Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-14851 State: PUBLISHED Published: 2021-03-18T19:04:21 Last Updated: 2024-08-05T00:26:39.132Z Vendors: n/a Products: nbdkit Problem Types: CWE-617 Description: A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertion failure, causing nbdkit to exit. This issue only affected nbdkit versions 1.12.7, 1.14.1, and 1.15.1. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1757259 - https://www.redhat.com/archives/libguestfs/2019-September/msg00272.html
CVE ID: CVE-2019-14852 State: PUBLISHED Published: 2021-03-18T19:07:37 Last Updated: 2024-08-05T00:26:39.132Z Vendors: n/a Products: apicast Problem Types: CWE-327 Description: A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encryption, gaining access to unauthorized information. Version shipped in Red Hat 3scale API Management Platform is vulnerable to this issue. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1758208
CVE ID: CVE-2019-14853 State: PUBLISHED Published: 2019-11-26T12:06:20 Last Updated: 2024-08-05T00:26:39.175Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: [UNKNOWN] Products: python-ecdsa Problem Types: CWE-391 Description: An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14853 - https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3 - https://www.debi
w_bug.cgi?id=CVE-2019-14853 - https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3 - https://www.debian.org/security/2019/dsa-4588 - https://seclists.org/bugtraq/2019/Dec/33
CVE ID: CVE-2019-14854 State: PUBLISHED Published: 2020-01-07T16:36:45 Last Updated: 2024-08-05T00:26:39.141Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: library-go Problem Types: CWE-117 Description: OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14854
CVE ID: CVE-2019-14855 State: PUBLISHED Published: 2020-03-20T00:00:00 Last Updated: 2024-08-05T00:26:39.140Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: gnupg2 Problem Types: CWE-326 Description: A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/4516-1/ - https://rwc.iacr.org/2020/slides/Leurent.pdf - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855 - h
/4516-1/ - https://rwc.iacr.org/2020/slides/Leurent.pdf - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855 - https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html - https://dev.gnupg.org/T4755
CVE ID: CVE-2019-14856 State: PUBLISHED Published: 2019-11-26T13:01:31 Last Updated: 2024-08-05T00:26:39.119Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: [UNKNOWN] Products: ansible Problem Types: CWE-287 Description: ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2020:0756 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14856
CVE ID: CVE-2019-14857 State: PUBLISHED Published: 2019-11-26T11:56:17 Last Updated: 2024-08-05T00:26:39.151Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: [UNKNOWN] Products: mod_auth_openidc Problem Types: CWE-601 Description: A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14857 - https://github.com/zmartzone/mod_auth_openidc/commit/5c15dfb08106c2451c2c44ce7ace6813c216ba75 - https://github.com/zmartzone/mod_auth_openidc/c
tzone/mod_auth_openidc/commit/5c15dfb08106c2451c2c44ce7ace6813c216ba75 - https://github.com/zmartzone/mod_auth_openidc/commit/ce37080c6aea30aabae8b4a9b4eea7808445cc8e - https://github.com/zmartzone/mod_auth_openidc/pull/451 - https://groups.google.com/forum/#%21topic/mod_auth_openidc/boy1Ba3Gdk4 - https://lists.debian.org/debian-lts-announce/2020/07/msg00028.html
CVE ID: CVE-2019-14858 State: PUBLISHED Published: 2019-10-14T14:36:50 Last Updated: 2024-08-05T00:26:39.087Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Ansible Problem Types: CWE-117, CWE-532 Description: A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and pr
a in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14858 - https://access.redhat.com/errata/RHSA-2019:3203 - https://access.redhat.com/errata/RHSA-2019:3202 - https://access.redhat.com/errata/RHSA-2019:3207 - https://access.redhat.com/errata/RHSA-2019:3201 - https://access.redhat.com/errata/RHSA-2020:0756 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.ht
nsuse-security-announce/2020-04/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html
CVE ID: CVE-2019-14859 State: PUBLISHED Published: 2020-01-02T14:15:58 Last Updated: 2024-08-05T00:26:39.127Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: python-ecdsa Problem Types: CWE-347 Description: A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/warner/python-ecdsa/rel
ransactions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14859 - https://pypi.org/project/ecdsa/0.13.3/ - https://github.com/warner/python-ecdsa/issues/114
CVE ID: CVE-2019-14860 State: PUBLISHED Published: 2019-11-08T14:45:52 Last Updated: 2024-08-05T00:26:39.101Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: syndesis Problem Types: CWE-942 Description: It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14860 - https://access.redhat.com/errata/RHSA-2019:3892
CVE ID: CVE-2019-14861 State: PUBLISHED Published: 2019-12-10T22:19:05 Last Updated: 2024-08-05T00:26:39.136Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: samba Problem Types: CWE-276 Description: All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authenticated users. This is used for example to allow machines to self-register in DNS.
low creation of new records by authenticated users. This is used for example to allow machines to self-register in DNS. If a DNS record was created that case-insensitively matched the name of the zone, the ldb_qsort() and dns_name_compare() routines could be confused into reading memory prior to the list of DNS entries when responding to DnssrvEnumRecords() or DnssrvEnumRecords2() and so following invalid memory as a pointer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://usn.ubuntu.com/4217-1/ - https://usn.ubuntu.com/4217-2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PJH3ROOFYMOATD2UE
-2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PJH3ROOFYMOATD2UEPC47P5RPBDTY77E/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNKA4YIPV7AZR7KK3GW6L3HKGHSGJZFE/ - https://security.gentoo.org/glsa/202003-52 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14861 - https://security.netapp.com/advisory/ntap-20191210-0002/ - https://www.samba.org/samba/security/CVE-2019-14861.html - https://www.synology.com/security/advisory/Synology_SA_19_40 - https://lists.debian.org/debian-lts-announce/2021/05/msg00023.ht
/www.synology.com/security/advisory/Synology_SA_19_40 - https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html - http://www.openwall.com/lists/oss-security/2024/06/24/3
CVE ID: CVE-2019-14862 State: PUBLISHED Published: 2020-01-02T14:18:58 Last Updated: 2024-08-05T00:26:39.128Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: knockout Problem Types: CWE-79 Description: There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpujul2020.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14862 - https://snyk.io/vuln/npm:knock
ity-alerts/cpujul2020.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14862 - https://snyk.io/vuln/npm:knockout:20180213 - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2019-14863 State: PUBLISHED Published: 2020-01-02T14:20:50 Last Updated: 2024-08-05T00:26:39.196Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Red Hat Products: angular: Problem Types: CWE-79 Description: There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14863 - https://snyk.io/vuln/npm:angular:20150807
CVE ID: CVE-2019-14864 State: PUBLISHED Published: 2020-01-02T14:23:56 Last Updated: 2024-08-05T00:26:39.116Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Ansible Problem Types: CWE-117, CWE-532 Description: Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864 - https://github.c
es: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864 - https://github.com/ansible/ansible/issues/63522 - https://github.com/ansible/ansible/pull/63527 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html - https://www.debian.org/security/2021/dsa-4950
CVE ID: CVE-2019-14865 State: PUBLISHED Published: 2019-11-29T09:50:12.000Z Last Updated: 2025-02-13T16:27:23.142Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: grub2 Problem Types: CWE-267 Description: A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/oss-sec/2019/q4/101 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14865 - https:/
ences: - https://seclists.org/oss-sec/2019/q4/101 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14865 - https://access.redhat.com/errata/RHSA-2020:0335 - http://www.openwall.com/lists/oss-security/2024/02/06/3
CVE ID: CVE-2019-14866 State: PUBLISHED Published: 2020-01-07T16:53:51.000Z Last Updated: 2025-02-13T16:27:23.692Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: cpio Problem Types: CWE-20 Description: In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system. Additional A
hives from a high-privilege user without carefully reviewing them may lead to the compromise of the system. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14866 - https://lists.gnu.org/archive/html/bug-cpio/2019-08/msg00003.html - https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00000.html - https://lists.debian.org/debian-lts-announce/2023/06/msg00007.html
CVE ID: CVE-2019-14867 State: PUBLISHED Published: 2019-11-27T08:05:17 Last Updated: 2024-08-05T00:26:39.117Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: ipa Problem Types: CWE-94, CWE-400 Description: A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosti
l key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server. Additional Analyst Notes: - CVE Program Container: References: - https://www.freeipa.org/page/Releases/4.7.4 - https://www.freeipa.org/page/Releases/4.8.3 - https://www.freeipa.org/page/Releases/4.6.7 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14867 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLFL5XDCJ3WT6JCLCQVKHZBLHGW7PW4T/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/67SEUWJAJ5RMH5K4Q6TS2I7HIMXUGNKF/ - https://access.redhat.com/errat
t/package-announce%40lists.fedoraproject.org/message/67SEUWJAJ5RMH5K4Q6TS2I7HIMXUGNKF/ - https://access.redhat.com/errata/RHSA-2020:0378 - https://access.redhat.com/errata/RHBA-2019:4268
CVE ID: CVE-2019-14868 State: PUBLISHED Published: 2020-04-02T16:48:57 Last Updated: 2024-08-05T00:26:39.141Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: KornShell Products: ksh Problem Types: CWE-77 Description: In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.r
them to exploit this issue remotely. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14868 - https://github.com/att/ast/commit/c7de8b641266bac7c77942239ac659edfee9ecd2 - https://support.apple.com/kb/HT211170 - http://seclists.org/fulldisclosure/2020/May/53 - https://lists.debian.org/debian-lts-announce/2020/07/msg00015.html
CVE ID: CVE-2019-14869 State: PUBLISHED Published: 2019-11-15T11:55:54 Last Updated: 2024-08-05T00:26:39.155Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Ghostscript Products: ghostscript Problem Types: CWE-648 Description: A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands. Additional Analyst Notes: - CVE Pr
hin the Ghostscript and access files outside of restricted areas or execute commands. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14869 - http://www.openwall.com/lists/oss-security/2019/11/15/1 - https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=485904772c5f - https://bugs.ghostscript.com/show_bug.cgi?id=701841 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IX55AEDERTDFEZAROKZW64MZRPLINEGI/ - https://seclists.org/bugtraq/2019/Nov/27 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HC4REO73BEJOJAU7NHFHJECAU
tps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HC4REO73BEJOJAU7NHFHJECAUAYJUE3H/ - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00049.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00050.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2Q4E3OTDAJRSUCOBTDQO7Y5UTE2FFMLF/ - https://access.redhat.com/errata/RHSA-2020:0222 - http://jvn.jp/en/jp/JVN52486659/index.html
CVE ID: CVE-2019-14870 State: PUBLISHED Published: 2019-12-10T00:00:00 Last Updated: 2024-08-05T00:26:39.129Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: samba Problem Types: CWE-285 Description: All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka n
ets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14870 - https://usn.ubuntu.com/4217-1/ - https://security.netapp.com/advisory/ntap-20191210-0002/ - https://www.samba.org/samba/security/CVE-2019-14870.html - https://usn.ubuntu.com/4217-2/ - https://lists.fedoraproject.org/archives/list/package-announc
ity/CVE-2019-14870.html - https://usn.ubuntu.com/4217-2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PJH3ROOFYMOATD2UEPC47P5RPBDTY77E/ - https://www.synology.com/security/advisory/Synology_SA_19_40 - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNKA4YIPV7AZR7KK3GW6L3HKGHSGJZFE/ - https://security.gentoo.org/glsa/202003-52 - https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html - https://lists.debian.org/debian-lts-announce/2022/11/msg00034.html - https://security.netapp.com/advisory/ntap-20230216-0
ttps://lists.debian.org/debian-lts-announce/2022/11/msg00034.html - https://security.netapp.com/advisory/ntap-20230216-0008/ - https://security.gentoo.org/glsa/202310-06
CVE ID: CVE-2019-14871 State: PUBLISHED Published: 2020-03-18T15:43:25 Last Updated: 2024-08-05T00:26:39.135Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: newlib Problem Types: CWE-476 Description: The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP and other newlib macros in versions prior to 3.3.0, does not check for memory allocation problems when the DEBUG flag is unset (as is the case in production firmware builds). Additional Analyst Notes: - CVE Program Container: References: - https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabiliti
Program Container: References: - https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/
CVE ID: CVE-2019-14872 State: PUBLISHED Published: 2020-03-19T12:35:41 Last Updated: 2024-08-05T00:26:39.139Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: newlib Problem Types: CWE-476 Description: The _dtoa_r function of the newlib libc library, prior to version 3.3.0, performs multiple memory allocations without checking their return value. This could result in NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/