Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-1000172 State: PUBLISHED Published: 2018-04-30T22:00:00Z Last Updated: 2024-09-17T03:13:30.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator page. This vulnerability appears to have been fixed in 2.2.45. Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/zeroday/FG-VD-17-215 - https://wordpress.org/plugins/nextgen-gallery/#developers
CVE ID: CVE-2018-1000173 State: PUBLISHED Published: 2018-05-08T15:00:00 Last Updated: 2024-08-05T12:33:49.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104210 - https://jenkins.io/security/advisory/2018-04-16/
CVE ID: CVE-2018-1000174 State: PUBLISHED Published: 2018-05-08T15:00:00 Last Updated: 2024-08-05T12:33:49.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to an arbitrary URL after successful login. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-04-16/ - http://www.securityfocus.com/bid/104211
CVE ID: CVE-2018-1000175 State: PUBLISHED Published: 2018-05-08T15:00:00Z Last Updated: 2024-09-17T02:22:07.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers able to configure the HTML Publisher build step to override arbitrary files on the Jenkins master. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-04-16/
CVE ID: CVE-2018-1000176 State: PUBLISHED Published: 2018-05-08T15:00:00Z Last Updated: 2024-09-16T22:45:15.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/ExtendedEmailPublisher/global.groovy and ExtendedEmailPublisherDescriptor.java that allows attackers with control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured SMTP password. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-04-16/
CVE ID: CVE-2018-1000177 State: PUBLISHED Published: 2018-05-08T15:00:00Z Last Updated: 2024-09-17T04:20:43.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containing JavaScript that would be executed in another user's browser when that user performs some UI actions. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-04-16/
CVE ID: CVE-2018-1000178 State: PUBLISHED Published: 2018-05-08T15:00:00 Last Updated: 2024-08-05T12:33:49.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::processMessage(const QByteArray &msg) datastreampeer.cpp line 62 that allows an attacker to execute code remotely. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4189 - https://lists.debian.org/debian-lts-announce/2018/05/msg00001.html - https://github.com/quassel/quassel/blob/master/src/common/protocols/datastream/datastreampeer.cpp#L62 - https://security.gento
//github.com/quassel/quassel/blob/master/src/common/protocols/datastream/datastreampeer.cpp#L62 - https://security.gentoo.org/glsa/201806-04 - https://i.imgur.com/JJ4QcNq.png - https://usn.ubuntu.com/4594-1/
CVE ID: CVE-2018-1000179 State: PUBLISHED Published: 2018-05-08T15:00:00 Last Updated: 2024-08-05T12:33:49.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL Pointer Dereference of CWE-476 exists in quassel version 0.12.4 in the quasselcore void CoreAuthHandler::handle(const Login &msg) coreauthhandler.cpp line 235 that allows an attacker to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4189 - https://security.gentoo.org/glsa/201806-04 - https://github.com/quassel/quassel/blob/master/src/core/coreauthhandler.cpp#L236 - https://usn.ubuntu.com/4594-1/
CVE ID: CVE-2018-1000180 State: PUBLISHED Published: 2018-06-05T13:00:00 Last Updated: 2024-08-05T12:33:49.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2428 - https://access.redhat.com/errata/RHSA-2018:2669 - https://access.redhat.com/er
access.redhat.com/errata/RHSA-2018:2428 - https://access.redhat.com/errata/RHSA-2018:2669 - https://access.redhat.com/errata/RHSA-2018:2643 - https://access.redhat.com/errata/RHSA-2018:2424 - https://access.redhat.com/errata/RHSA-2018:2423 - https://access.redhat.com/errata/RHSA-2018:2425 - https://www.debian.org/security/2018/dsa-4233 - https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E - http://www.securityfocus.com/bid/106567 - https://access.redhat.com/errata/RHSA-2019:0877 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html -
le.com/security-alerts/cpuapr2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.bountysource.com/issues/58293083-rsa-key-generation-computation-of-iterations-for-mr-primality-test - https://github.com/bcgit/bc-java/commit/22467b6e8fe19717ecdf201c0cf91bacf04a55ad - https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839 - https://security.netapp.com/advisory/ntap-20190204-0003/ - https://github.com/bcgit/b
22b7795fc165630aba8d5f5729acc839 - https://security.netapp.com/advisory/ntap-20190204-0003/ - https://github.com/bcgit/bc-java/wiki/CVE-2018-1000180 - https://www.oracle.com/security-alerts/cpuApr2021.html
CVE ID: CVE-2018-1000181 State: PUBLISHED Published: 2018-06-05T13:00:00 Last Updated: 2024-08-05T12:33:49.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kitura 2.3.0 and earlier have an unintended read access to unauthorised files and folders that can be exploited by a crafted URL resulting in information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/IBM-Swift/Kitura/pull/1278
CVE ID: CVE-2018-1000182 State: PUBLISHED Published: 2018-06-05T20:00:00Z Last Updated: 2024-09-16T18:49:17.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java, TFS2013GitRepositoryBrowser.java, ViewGitWeb.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-06-04/#SECURITY-810
CVE ID: CVE-2018-1000183 State: PUBLISHED Published: 2018-06-05T20:00:00Z Last Updated: 2024-09-17T03:07:20.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-06-04/#SECURITY-804
CVE ID: CVE-2018-1000184 State: PUBLISHED Published: 2018-06-05T20:00:00Z Last Updated: 2024-09-16T22:56:33.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: A server-side request forgery vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubPluginConfig.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-06-04/#SECURITY-799
CVE ID: CVE-2018-1000185 State: PUBLISHED Published: 2018-06-05T20:00:00Z Last Updated: 2024-09-16T22:14:09.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-06-04/#SECURITY-806
CVE ID: CVE-2018-1000186 State: PUBLISHED Published: 2018-06-05T20:00:00Z Last Updated: 2024-09-16T22:36:38.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-06-04/#SECURITY-805
CVE ID: CVE-2018-1000187 State: PUBLISHED Published: 2018-06-05T20:00:00Z Last Updated: 2024-09-17T03:02:32.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that results in sensitive variables such as passwords being written to logs. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-06-04/#SECURITY-883
CVE ID: CVE-2018-1000188 State: PUBLISHED Published: 2018-06-05T20:00:00Z Last Updated: 2024-09-17T01:26:35.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-06-04/#SECURITY-809
CVE ID: CVE-2018-1000189 State: PUBLISHED Published: 2018-06-05T20:00:00Z Last Updated: 2024-09-17T02:31:34.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with Overall/Read access to execute a command on the Jenkins master. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-06-04/#SECURITY-807
CVE ID: CVE-2018-1000190 State: PUBLISHED Published: 2018-06-05T20:00:00Z Last Updated: 2024-09-16T23:00:43.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-06-04/#SECURITY-865
CVE ID: CVE-2018-1000191 State: PUBLISHED Published: 2018-06-05T20:00:00Z Last Updated: 2024-09-17T01:41:43.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: A exposure of sensitive information vulnerability exists in Jenkins Black Duck Detect Plugin 1.4.0 and older in DetectPostBuildStepDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-06-04/#SECURITY-866
CVE ID: CVE-2018-1000192 State: PUBLISHED Published: 2018-06-05T21:00:00 Last Updated: 2024-08-05T12:40:46.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read access to enumerate all installed plugins. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuapr2022.html - https://jenkins.io/security/advisory/2018-05-09/#SECURITY-771
CVE ID: CVE-2018-1000193 State: PUBLISHED Published: 2018-06-05T21:00:00 Last Updated: 2024-08-05T12:40:46.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have the same name as other users, and cannot be deleted via the UI. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuapr2022.html - https://jenkins.io/security/advisory/2018-05-09/#SECURITY-786
CVE ID: CVE-2018-1000194 State: PUBLISHED Published: 2018-06-05T21:00:00 Last Updated: 2024-08-05T12:40:47.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuapr2022.html - https://jenkins.io/security/advisory/2018-05-09/#SECURITY-788
CVE ID: CVE-2018-1000195 State: PUBLISHED Published: 2018-06-05T21:00:00 Last Updated: 2024-08-05T12:40:46.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful (200) or not. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuapr2022.html - https://jenkins.io/security/advisory/2018-05-09/#SECURITY-794
CVE ID: CVE-2018-1000196 State: PUBLISHED Published: 2018-06-05T21:00:00Z Last Updated: 2024-09-16T16:53:10.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_notifier/global.erb that allows attackers with local Jenkins master file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured Gitlab token. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-05-09/#SECURITY-263
CVE ID: CVE-2018-1000197 State: PUBLISHED Published: 2018-06-05T21:00:00Z Last Updated: 2024-09-17T02:57:51.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/Read permission to read and write the Black Duck Hub plugin configuration. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-05-09/#SECURITY-670
CVE ID: CVE-2018-1000198 State: PUBLISHED Published: 2018-06-05T21:00:00Z Last Updated: 2024-09-16T19:52:03.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read permission to make Jenkins process XML eternal entities in an XML document. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-05-09/#SECURITY-671
CVE ID: CVE-2018-1000199 State: PUBLISHED Published: 2018-05-24T13:00:00 Last Updated: 2024-08-05T12:40:46.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result in crash and possibly memory corruption. This attack appear to be exploitable via local code execution and the ability to use ptrace. This vulnerability appears to have been fixed in git commit f67b15037a7a50c57f72e69a6d59941ad90a0f0f. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4187 - https://access.redhat.com/errata/RHSA-2018:1347 - https://ac
ferences: - https://www.debian.org/security/2018/dsa-4187 - https://access.redhat.com/errata/RHSA-2018:1347 - https://access.redhat.com/errata/RHSA-2018:1348 - https://www.debian.org/security/2018/dsa-4188 - https://access.redhat.com/errata/RHSA-2018:1354 - http://www.securitytracker.com/id/1040806 - https://access.redhat.com/errata/RHSA-2018:1355 - https://access.redhat.com/errata/RHSA-2018:1345 - https://access.redhat.com/errata/RHSA-2018:1318 - https://access.redhat.com/errata/RHSA-2018:1374 - https://lkml.org/lkml/2018/4/6/813 - https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html - https://usn.ubuntu.com/3641-2/ - https://usn.ubuntu.com/3641-1/ - http://lists.opensuse.org/
nce/2018/05/msg00000.html - https://usn.ubuntu.com/3641-2/ - https://usn.ubuntu.com/3641-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html
CVE ID: CVE-2018-1000200 State: PUBLISHED Published: 2018-06-05T13:00:00 Last Updated: 2024-08-05T12:40:46.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory (OOM) killing of large mlocked processes. The issue arises from an oom killed process's final thread calling exit_mmap(), which calls munlock_vma_pages_all() for mlocked vmas.This can happen synchronously with the oom reaper's unmap_page_range() since the vma's VM_LOCKED bit is cleared before munlocking (to determine if any other vmas share the memory and are mlocked). Additional Analyst Notes: - CVE Program Co
munlocking (to determine if any other vmas share the memory and are mlocked). Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3752-2/ - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=27ae357fa82be5ab73b2ef8d39dcb8ca2563483a - https://usn.ubuntu.com/3752-3/ - https://access.redhat.com/security/cve/cve-2018-1000200 - https://marc.info/?l=linux-kernel&m=152460926619256 - https://access.redhat.com/errata/RHSA-2018:2948 - http://www.securityfocus.com/bid/104397 - https://marc.info/?l=linux-kernel&m=152400522806945 - https://usn.ubuntu.com/3752-1/ - http://seclists.org/oss-sec/2018/q2/67
CVE ID: CVE-2018-1000201 State: PUBLISHED Published: 2018-06-22T18:00:00 Last Updated: 2024-08-05T12:40:46.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ffi/ffi/commit/e0fe486df0e117ed67b0282b6ada04b7214ca05c - https://github.com/ffi/ffi/commit/09e0c6076466b4383da7fa4e13f714311109945a
CVE ID: CVE-2018-1000202 State: PUBLISHED Published: 2018-06-05T21:00:00Z Last Updated: 2024-09-17T01:35:40.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-05-09/#SECURITY-821
CVE ID: CVE-2018-1000203 State: PUBLISHED Published: 2018-06-06T19:00:00Z Last Updated: 2024-09-16T23:40:51.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: Soar Labs Soar Coin version up to and including git commit 4a2aa71ee21014e2880a3f7aad11091ed6ad434f (latest release as of Sept 2017) contains an intentional backdoor vulnerability in the function zero_fee_transaction() that can result in theft of Soar Coins by the "onlycentralAccount" (Soar Labs) after payment is processed. Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/neowenyuan27/SoarCoin/master/wallet/soarcoinv2.sol - https://www.bankinfosecurity.com/exclusive-aussie-
busercontent.com/neowenyuan27/SoarCoin/master/wallet/soarcoinv2.sol - https://www.bankinfosecurity.com/exclusive-aussie-firm-loses-5m-to-backdoored-cryptocurrency-a-11057
CVE ID: CVE-2018-1000204 State: PUBLISHED Published: 2018-06-26T14:00:00 Last Updated: 2024-08-05T12:40:46.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make th
ns to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties dispute the relevance of this report, noting that the requirement for an attacker to have both the CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it "virtually impossible to exploit. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3752-2/ - https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html - https://usn.ubuntu.com/3696-1/ - https://usn.ubuntu.com/3752-3/ - https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html - http://www.openwall.com/lists/oss-security/2018/0