Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-18387 State: PUBLISHED Published: 2019-10-23T22:56:29 Last Updated: 2024-08-05T01:54:14.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Hotel and Lodge Management System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the id parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details. Additional Analyst Notes: - CVE Program Container: References: - https://www.sevenlayers.com/index.php/266-hotel-and-lodge-management-system-1-0-sqli
CVE ID: CVE-2019-18388 State: PUBLISHED Published: 2019-12-23T00:00:00 Last Updated: 2024-08-05T01:54:13.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via malformed commands. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/virgl/virglrenderer/commit/0d9a2c88dc3a70023541b3260b9f00c982abda16 - https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=d2cdbcf6a8f2317f250fd54f08aa35dde2fa3e30#diff-content-3cd772559e0d73afa136d6818023cfd0c4c8ecc0 - https://access.redhat.com/sec
f6a8f2317f250fd54f08aa35dde2fa3e30#diff-content-3cd772559e0d73afa136d6818023cfd0c4c8ecc0 - https://access.redhat.com/security/cve/cve-2019-18388 - https://bugzilla.redhat.com/show_bug.cgi?id=1765578 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.html - https://lists.debian.org/debian-lts-announce/2022/12/msg00017.html
CVE ID: CVE-2019-18389 State: PUBLISHED Published: 2019-12-23T00:00:00 Last Updated: 2024-08-05T01:54:14.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service, or QEMU guest-to-host escape and code execution, via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=9c280a28651507e6ef87b17b90d47b6af3a4ab7d - https://gitlab.freedesktop.org/virgl/virglrenderer/commit/c
4/diffs?commit_id=9c280a28651507e6ef87b17b90d47b6af3a4ab7d - https://gitlab.freedesktop.org/virgl/virglrenderer/commit/cbc8d8b75be360236cada63784046688aeb6d921 - https://bugzilla.redhat.com/show_bug.cgi?id=1765577 - https://access.redhat.com/security/cve/cve-2019-18389 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.html - https://lists.debian.org/debian-lts-announce/2022/12/msg00017.html
CVE ID: CVE-2019-18390 State: PUBLISHED Published: 2019-12-23T00:00:00 Last Updated: 2024-08-05T01:54:14.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_BLIT commands. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=d2cdbcf6a8f2317f250fd54f08aa35dde2fa3e30#3cd772559e0d73afa136d6818023cfd0c4c8ecc0_0_151 - https://gitlab.freedesktop.org/virgl/virglrenderer/commit/24f67de7a9088a873844a39be03cee6882260a
023cfd0c4c8ecc0_0_151 - https://gitlab.freedesktop.org/virgl/virglrenderer/commit/24f67de7a9088a873844a39be03cee6882260ac9 - https://access.redhat.com/security/cve/cve-2019-18390 - https://bugzilla.redhat.com/show_bug.cgi?id=1765584 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.html - https://lists.debian.org/debian-lts-announce/2022/12/msg00017.html
CVE ID: CVE-2019-18391 State: PUBLISHED Published: 2019-12-23T00:00:00 Last Updated: 2024-08-05T01:54:14.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=8c9cfb4e425542e96f0717189fe4658555baaf08 - https://gitlab.freedesktop.org/virgl/virglrenderer/commit/2abeb1802e3c005b17a7123e382171b3fb665971 - https://
55baaf08 - https://gitlab.freedesktop.org/virgl/virglrenderer/commit/2abeb1802e3c005b17a7123e382171b3fb665971 - https://bugzilla.redhat.com/show_bug.cgi?id=1765589 - https://access.redhat.com/security/cve/cve-2019-18391 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.html - https://lists.debian.org/debian-lts-announce/2022/12/msg00017.html
CVE ID: CVE-2019-18392 State: REJECTED Published: 2020-08-28T14:38:28 Last Updated: 2020-08-28T14:38:28 Description: No description available.
CVE ID: CVE-2019-18393 State: PUBLISHED Published: 2019-10-24T10:58:18 Last Updated: 2024-08-05T01:54:14.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/igniterealtime/Openfire/pull/1498 - https://swarm.ptsecurity.com/openfire-admin-console/
CVE ID: CVE-2019-18394 State: PUBLISHED Published: 2019-10-24T10:58:34 Last Updated: 2024-08-05T01:54:14.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/igniterealtime/Openfire/pull/1497 - https://swarm.ptsecurity.com/openfire-admin-console/
CVE ID: CVE-2019-18396 State: PUBLISHED Published: 2019-10-31T19:08:27 Last Updated: 2024-08-05T01:54:14.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the Web Interface in OI_Fw_V20 allows remote attackers to execute arbitrary OS commands in the pingAddr parameter to mnt_ping.cgi. NOTE: This may overlap CVE-2017–14127. Additional Analyst Notes: - CVE Program Container: References: - https://www.twitter.com/c4pt41nnn - https://medium.com/%40c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052 - ht
com/c4pt41nnn - https://medium.com/%40c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052 - http://packetstormsecurity.com/files/155296/Technicolor-TD5130.2-Remote-Command-Execution.html
CVE ID: CVE-2019-18397 State: PUBLISHED Published: 2019-11-13T13:55:35 Last Updated: 2024-08-05T01:54:14.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can
uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fribidi/fribidi/commit/034c6e9a1d296286305f4cfd1e0072b879f52568 - https://marc.info/?l=oss-security&m=157322128105807&w=2 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=944327 - https://security-tracker.debian.org/tracker/CVE-2019-18397 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5UJRTG32FDNI7T637Q6PZYL3UCRR5HR/ - https://access.
org/archives/list/package-announce%40lists.fedoraproject.org/message/W5UJRTG32FDNI7T637Q6PZYL3UCRR5HR/ - https://access.redhat.com/errata/RHSA-2019:4326 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFS3N6KKXPI6ATDNEUFRSLX7R6BOBNIP/ - https://access.redhat.com/errata/RHSA-2019:4361 - https://access.redhat.com/errata/RHSA-2020:0291 - https://security.gentoo.org/glsa/202003-41
CVE ID: CVE-2019-18408 State: PUBLISHED Published: 2019-10-24T13:37:39 Last Updated: 2024-08-05T01:54:14.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14689 - https://github.com/libarchive/libarchive/commit/b8592ecba2f9e451e1f5cb7ab6dcee8b8e7b3f60 - https://github.com/libarchive/libarchive/compare/v3.3.3...v3.4.0 - https://lists.debian.org/debian-lts-announce/2019/10/msg0
s://github.com/libarchive/libarchive/compare/v3.3.3...v3.4.0 - https://lists.debian.org/debian-lts-announce/2019/10/msg00034.html - https://usn.ubuntu.com/4169-1/ - https://www.debian.org/security/2019/dsa-4557 - https://seclists.org/bugtraq/2019/Nov/2 - https://support.f5.com/csp/article/K52144175?utm_source=f5support&amp%3Butm_medium=RSS - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00015.html - https://access.redhat.com/errata/RHSA-2020:0246 - https://access.redhat.com/errata/RHSA-2020:0271 - https://access.redhat.com/errata/RHSA-2020:0203 - https://security.gentoo.org/glsa/202003-28 - https:/
/RHSA-2020:0271 - https://access.redhat.com/errata/RHSA-2020:0203 - https://security.gentoo.org/glsa/202003-28 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LZ4VJGTCYEJSDLOEWUUFG6TM4SUPFSY/
CVE ID: CVE-2019-18409 State: PUBLISHED Published: 2019-10-24T13:59:19 Last Updated: 2024-08-05T01:54:14.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used, a local user can insert malicious code into the ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zenspider/ruby_parser-legacy/issues/1
CVE ID: CVE-2019-18411 State: PUBLISHED Published: 2019-11-06T21:48:40 Last Updated: 2024-08-05T01:54:14.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password function and control the system to send the authentication code back to the channel that the attackers own. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/aliceicl/e32fb4a17277c7db9e0256185ac03dae
CVE ID: CVE-2019-18412 State: PUBLISHED Published: 2020-01-15T15:08:04 Last Updated: 2024-08-05T01:54:14.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains IDETalk plugin before version 193.4099.10 allows XXE Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2020/01/24/jetbrains-security-bulletin-q4-2019/
CVE ID: CVE-2019-18413 State: PUBLISHED Published: 2019-10-24T00:00:00 Last Updated: 2024-08-05T01:54:14.412Z Severity: LOW (CVSS 3.7 CVSS:3.1/AC:H/AV:N/A:N/C:N/I:L/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS att
nput validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input. NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/typestack/class-validator/issues/438 - https://github.com/typestack/class-validator#passing-options - https://github.com/typestack/class-validator/issues/438#issuecomment-964728471 - https://github.com/typestack/class-validator/issues/1422#issuecomment-1344635415
CVE ID: CVE-2019-18414 State: PUBLISHED Published: 2019-10-24T17:20:23 Last Updated: 2024-08-05T01:54:14.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code or adding a staff entry via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://www.sevenlayers.com/index.php/263-restaurant-management-system-csrf
CVE ID: CVE-2019-18415 State: PUBLISHED Published: 2019-10-24T17:30:25 Last Updated: 2024-08-05T01:54:14.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen. Additional Analyst Notes: - CVE Program Container: References: - https://www.sevenlayers.com/index.php/264-restaurant-management-system-1-0-xss-session-hijack
CVE ID: CVE-2019-18416 State: PUBLISHED Published: 2019-10-24T17:29:59 Last Updated: 2024-08-05T01:54:14.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member. Additional Analyst Notes: - CVE Program Container: References: - https://www.sevenlayers.com/index.php/264-restaurant-management-system-1-0-xss-session-hijack
CVE ID: CVE-2019-18417 State: PUBLISHED Published: 2019-10-24T17:30:14 Last Updated: 2024-08-05T01:54:14.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can result in code execution. The issue occurs because the application fails to adequately sanitize user-supplied input, e.g., "add a new food" allows .php files. Additional Analyst Notes: - CVE Program Container: References: - https://www.sevenlayers.com/index.php/265-restaurant-management-system-1-0-arbitrary-file-upload
CVE ID: CVE-2019-18418 State: PUBLISHED Published: 2019-10-24T19:01:06 Last Updated: 2024-08-05T01:54:14.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Andhrimnirr/ClonOS-WEB-control-panel-multi-vulnerability - http://packetstormsecurity.com/files/154986/ClonOs-WEB-UI-19.09-Improper-Access-Control.html
CVE ID: CVE-2019-18419 State: PUBLISHED Published: 2019-10-24T19:00:55 Last Updated: 2024-08-05T01:54:14.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via the lang parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Andhrimnirr/ClonOS-WEB-control-panel-multi-vulnerability
CVE ID: CVE-2019-18420 State: PUBLISHED Published: 2019-10-31T13:30:06 Last Updated: 2024-08-05T01:54:14.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function which uses a printf-like format string to interpret its parameters. Error handling for a bad format character was done using BUG(), which crashes Xen. One path, via the VCPUOP_initialise hypercall, has a bad format character. The BUG() can be hit if VCPUOP_initialise executes for a sufficiently long period of time for a continuation
character. The BUG() can be hit if VCPUOP_initialise executes for a sufficiently long period of time for a continuation to be created. Malicious guests may cause a hypervisor crash, resulting in a Denial of Service (DoS). Xen versions 4.6 and newer are vulnerable. Xen versions 4.5 and earlier are not vulnerable. Only x86 PV guests can exploit the vulnerability. HVM and PVH guests, and guests on ARM systems, cannot exploit the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-296.html - http://www.openwall.com/lists/oss-security/2019/10/31/1 - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html - https://
/lists/oss-security/2019/10/31/1 - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BQKX7M2RHCWDBKNPX4KEBI3MJIH6AYZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5WWPW4BSZDDW7VHU427XTVXV7ROOFFW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZYATWNUGHRBG6I3TC24YHP5Y3J7I6KH/ - https://www.debian.org/security/2020/dsa-4602 - https://seclists.org/bugtraq/2020/Jan/21 - https://security.gentoo.org/glsa/202003-56
CVE ID: CVE-2019-18421 State: PUBLISHED Published: 2019-10-31T13:34:00 Last Updated: 2024-08-05T01:54:14.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations. There are issues with restartable PV type change operations. To avoid using shadow pagetables for PV guests, Xen exposes the actual hardware pagetables to the guest. In order to prevent the guest from modifying these page tables directly, Xen keeps track of how pages are used using a type system; pages must be "promoted" before being used as a pag
directly, Xen keeps track of how pages are used using a type system; pages must be "promoted" before being used as a pagetable, and "demoted" before being used for any other type. Xen also allows for "recursive" promotions: i.e., an operating system promoting a page to an L4 pagetable may end up causing pages to be promoted to L3s, which may in turn cause pages to be promoted to L2s, and so on. These operations may take an arbitrarily large amount of time, and so must be re-startable. Unfortunately, making recursive pagetable promotion and demotion operations restartable is incredibly complicated, and the code contains several races which, if triggered, can cause Xen to drop or retain extra
incredibly complicated, and the code contains several races which, if triggered, can cause Xen to drop or retain extra type counts, potentially allowing guests to get write access to in-use pagetables. A malicious PV guest administrator may be able to escalate their privilege to that of the host. All x86 systems with untrusted PV guests are vulnerable. HVM and PVH guests cannot exercise this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-299.html - http://www.openwall.com/lists/oss-security/2019/10/31/3 - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html - https://lists.fedoraproject.org/archives/l
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BQKX7M2RHCWDBKNPX4KEBI3MJIH6AYZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5WWPW4BSZDDW7VHU427XTVXV7ROOFFW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZYATWNUGHRBG6I3TC24YHP5Y3J7I6KH/ - https://www.debian.org/security/2020/dsa-4602 - https://seclists.org/bugtraq/2020/Jan/21 - https://security.gentoo.org/glsa/202003-56
CVE ID: CVE-2019-18422 State: PUBLISHED Published: 2019-10-31T13:35:15 Last Updated: 2024-08-05T01:54:14.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. Interrupts are unconditionally unmasked in exception handlers. When an exception occurs on an ARM system which is handled without changing processor level, some interrupts are unconditionally enabled during exception entry. So exceptions which occur when interrupts are masked will effectively unmask the interrupts. A malicious guest might contrive to arra
which occur when interrupts are masked will effectively unmask the interrupts. A malicious guest might contrive to arrange for critical Xen code to run with interrupts erroneously enabled. This could lead to data corruption, denial of service, or possibly even privilege escalation. However a precise attack technique has not been identified. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-303.html - http://www.openwall.com/lists/oss-security/2019/10/31/5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BQKX7M2RHCWDBKNPX4KEBI3MJIH6AYZ/ - https://lists.fedoraproject.org/archives/list/package
ists.fedoraproject.org/message/2BQKX7M2RHCWDBKNPX4KEBI3MJIH6AYZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5WWPW4BSZDDW7VHU427XTVXV7ROOFFW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZYATWNUGHRBG6I3TC24YHP5Y3J7I6KH/ - https://www.debian.org/security/2020/dsa-4602 - https://seclists.org/bugtraq/2020/Jan/21
CVE ID: CVE-2019-18423 State: PUBLISHED Published: 2019-10-31T13:36:27 Last Updated: 2024-08-05T01:54:14.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_to_physmap hypercall. p2m->max_mapped_gfn is used by the functions p2m_resolve_translation_fault() and p2m_get_entry() to sanity check guest physical frame. The rest of the code in the two functions will assume that there is a valid root table and check that with BUG_ON(). The function p2m_get_root_pointer() will ignore the unused top bits of a guest physical frame. This means that the function p2m_set_entry