4726
CVE ID: CVE-2019-17024 State: PUBLISHED Published: 2020-01-08T21:31:03 Last Updated: 2024-08-05T01:24:48.822Z Vendors: Mozilla Products: Firefox ESR, Firefox Problem Types: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4 Description: Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1507180%2C1595470%2C1598605%
tes: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1507180%2C1595470%2C1598605%2C1601826 - https://www.mozilla.org/security/advisories/mfsa2020-01/ - https://www.mozilla.org/security/advisories/mfsa2020-02/ - https://seclists.org/bugtraq/2020/Jan/12 - https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html - https://www.debian.org/security/2020/dsa-4600 - https://usn.ubuntu.com/4234-1/ - https://seclists.org/bugtraq/2020/Jan/18 - https://access.redhat.com/errata/RHSA-2020:0085 - https://access.redhat.com/errata/RHSA-2020:0086 - http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html - https:/
086 - http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html - https://access.redhat.com/errata/RHSA-2020:0111 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html - https://access.redhat.com/errata/RHSA-2020:0120 - https://access.redhat.com/errata/RHSA-2020:0123 - https://access.redhat.com/errata/RHSA-2020:0127 - https://usn.ubuntu.com/4241-1/ - https://www.debian.org/security/2020/dsa-4603 - https://seclists.org/bugtraq/2020/Jan/26 - https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html - https://access.redhat.com/errata/RHSA-20
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html - https://access.redhat.com/errata/RHSA-2020:0292 - https://access.redhat.com/errata/RHSA-2020:0295 - https://security.gentoo.org/glsa/202003-02 - https://usn.ubuntu.com/4335-1/
CVE ID: CVE-2019-17025 State: PUBLISHED Published: 2020-01-08T21:31:26 Last Updated: 2024-08-05T01:24:48.686Z Vendors: Mozilla Products: Firefox Problem Types: Memory safety bugs fixed in Firefox 72 Description: Mozilla developers reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 72. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1328295%2C1328300%2C1590447%2C1590965%2C1595692%2C1597321%2C1597481 - https://www.mozilla.org/security/adv
st.cgi?bug_id=1328295%2C1328300%2C1590447%2C1590965%2C1595692%2C1597321%2C1597481 - https://www.mozilla.org/security/advisories/mfsa2020-01/ - https://usn.ubuntu.com/4234-1/
CVE ID: CVE-2019-17026 State: PUBLISHED Published: 2020-03-02T04:05:03.000Z Last Updated: 2025-10-21T23:35:50.362Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: IonMonkey type confusion with StoreElementHole and FallibleStoreElement Description: Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2020-04/ - https
ogram Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2020-04/ - https://www.mozilla.org/security/advisories/mfsa2020-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1607443 - https://security.gentoo.org/glsa/202003-02 - https://usn.ubuntu.com/4335-1/ - http://packetstormsecurity.com/files/162568/Firefox-72-IonMonkey-JIT-Type-Confusion.html
CVE ID: CVE-2019-17027 State: REJECTED Published: 2020-02-26T16:47:55 Last Updated: 2020-02-26T16:47:55 Description: No description available.
CVE ID: CVE-2019-17028 State: REJECTED Published: 2020-02-26T16:49:36 Last Updated: 2020-02-26T16:49:36 Description: No description available.
CVE ID: CVE-2019-17029 State: REJECTED Published: 2020-02-26T16:49:36 Last Updated: 2020-02-26T16:49:36 Description: No description available.
CVE ID: CVE-2019-17030 State: REJECTED Published: 2020-02-26T16:49:36 Last Updated: 2020-02-26T16:49:36 Description: No description available.
CVE ID: CVE-2019-17031 State: REJECTED Published: 2020-02-26T16:49:36 Last Updated: 2020-02-26T16:49:36 Description: No description available.
CVE ID: CVE-2019-17032 State: REJECTED Published: 2020-02-26T16:49:36 Last Updated: 2020-02-26T16:49:36 Description: No description available.
CVE ID: CVE-2019-17033 State: REJECTED Published: 2020-02-26T16:49:37 Last Updated: 2020-02-26T16:49:37 Description: No description available.
CVE ID: CVE-2019-17034 State: REJECTED Published: 2020-02-26T16:49:37 Last Updated: 2020-02-26T16:49:37 Description: No description available.
CVE ID: CVE-2019-17035 State: REJECTED Published: 2020-02-26T16:49:37 Last Updated: 2020-02-26T16:49:37 Description: No description available.
CVE ID: CVE-2019-17036 State: REJECTED Published: 2020-02-26T16:49:37 Last Updated: 2020-02-26T16:49:37 Description: No description available.
CVE ID: CVE-2019-17037 State: REJECTED Published: 2020-02-26T16:49:37 Last Updated: 2020-02-26T16:49:37 Description: No description available.
CVE ID: CVE-2019-17038 State: REJECTED Published: 2020-02-26T16:49:37 Last Updated: 2020-02-26T16:49:37 Description: No description available.
CVE ID: CVE-2019-17039 State: REJECTED Published: 2020-02-26T16:49:37 Last Updated: 2020-02-26T16:49:37 Description: No description available.
CVE ID: CVE-2019-17040 State: PUBLISHED Published: 2019-09-30T13:06:43 Last Updated: 2024-08-05T01:24:48.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rsyslog/rsyslog/blob/v8-stable/ChangeLog - https://github.com/rsyslog/rsyslog/pull/3875 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6SUQE25RD37CD24BHKUWMG27U5RQ2FU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPNCHI7X
MG27U5RQ2FU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPNCHI7X2IEXRH6RYD6IDPR4PLB5RPC7/
CVE ID: CVE-2019-17041 State: PUBLISHED Published: 2019-10-07T15:31:17 Last Updated: 2024-08-05T01:24:48.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the none