Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
https://access.redhat.com/errata/RHSA-2019:1529 - https://kc.mcafee.com/corporate/index?page=content&id=SB10284 - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.debian.org/security/2019/dsa-4596 - https://seclists.org/bugtraq/2019/Dec/43 - https://www.oracle.com/security-alerts/cpujan2020.html - https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9f
da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - http://packetstormsecurity.com/files/163456/Apache-Tomcat-9.0.0M1-Open-Redirect.html
CVE ID: CVE-2018-11785 State: PUBLISHED Published: 2018-10-24T20:00:00Z Last Updated: 2024-09-16T20:06:46.672Z Vendors: Apache Software Foundation Products: Apache Impala Problem Types: Unauthorized access Description: Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a running query, leading to wrong results for a query. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105742 - https://lists.apache.org/thread.html/cba8f18df15af862aa07c584d8dc85c44a199fb8f460edd498059247%40%3Cdev.impala.apache.org%3E
CVE ID: CVE-2018-11786 State: PUBLISHED Published: 2018-09-18T14:00:00Z Last Updated: 2024-09-17T02:12:17.084Z Vendors: Apache Software Foundation Products: Apache Karaf Problem Types: Process Execution Description: In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a bit by using chroot to change the root directory to protect files outside of the Karaf install directory; it can be further locked down by defining a security manager policy that limits
outside of the Karaf install directory; it can be further locked down by defining a security manager policy that limits file system access to those directories beneath the Karaf home that are necessary for the system to run. However, this still allows anyone with ssh access to the Karaf process to read and write a large number of files as the Karaf process user. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/5b7ac762c6bbe77ac5d9389f093fc6dbf196c36d788e3d7629e6c1d9%40%3Cdev.karaf.apache.org%3E - https://issues.apache.org/jira/browse/KARAF-5427 - http://karaf.apache.org/security/cve-2018-11786.txt
CVE ID: CVE-2018-11787 State: PUBLISHED Published: 2018-09-18T14:00:00Z Last Updated: 2024-09-17T02:16:58.807Z Vendors: Apache Software Foundation Products: Apache Karaf Problem Types: Unsecure Access Description: In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web browser, and when navigated to it is available at .../system/console/gogo. Trying to go directly to that URL does require authentication. And optional bundle that some applications use is
/gogo. Trying to go directly to that URL does require authentication. And optional bundle that some applications use is the Pax Web Extender Whiteboard, it is part of the pax-war feature and perhaps others. When it is installed, the Gogo console becomes available at another URL .../gogo/, and that URL is not secured giving access to the Karaf console to unauthenticated users. A mitigation for the issue is to manually stop/uninstall Gogo plugin bundle that is installed with the webconsole feature, although of course this removes the console from the .../system/console application, not only from the unauthenticated endpoint. One could also stop/uninstall the Pax Web Extender Whiteboard, but ot
ation, not only from the unauthenticated endpoint. One could also stop/uninstall the Pax Web Extender Whiteboard, but other components/applications may require it and so their functionality would be reduced/compromised. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/KARAF-4993 - https://lists.apache.org/thread.html/d9ba4c3104ba32225646879a057b75b54430f349c246c85469037d3c%40%3Cdev.karaf.apache.org%3E - http://karaf.apache.org/security/cve-2018-11787.txt
CVE ID: CVE-2018-11788 State: PUBLISHED Published: 2019-01-07T16:00:00 Last Updated: 2024-08-05T08:17:09.240Z Vendors: Apache Software Foundation Products: Apache Karaf Problem Types: XXE vulnerability Description: Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases. Additional Anal
pache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases. Additional Analyst Notes: - CVE Program Container: References: - http://karaf.apache.org/security/cve-2018-11788.txt - http://www.securityfocus.com/bid/106479
CVE ID: CVE-2018-11789 State: PUBLISHED Published: 2019-03-18T14:15:31 Last Updated: 2024-08-05T08:17:09.232Z Vendors: n/a Products: Apache Incubator Heron Problem Types: Information Disclosure Description: When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any file on the host. Example woule be modifying the parameter path= to go to the directory you would like to view. i.e. ..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/5ea1a102d87a47c5912d745fa0d5dfa2830fc94099cbc30911f095b9%40%3Cdev.heron.apache.org%3E - http://www.securityfocus.
d.html/5ea1a102d87a47c5912d745fa0d5dfa2830fc94099cbc30911f095b9%40%3Cdev.heron.apache.org%3E - http://www.securityfocus.com/bid/107430
CVE ID: CVE-2018-11790 State: PUBLISHED Published: 2019-01-31T16:00:00Z Last Updated: 2024-09-16T19:30:22.439Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: Information Disclosure Description: When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this case OpenOffice runs into an Arithmetic Overflow at a string length calculation. Additional Analyst Notes: - CVE Program Container: References: - https://www.openoffice.org/security/cves/CVE-2018-11790.html - https://usn.ubuntu.com/3883-1/ - http://www.securityfocus.com/bid/106803 - https://lists.apache.org/thread
-11790.html - https://usn.ubuntu.com/3883-1/ - http://www.securityfocus.com/bid/106803 - https://lists.apache.org/thread.html/7394e6b5f78a878bd0c44e9bc9adf90b8cdf49e9adc0f287145aba9b%40%3Ccommits.openoffice.apache.org%3E
CVE ID: CVE-2018-11791 State: REJECTED Published: 2019-03-14T22:00:00 Last Updated: 2019-03-14T21:57:01 Description: No description available.
CVE ID: CVE-2018-11792 State: PUBLISHED Published: 2018-10-24T20:00:00Z Last Updated: 2024-09-16T19:52:28.202Z Vendors: Apache Software Foundation Products: Apache Impala Problem Types: Unauthorized access Description: In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. This may pose a potential security risk, such as having ALTER on a table and ALL on a particular database allows a user to move the table to a database with ALL, which will automatically grant that user with ALL privilege on that table due to the privilege inherited from the database. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105739 -
he database. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105739 - https://lists.apache.org/thread.html/cba8f18df15af862aa07c584d8dc85c44a199fb8f460edd498059247%40%3Cdev.impala.apache.org%3E
CVE ID: CVE-2018-11793 State: PUBLISHED Published: 2019-03-05T21:00:00Z Last Updated: 2024-09-16T16:27:53.700Z Vendors: Apache Software Foundation Products: Apache Mesos Problem Types: Denial of Service Description: When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, and 1.7.0 might overflow the stack due to unbounded recursion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107281 - https://lists.apache.org/thre
st Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107281 - https://lists.apache.org/thread.html/9be975c53e5ad612c7e0af39f5b88837fbfbc32108e587d3d8499844%40%3Cdev.mesos.apache.org%3E
CVE ID: CVE-2018-11794 State: REJECTED Published: 2018-12-21T14:00:00 Last Updated: 2018-12-21T13:57:01 Description: No description available.
CVE ID: CVE-2018-11795 State: REJECTED Published: 2018-12-17T21:00:00 Last Updated: 2018-12-17T20:57:01 Description: No description available.
CVE ID: CVE-2018-11796 State: PUBLISHED Published: 2018-10-09T22:00:00Z Last Updated: 2024-09-16T18:19:51.122Z Vendors: Apache Software Foundation Products: Apache Tika Problem Types: Denial of Service Vulnerability Description: In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upg
1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105585 - https://lists.apache.org/thread.html/88de8350cda9b184888ec294c813c5bd8a2081de8fd3666f8904bc05%40%3Cdev.tika.apache.org%3E - https://security.netapp.com/advisory/ntap-20190903-0002/ - https://access.redhat.com/errata/RHSA-2019:3892
CVE ID: CVE-2018-11797 State: PUBLISHED Published: 2018-10-05T20:00:00Z Last Updated: 2024-09-16T16:33:51.092Z Vendors: Apache Software Foundation Products: Apache PDFBox Problem Types: DoS vulnerability Description: In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/645574bc50b886d39c20b4065d51ccb1cd5d3a6b4750a22edbb565eb%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/a9760973a873522f4d4c0a99916ceb74f361d91006b663a0a418d34a%40%3Cannounce.apache.org%3E - https:
sts.apache.org/thread.html/a9760973a873522f4d4c0a99916ceb74f361d91006b663a0a418d34a%40%3Cannounce.apache.org%3E - https://lists.debian.org/debian-lts-announce/2018/10/msg00008.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ/ - https://www.oracle.com/security-alerts/cpuapr2020.html - https://lists.apache.org/thread.html/r54594251369e14c185da9662a5340a52afbbdf75d61c9c3a69c8f2e8%40%3Cdev.pdfbox.apache.org%3E
CVE ID: CVE-2018-11798 State: PUBLISHED Published: 2019-01-07T18:00:00 Last Updated: 2024-08-05T08:17:09.238Z Vendors: Apache Software Foundation Products: Apache Thrift Problem Types: Improper Access Control Description: The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106501 - https://lists.apache.org/thread.html/6e9edd282684896cedf615fb67a02bebfe6007f2d5baf03ba52e34fd%40%3Cuser.thrift.apache.org%3E - https://access
org/thread.html/6e9edd282684896cedf615fb67a02bebfe6007f2d5baf03ba52e34fd%40%3Cuser.thrift.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:1545 - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://access.redhat.com/errata/RHSA-2019:3140
CVE ID: CVE-2018-11799 State: PUBLISHED Published: 2018-12-19T20:00:00 Last Updated: 2024-08-05T08:17:09.230Z Vendors: Apache Software Foundation Products: Apache Oozie Problem Types: Gain Privileges Description: Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users. The malicious user can construct an XML that results workflows running in other user's name. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/347e7a8cb86014b7ca37e49eb00b8d088203bdc0bcfb4799f8e5955a%40%3Cuser.oozie.apache.org%3E - http://www.securityfocus.com/bid/106266
CVE ID: CVE-2018-11800 State: PUBLISHED Published: 2019-06-11T16:42:05 Last Updated: 2024-08-05T08:17:09.177Z Vendors: Apache Products: Apache Fineract Problem Types: SQL Injection Description: SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on the GroupSummaryCounts related table. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/32aa471180f8978b5f0ed64fcd862769f73c40bbe6cb948abdc899bf%40%3Cdev.fineract.apache.org%3E - http://www.openwall.com/lists/oss-security/2019/05/09/1 - http://www.securityfocus.com/bid/108291
CVE ID: CVE-2018-11801 State: PUBLISHED Published: 2019-06-11T16:43:28 Last Updated: 2024-08-05T08:17:09.271Z Vendors: Apache Products: Apache Fineract Problem Types: SQL Injection Description: SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on a m_center data related table. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/32aa471180f8978b5f0ed64fcd862769f73c40bbe6cb948abdc899bf%40%3Cdev.fineract.apache.org%3E - http://www.openwall.com/lists/oss-security/2019/05/09/1 - http://www.securityfocus.com/bid/108291
CVE ID: CVE-2018-11802 State: PUBLISHED Published: 2020-04-01T21:11:38 Last Updated: 2024-08-05T08:17:09.126Z Vendors: Apache Products: Apache Solr Problem Types: Authorization bypass Description: In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin). Additional Analyst Notes: - CVE Program
use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin). Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2019/04/24/1
CVE ID: CVE-2018-11803 State: PUBLISHED Published: 2019-02-05T17:00:00Z Last Updated: 2024-09-17T01:56:52.279Z Vendors: Apache Software Foundation Products: Apache Subversion Problem Types: Access of Uninitialized Pointer Description: Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if the client omits the root path in a recursive directory listing operation. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3869-1/ - https://lists.apache.org/thread.html/fa71074862373c142d264534385f8ea5d8d6b80d27f36f3c46f55003%40%3Cdev.subversion.apache.org%3E - http://www.securityfo
.html/fa71074862373c142d264534385f8ea5d8d6b80d27f36f3c46f55003%40%3Cdev.subversion.apache.org%3E - http://www.securityfocus.com/bid/106770 - https://security.gentoo.org/glsa/201904-08
CVE ID: CVE-2018-11804 State: PUBLISHED Published: 2018-10-24T00:00:00 Last Updated: 2024-08-05T08:17:09.224Z Vendors: Apache Software Foundation Products: Apache Spark Problem Types: Information Disclosure Description: Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the developer account running the build. Note that this issue does not affect end use
l information in files readable to the developer account running the build. Note that this issue does not affect end users of Spark, only developers building Spark from source code. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/2b11aa4201e36f2ec8f728e722fe33758410f07784379cbefd0bda9d%40%3Cdev.spark.apache.org%3E - https://spark.apache.org/security.html#CVE-2018-11804 - http://www.securityfocus.com/bid/105756
CVE ID: CVE-2018-11805 State: PUBLISHED Published: 2019-12-12T22:11:05 Last Updated: 2024-08-05T08:17:09.279Z Vendors: Apache Products: Apache SpamAssassin Problem Types: Remote Code Execution Description: In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/6f89f82a573ea616dce53ec67e52d963618a9f9ac71da5c1efdbd166%40%3Cuse
er: References: - https://lists.apache.org/thread.html/6f89f82a573ea616dce53ec67e52d963618a9f9ac71da5c1efdbd166%40%3Cusers.spamassassin.apache.org%3E - https://lists.apache.org/thread.html/d015dc5b4f24fd6777a85d068502a9c5d58d69d877ed5b0eb9a22cd5%40%3Cdev.spamassassin.apache.org%3E - https://lists.apache.org/thread.html/2946b38caec47f7f6a79e8e03d2aa723794186e59a7dc6b5e76dfc18%40%3Cannounce.spamassassin.apache.org%3E - http://www.openwall.com/lists/oss-security/2019/12/12/1 - https://lists.apache.org/thread.html/bc58907171c6585e5875a3ce86066d4956c218911cb74e3156de4433%40%3Cannounce.apache.org%3E - https://seclists.org/oss-sec/2019/q4/154 - https://svn.apache.org/repos/asf/spamassassin/branches
nounce.apache.org%3E - https://seclists.org/oss-sec/2019/q4/154 - https://svn.apache.org/repos/asf/spamassassin/branches/3.4/build/announcements/3.4.3.txt - https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7647 - https://www.debian.org/security/2019/dsa-4584 - https://seclists.org/bugtraq/2019/Dec/27 - https://lists.debian.org/debian-lts-announce/2019/12/msg00019.html - https://lists.apache.org/thread.html/c1f59b7e13b7f2c12f847f7d0dec2636df3cdbcaa6d8309007395ff4%40%3Cusers.spamassassin.apache.org%3E - https://lists.apache.org/thread.html/8534b60bae95ac3a8a4adb840f4ab26135f1c973ce197ff44439cbae%40%3Cusers.spamassassin.apache.org%3E - https://lists.apache.org/thread.html/0b5c73809d0690527341
f1c973ce197ff44439cbae%40%3Cusers.spamassassin.apache.org%3E - https://lists.apache.org/thread.html/0b5c73809d0690527341d940029f743807b70550050fd23ee869c5e5%40%3Cusers.spamassassin.apache.org%3E - https://usn.ubuntu.com/4237-1/ - https://usn.ubuntu.com/4237-2/ - https://lists.apache.org/thread.html/rc4df9835fb2d7b5bb1202fca99a1de21a40acef055661d3a9e8ae781%40%3Cdev.spamassassin.apache.org%3E - https://lists.apache.org/thread.html/r217177f7de36deab36dab88db4b6448961122571176dd4b2c133d08e%40%3Cannounce.spamassassin.apache.org%3E - https://lists.apache.org/thread.html/rc4df9835fb2d7b5bb1202fca99a1de21a40acef055661d3a9e8ae781%40%3Cusers.spamassassin.apache.org%3E - https://lists.apache.org/thread
fb2d7b5bb1202fca99a1de21a40acef055661d3a9e8ae781%40%3Cusers.spamassassin.apache.org%3E - https://lists.apache.org/thread.html/r6729f3d3be754a06c39bb4f11c925a3631e8ea2b4c865546d755cb0a%40%3Cusers.spamassassin.apache.org%3E - https://lists.apache.org/thread.html/r71f789fcd6339144e3d4db8f4128def12c341e638bd0107a0b82a05b%40%3Cannounce.spamassassin.apache.org%3E - https://lists.apache.org/thread.html/rc4df9835fb2d7b5bb1202fca99a1de21a40acef055661d3a9e8ae781%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r6729f3d3be754a06c39bb4f11c925a3631e8ea2b4c865546d755cb0a%40%3Cdev.spamassassin.apache.org%3E - http://www.openwall.com/lists/oss-security/2020/01/30/3 - http://www.openwall.co
a%40%3Cdev.spamassassin.apache.org%3E - http://www.openwall.com/lists/oss-security/2020/01/30/3 - http://www.openwall.com/lists/oss-security/2020/01/30/2 - https://lists.apache.org/thread.html/r2578c486552637bfedbe624940cc60d6463bd90044c887bdebb75e74%40%3Cusers.spamassassin.apache.org%3E - https://lists.apache.org/thread.html/r6729f3d3be754a06c39bb4f11c925a3631e8ea2b4c865546d755cb0a%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r3d32ebf97b1245b8237763444e911c4595d2ad5e34a1641840d8146f%40%3Cusers.spamassassin.apache.org%3E - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00003.html
CVE ID: CVE-2018-11806 State: PUBLISHED Published: 2018-06-13T16:00:00 Last Updated: 2024-08-05T08:17:09.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2762 - http://www.securityfocus.com/bid/104400 - https://usn.ubuntu.com/3826-1/ - https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg01012.html - http://www.openwall.com/lists/oss-security/2018/06/07/1 - https://bugzilla.redhat.com/show_bug.cgi?id=1586245 - https://www.zerodayinitiative.com/advisories/ZDI-18-567/ - ht
/1 - https://bugzilla.redhat.com/show_bug.cgi?id=1586245 - https://www.zerodayinitiative.com/advisories/ZDI-18-567/ - https://access.redhat.com/errata/RHSA-2018:2462 - https://access.redhat.com/errata/RHSA-2018:2822 - https://access.redhat.com/errata/RHSA-2018:2887 - https://lists.debian.org/debian-lts-announce/2019/05/msg00010.html - https://www.debian.org/security/2019/dsa-4454 - https://seclists.org/bugtraq/2019/May/76 - https://access.redhat.com/errata/RHSA-2019:2892