Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-5031 State: PUBLISHED Published: 2019-10-02T15:55:15 Last Updated: 2024-08-04T19:40:49.213Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Foxit Problem Types: CWE-703 Description: An exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.4.1.16828. A specially crafted PDF document can trigger an out-of-memory condition which isn't handled properly, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also tri
s file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0793
CVE ID: CVE-2019-5032 State: PUBLISHED Published: 2019-08-21T17:02:05 Last Updated: 2024-08-04T19:40:49.304Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Aspose Problem Types: CWE-125 Description: An exploitable out-of-bounds read vulnerability exists in the LabelSst record parser of Aspose Aspose.Cells 19.1.0 library. A specially crafted XLS file can cause an out-of-bounds read, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0794
CVE ID: CVE-2019-5033 State: PUBLISHED Published: 2019-08-21T17:01:48 Last Updated: 2024-08-04T19:40:48.967Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Aspose Problem Types: CWE-125 Description: An exploitable out-of-bounds read vulnerability exists in the Number record parser of Aspose Aspose.Cells 19.1.0 library. A specially crafted XLS file can cause an out-of-bounds read, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0795
CVE ID: CVE-2019-5034 State: PUBLISHED Published: 2019-08-20T21:07:10 Last Updated: 2024-08-04T19:40:49.198Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Nest Labs Problem Types: CWE-125 Description: An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002. A set of specially crafted weave packets can cause an out of bounds read, resulting in information disclosure. An attacker can send packets to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0797
CVE ID: CVE-2019-5035 State: PUBLISHED Published: 2019-08-20T21:07:51 Last Updated: 2024-08-04T19:40:49.376Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Nest Labs Problem Types: CWE-307 Description: An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of specially crafted weave packets can brute force a pairing code, resulting in greater Weave access and potentially full device control. An attacker can send specially crafted packets to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintell
kets to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0798
CVE ID: CVE-2019-5036 State: PUBLISHED Published: 2019-08-20T21:08:40 Last Updated: 2024-08-04T19:40:49.272Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Nest Labs Problem Types: CWE-284 Description: An exploitable denial-of-service vulnerability exists in the Weave error reporting functionality of the Nest Cam IQ Indoor, version 4620002. A specially crafted weave packets can cause an arbitrary Weave Exchange Session to close, resulting in a denial of service. An attacker can send a specially crafted packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerabilit
lnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0799
CVE ID: CVE-2019-5037 State: PUBLISHED Published: 2019-08-20T20:39:57 Last Updated: 2024-08-04T19:40:49.265Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Nest Labs Problem Types: CWE-190 Description: An exploitable denial-of-service vulnerability exists in the Weave certificate loading functionality of Nest Cam IQ Indoor camera, version 4620002. A specially crafted weave packet can cause an integer overflow and an out-of-bounds read on unmapped memory to occur, resulting in a denial of service. An attacker can send a specially crafted packet to trigger. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.
y crafted packet to trigger. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0800
CVE ID: CVE-2019-5038 State: PUBLISHED Published: 2019-08-20T20:39:27 Last Updated: 2024-08-04T19:40:49.275Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Nest Labs Problem Types: CWE-121 Description: An exploitable command execution vulnerability exists in the print-tlv command of Weave tool. A specially crafted weave TLV can trigger a stack-based buffer overflow, resulting in code execution. An attacker can trigger this vulnerability by convincing the user to open a specially crafted Weave command. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0801
CVE ID: CVE-2019-5039 State: PUBLISHED Published: 2019-08-20T20:39:41 Last Updated: 2024-08-04T19:40:49.152Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Nest Labs Problem Types: CWE-122 Description: An exploitable command execution vulnerability exists in the ASN1 certificate writing functionality of Openweave-core version 4.0.2. A specially crafted weave certificate can trigger a heap-based buffer overflow, resulting in code execution. An attacker can craft a weave certificate to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0802
CVE ID: CVE-2019-5040 State: PUBLISHED Published: 2019-08-20T20:42:39 Last Updated: 2024-08-04T19:40:49.003Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: n/a Products: Nest Labs Problem Types: CWE-190 Description: An exploitable information disclosure vulnerability exists in the Weave MessageLayer parsing of Openweave-core version 4.0.2 and Nest Cam IQ Indoor version 4620002. A specially crafted weave packet can cause an integer overflow to occur, resulting in PacketBuffer data reuse. An attacker can send a packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_repor
lity. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0803
CVE ID: CVE-2019-5041 State: PUBLISHED Published: 2019-08-21T17:01:58 Last Updated: 2024-08-04T19:47:55.650Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Aspose Problem Types: CWE-121 Description: An exploitable Stack Based Buffer Overflow vulnerability exists in the EnumMetaInfo function of Aspose Aspose.Words library, version 18.11.0.0. A specially crafted doc file can cause a stack-based buffer overflow, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.talosintelligence.com/vulnerabil
erability. Additional Analyst Notes: - CVE Program Container: References: - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0805
CVE ID: CVE-2019-5042 State: PUBLISHED Published: 2019-09-18T20:41:35 Last Updated: 2024-08-04T19:47:55.846Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Talos Products: Aspose.PDF for C++ Problem Types: CWE-416 Description: An exploitable Use-After-Free vulnerability exists in the way FunctionType 0 PDF elements are processed in Aspose.PDF 19.2 for C++. A specially crafted PDF can cause a dangling heap pointer, resulting in a use-after-free. An attacker can send a malicious PDF to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0809
CVE ID: CVE-2019-5043 State: PUBLISHED Published: 2019-10-31T20:02:30 Last Updated: 2024-08-04T19:47:55.624Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Nest Labs Problem Types: CWE-400 Description: An exploitable denial-of-service vulnerability exists in the Weave daemon of the Nest Cam IQ Indoor, version 4620002. A set of TCP connections can cause unrestricted resource allocation, resulting in a denial of service. An attacker can connect multiple times to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0810
CVE ID: CVE-2019-5044 State: REJECTED Published: 2019-07-09T18:25:00 Last Updated: 2019-07-09T18:25:00 Description: No description available.
CVE ID: CVE-2019-5045 State: PUBLISHED Published: 2019-10-09T20:40:20 Last Updated: 2024-08-04T19:47:55.929Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: NitroPDF Problem Types: CWE-122 Description: A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0814
CVE ID: CVE-2019-5046 State: PUBLISHED Published: 2019-10-09T20:55:39 Last Updated: 2024-08-04T19:47:55.678Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: NitroPDF Problem Types: CWE-122 Description: A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0815
CVE ID: CVE-2019-5047 State: PUBLISHED Published: 2019-10-09T20:40:10 Last Updated: 2024-08-04T19:47:55.839Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: NitroPDF Problem Types: CWE-416 Description: An exploitable Use After Free vulnerability exists in the CharProcs parsing functionality of NitroPDF. A specially crafted PDF can cause a type confusion, resulting in a Use After Free. An attacker can craft a malicious PDF to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0816
CVE ID: CVE-2019-5048 State: PUBLISHED Published: 2019-10-09T20:55:39 Last Updated: 2024-08-04T19:47:55.878Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: NitroPDF Problem Types: CWE-122 Description: A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0817
CVE ID: CVE-2019-5049 State: PUBLISHED Published: 2019-10-31T19:54:48 Last Updated: 2024-08-04T19:47:56.577Z Vendors: n/a Products: AMD ATI Problem Types: Out-of-bounds-write Description: An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002. A specially crafted pixel shader can cause an out-of-bounds memory write. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0818
CVE ID: CVE-2019-5050 State: PUBLISHED Published: 2019-10-09T20:55:39 Last Updated: 2024-08-04T19:47:56.649Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: NitroPDF Problem Types: CWE-122 Description: A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0819
CVE ID: CVE-2019-5051 State: PUBLISHED Published: 2019-07-03T18:43:48 Last Updated: 2024-08-04T19:47:55.830Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Simple DirectMedia Problem Types: CWE-390 Description: An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html - http://lists.opensuse
gram Container: References: - https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html - https://usn.ubuntu.com/4238-1/ - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820
CVE ID: CVE-2019-5052 State: PUBLISHED Published: 2019-07-03T18:43:07 Last Updated: 2024-08-04T19:47:55.665Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Simple DirectMedia Problem Types: CWE-190 Description: An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an integer overflow, resulting in too little memory being allocated, which can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.or
to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/07/msg00021.html - https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html - https://usn.ubuntu.com/4238-1/ - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0821
CVE ID: CVE-2019-5053 State: PUBLISHED Published: 2019-10-09T20:40:02 Last Updated: 2024-08-04T19:47:55.644Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: NitroPDF Problem Types: CWE-416 Description: An exploitable use-after-free vulnerability exists in the Length parsing function of NitroPDF. A specially crafted PDF can cause a type confusion, resulting in a use-after-free condition. An attacker can craft a malicious PDF to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0830
CVE ID: CVE-2019-5054 State: PUBLISHED Published: 2019-09-11T21:09:39 Last Updated: 2024-08-04T19:47:55.638Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Netgear Products: N300 WNR2000v5 Problem Types: CWE-476 Description: An exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70) HTTP server. An HTTP request with an empty User-Agent string sent to a page requiring authentication can cause a null pointer dereference, resulting in the HTTP service crashing. An unauthenticated attacker can send a specially crafted HTTP request to trigger this vulnerability. Additi
ce crashing. An unauthenticated attacker can send a specially crafted HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0831
CVE ID: CVE-2019-5055 State: PUBLISHED Published: 2019-09-11T21:10:22 Last Updated: 2024-08-04T19:47:55.825Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Netgear Products: N300 WNR2000v5 Problem Types: CWE-476 Description: An exploitable denial-of-service vulnerability exists in the Host Access Point Daemon (hostapd) on the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70) wireless router. A SOAP request sent in an invalid sequence to the <WFAWLANConfig:1#PutMessage> service can cause a null pointer dereference, resulting in the hostapd service crashing. An unauthenticated attacker can send a specially-crafted SOAP request to trigger this vulnerabili
tapd service crashing. An unauthenticated attacker can send a specially-crafted SOAP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0832
CVE ID: CVE-2019-5057 State: PUBLISHED Published: 2019-07-31T16:48:35 Last Updated: 2024-08-04T19:47:55.950Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: SDL Problem Types: CWE-122 Description: An exploitable code execution vulnerability exists in the PCX image-rendering functionality of SDL2_image 2.0.4. A specially crafted PCX image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html - http://lists.opensuse.org/opensuse-
nces: - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0841
CVE ID: CVE-2019-5058 State: PUBLISHED Published: 2019-07-31T16:49:27 Last Updated: 2024-08-04T19:47:56.663Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: SDL Problem Types: CWE-122 Description: An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html - http://lists.opensuse.org/opensuse-
nces: - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0842
CVE ID: CVE-2019-5059 State: PUBLISHED Published: 2019-07-31T16:50:45 Last Updated: 2024-08-04T19:47:55.936Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: SDL Problem Types: CWE-190 Description: An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow, allocating too small of a buffer. This buffer can then be written out of bounds resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: Refe
display a specially crafted image to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0843
CVE ID: CVE-2019-5060 State: PUBLISHED Published: 2019-07-31T16:51:28 Last Updated: 2024-08-04T19:47:55.654Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: SDL Problem Types: CWE-190 Description: An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this vulnerability. Additional Analyst Notes: - CVE P
tion. An attacker can display a specially crafted image to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0844