Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-1903 State: PUBLISHED Published: 2020-10-06T17:35:25 Last Updated: 2024-08-04T06:53:59.757Z Vendors: Facebook Products: WhatsApp for iOS, WhatsApp Business for iOS Problem Types: CWE-400 Description: An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulted in an out-of-memory denial of service. This issue would have required the receiver to explicitly open the attachment if it was received from a number not in the receiver's WhatsApp contacts. Additional Analyst Notes: - CVE Program Container: References: - https://www.whatsapp.com/security/advisories/2020/
CVE ID: CVE-2020-1904 State: PUBLISHED Published: 2020-10-06T17:35:26 Last Updated: 2024-08-04T06:54:00.435Z Vendors: Facebook Products: WhatsApp for iOS, WhatsApp Business for iOS Problem Types: CWE-23 Description: A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwriting files when sending specially crafted docx, xlsx, and pptx files as attachments to messages. Additional Analyst Notes: - CVE Program Container: References: - https://www.whatsapp.com/security/advisories/2020/
CVE ID: CVE-2020-1905 State: PUBLISHED Published: 2020-10-06T17:35:26 Last Updated: 2024-08-04T06:53:59.620Z Vendors: Facebook Products: WhatsApp for Android Problem Types: CWE-340 Description: Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have allowed a malicious third party app chosen to open the file to guess the URIs for previously opened attachments until the opener app is terminated. Additional Analyst Notes: - CVE Program Container: References: - https://www.whatsapp.com/security/advisories/2020/
CVE ID: CVE-2020-1906 State: PUBLISHED Published: 2020-10-06T17:35:26 Last Updated: 2024-08-04T06:53:59.903Z Vendors: Facebook Products: WhatsApp for Android, WhatsApp Business for Android Problem Types: CWE-122 Description: A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could have allowed an out-of-bounds write when processing malformed local videos with E-AC-3 audio streams. Additional Analyst Notes: - CVE Program Container: References: - https://www.whatsapp.com/security/advisories/2020/
CVE ID: CVE-2020-1907 State: PUBLISHED Published: 2020-10-06T17:35:27 Last Updated: 2024-08-04T06:53:59.972Z Vendors: Facebook Products: WhatsApp for Android, WhatsApp Business for Android, WhatsApp for iOS, WhatsApp Business for iOS, WhatsApp for Portal Problem Types: CWE-787 Description: A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsApp Business for iOS prior to v2.20.90, and WhatsApp for Portal prior to v173.0.0.29.505 could have allowed arbitrary code execution when parsing the contents of an RTP Extension header. Additional Analyst Notes: - CVE Program Container: References: -
n when parsing the contents of an RTP Extension header. Additional Analyst Notes: - CVE Program Container: References: - https://www.whatsapp.com/security/advisories/2020/
CVE ID: CVE-2020-1908 State: PUBLISHED Published: 2020-11-03T19:15:16 Last Updated: 2024-08-04T06:53:59.916Z Vendors: Facebook Products: WhatsApp Business for iOS, WhatsApp for iOS Problem Types: CWE-285 Description: Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the phone was locked. Additional Analyst Notes: - CVE Program Container: References: - https://www.whatsapp.com/security/advisories/2020/
CVE ID: CVE-2020-1909 State: PUBLISHED Published: 2020-11-03T19:15:17 Last Updated: 2024-08-04T06:53:59.797Z Vendors: Facebook Products: WhatsApp Business for iOS, WhatsApp for iOS Problem Types: CWE-416 Description: A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and potentially code execution. This could have happened only if several events occurred together in sequence, including receiving an animated sticker while placing a WhatsApp video call on hold. Additional Analyst Notes: - CVE Program Container: References: - https://www.whatsapp.com/security/advisories/2
on hold. Additional Analyst Notes: - CVE Program Container: References: - https://www.whatsapp.com/security/advisories/2020/
CVE ID: CVE-2020-1910 State: PUBLISHED Published: 2021-02-02T19:55:13 Last Updated: 2024-08-04T06:53:59.731Z Vendors: WhatsApp Products: WhatsApp Business for Android, WhatsApp for Android Problem Types: CWE-787 Description: A missing bounds check in WhatsApp for Android prior to v2.21.1.13 and WhatsApp Business for Android prior to v2.21.1.13 could have allowed out-of-bounds read and write if a user applied specific image filters to a specially crafted image and sent the resulting image. Additional Analyst Notes: - CVE Program Container: References: - https://www.whatsapp.com/security/advisories/2021/
CVE ID: CVE-2020-1911 State: PUBLISHED Published: 2020-09-04T02:35:20 Last Updated: 2024-08-04T06:53:59.783Z Vendors: Facebook Products: Hermes Problem Types: CWE-843 Description: A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.fa
ct Native applications are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/security/advisories/cve-2020-1911 - https://github.com/facebook/hermes/commit/fe52854cdf6725c2eaa9e125995da76e6ceb27da
CVE ID: CVE-2020-1912 State: PUBLISHED Published: 2020-09-09T18:50:17 Last Updated: 2024-08-04T06:54:00.338Z Vendors: Facebook Products: Hermes Problem Types: CWE-787 Description: An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835377369c8fd5917d9b87acffa721ad2a168 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/security/
ns are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/security/advisories/cve-2020-1912 - https://github.com/facebook/hermes/commit/091835377369c8fd5917d9b87acffa721ad2a168
CVE ID: CVE-2020-1913 State: PUBLISHED Published: 2020-09-09T19:00:19 Last Updated: 2024-08-04T06:53:59.912Z Vendors: Facebook Products: Hermes Problem Types: CWE-195 Description: An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause a denial of service attack or a potential RCE via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/security/advisories/cve-2020-1913
itional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/security/advisories/cve-2020-1913 - https://github.com/facebook/hermes/commit/2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6
CVE ID: CVE-2020-1914 State: PUBLISHED Published: 2020-10-08T18:50:11 Last Updated: 2024-08-04T06:53:59.745Z Vendors: Facebook Products: Hermes Problem Types: CWE-670 Description: A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/se
lications are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/security/advisories/cve-2020-1914 - https://github.com/facebook/hermes/commit/b2021df620824627f5a8c96615edbd1eb7fdddfc
CVE ID: CVE-2020-1915 State: PUBLISHED Published: 2020-10-26T20:20:13 Last Updated: 2024-08-04T06:53:59.849Z Vendors: Facebook Products: Hermes Problem Types: CWE-125 Description: An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/security/advisories/
affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/security/advisories/cve-2020-1915 - https://github.com/facebook/hermes/commit/8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0
CVE ID: CVE-2020-1916 State: PUBLISHED Published: 2021-03-10T15:50:27 Last Updated: 2024-08-04T06:54:00.370Z Vendors: Facebook Products: HHVM Problem Types: CWE-122 Description: An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resulting in an out-of-bounds write. This issue affects HHVM prior to 4.56.2, all versions between 4.57.0 and 4.78.0, 4.79.0, 4.80.0, 4.81.0, 4.82.0, 4.83.0. Additional Analyst Notes: - CVE Program Container: References: - https://hhvm.com/blog/2020/11/12/security-update.html - https://github.com/facebook/hhvm/commit/abe0b29e4d3a610f9bc920b8be4ad8403364c2d4
CVE ID: CVE-2020-1917 State: PUBLISHED Published: 2021-03-10T15:50:28 Last Updated: 2024-08-04T06:53:59.921Z Vendors: Facebook Products: HHVM Problem Types: CWE-122 Description: xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buffer was full, it would result in an out-of-bounds write. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0. Additional Analyst Notes: - CVE Program Container: References: - https://hhvm.com/b
4.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0. Additional Analyst Notes: - CVE Program Container: References: - https://hhvm.com/blog/2021/02/25/security-update.html - https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca
CVE ID: CVE-2020-1918 State: PUBLISHED Published: 2021-03-10T15:50:28 Last Updated: 2024-08-04T06:53:59.798Z Vendors: Facebook Products: HHVM Problem Types: CWE-127 Description: In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0. Additional Analyst Notes: - CVE Program Container: References: - https://hhvm.com/blog/2021/02/25/security-update.html - https://github.com/facebook/hhvm/commit/08193b7f0c
References: - https://hhvm.com/blog/2021/02/25/security-update.html - https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca
CVE ID: CVE-2020-1919 State: PUBLISHED Published: 2021-03-10T15:50:29 Last Updated: 2024-08-04T06:53:59.858Z Vendors: Facebook Products: HHVM Problem Types: CWE-125 Description: Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than the first. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0. Additional Analyst Notes: - CVE Program Container: References: - https://hhvm.com/blog/2021/02/25/security-update.html - https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f
tps://hhvm.com/blog/2021/02/25/security-update.html - https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca
CVE ID: CVE-2020-1920 State: PUBLISHED Published: 2021-06-01T11:45:12 Last Updated: 2024-08-04T06:54:00.363Z Vendors: Facebook Products: react-native Problem Types: CWE-1333 Description: A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/react-native/releases/tag/v0.64.1 - https://github.com/facebook/react-native/commit/ca09ae82715e33c9ac77b3fa55495cf84ba891c7
CVE ID: CVE-2020-1921 State: PUBLISHED Published: 2021-03-10T15:50:30 Last Updated: 2024-08-04T06:54:00.475Z Vendors: Facebook Products: HHVM Problem Types: CWE-121 Description: In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0. Additional Analyst Notes: - CVE Program Container: References: - https://hhvm.com/blog/2021/02/25/security-update.html - https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0
ps://hhvm.com/blog/2021/02/25/security-update.html - https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca
CVE ID: CVE-2020-1925 State: PUBLISHED Published: 2020-01-09T18:41:08 Last Updated: 2024-08-04T06:54:00.059Z Vendors: Apache Software Foundation Products: Apache Olingo Problem Types: Server Side Request Forgery Description: Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker. Additional Analyst Notes: - CVE Program Container: References: - http
which are not directly accessible by the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://mail-archives.apache.org/mod_mbox/olingo-user/202001.mbox/%3CCAGSZ4d6HwpF2woOrZJg_d0SkHytXJaCtAWXa3ZtBn33WG0YFvw%40mail.gmail.com%3E
CVE ID: CVE-2020-1926 State: PUBLISHED Published: 2021-03-16T13:00:16.000Z Last Updated: 2025-02-13T16:27:38.760Z Vendors: Apache Software Foundation Products: Apache Hive Problem Types: CWE-208 Description: Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8 Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/HIVE-22708 - https://lists.apache.org/thread.html/rd186eedff68102ba1e68059a808101c5aa587e11542c7dcd26e7b9d7%40%3Cuser.hive.apache.org%3E
CVE ID: CVE-2020-1927 State: PUBLISHED Published: 2020-04-01T23:08:43 Last Updated: 2024-08-04T06:53:59.905Z Vendors: Apache Products: Apache HTTP Server Problem Types: CWE-601 Description: In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2020/04/03/1 - http://www.openwall.com/lists/oss-security/2020/04/04/1 - https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201%40%3Cdev.h
2020/04/04/1 - https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201%40%3Cdev.httpd.apache.org%3E - https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac%40%3Cdev.httpd.apache.org%3E - https://lists.apache.org/thread.html/r70ba652b79ba224b2cbc0a183078b3a49df783b419903e3dcf4d78c7%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r10b853ea87dd150b0e76fda3f8254dfdb23dd05fa55596405b58478e%40%3Ccvs.httpd.apache.org%3E - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://httpd.apache.org/security/vulnerabiliti
msg00002.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.netapp.com/advisory/ntap-20200413-0002/ - https://usn.ubuntu.com/4458-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/ - https://www.debian.org/security/2020/dsa-4757 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/ - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.htm
49464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.a
org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r731d43caece41d78d8c6304641a02a369fd78300e7ffaf566b06bc59%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r6a4146bf3d1645af2880f8b7a4fd8afd696d5fd4a3ae272f49f5dc84%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - http
de552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-1928 State: PUBLISHED Published: 2020-01-28T00:28:08 Last Updated: 2024-08-04T06:54:00.379Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: Information Disclosure Description: An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present. Additional Analyst Notes: - CVE Program Container: References: - https://nifi.apache.org/security.html#CVE-2020-1928 - https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1%40%3Cusers.tomcat.ap
28 - https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b%40%3Cusers.tomcat.apache.org%3E
CVE ID: CVE-2020-1929 State: PUBLISHED Published: 2020-01-15T18:56:55 Last Updated: 2024-08-04T06:54:00.337Z Vendors: Apache Products: Beam Problem Types: Information Disclosure Description: The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets registered globally which disables trust checking for any code running in the same JVM. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rdd0e85b71bf0274471b40fa1396d77f7b2d1165eaea4becbdc69aa04%40%3
ainer: References: - https://lists.apache.org/thread.html/rdd0e85b71bf0274471b40fa1396d77f7b2d1165eaea4becbdc69aa04%40%3Cuser.beam.apache.org%3E
CVE ID: CVE-2020-1930 State: PUBLISHED Published: 2020-01-30T17:42:38 Last Updated: 2024-08-04T06:54:00.374Z Vendors: Apache Software Foundation Products: Apache SpamAssassin Problem Types: Local & Remote Command Execution Description: A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. With this bug unpatched, exploits can be injected in a number of scenarios including the same privileges as spamd is run which may be elevated though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only
though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places. If you cannot upgrade, do not use 3rd party rulesets, do not use sa-compile and do not run spamd as an account with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7648 - https://lists.apache.org/thread.html/r6729f3d3be754a06c39bb4f11c925a3631e8ea2b4c865546d755cb0a%40%3Cannounce.apache.org%3E - https://www.debian.org/security/2020/dsa-4615 - https://seclists.org/bugtraq/2020/Feb/1 - https://usn.ubuntu.com/4265-1/ - https://
.debian.org/security/2020/dsa-4615 - https://seclists.org/bugtraq/2020/Feb/1 - https://usn.ubuntu.com/4265-1/ - https://usn.ubuntu.com/4265-2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B7SY2LUSH2X3IUXN4EQQ5A6QVUFYIV3D/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOVVKFP2G2AF5GHAB4WMHOEX76A3H6CE/ - https://lists.debian.org/debian-lts-announce/2020/02/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00003.html