Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-15862 State: PUBLISHED Published: 2020-08-19T00:00:00 Last Updated: 2024-08-04T13:30:22.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root. Additional Analyst Notes: - CVE Program Container: References: - https://salsa.debian.org/debian/net-snmp/-/commit/fad8725402752746daf0a751dcff19eb6aeab52e - https://github.com/net-snmp/net-snmp/commit/77f6c60f57dba0aaea5d8ef1dd94bcd0c8e6d205 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965166 - https://security-tracker.debian.org/tracker/CVE-2020-15862 - https://sec
s.debian.org/cgi-bin/bugreport.cgi?bug=965166 - https://security-tracker.debian.org/tracker/CVE-2020-15862 - https://security.gentoo.org/glsa/202008-12 - https://usn.ubuntu.com/4471-1/ - https://security.netapp.com/advisory/ntap-20200904-0001/
CVE ID: CVE-2020-15863 State: PUBLISHED Published: 2020-07-28T15:40:29 Last Updated: 2024-08-04T13:30:22.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential privileged code execution. This was fixed in commit 5519724a13664b43e225ca05351c60b4468e4555. Additional Analyst Notes: - CVE Program Container: References: - https://lists.nongnu.org/archive/html/qemu-devel/202
5. Additional Analyst Notes: - CVE Program Container: References: - https://lists.nongnu.org/archive/html/qemu-devel/2020-07/msg03497.html - http://www.openwall.com/lists/oss-security/2020/07/22/1 - https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=5519724a13664b43e225ca05351c60b4468e4555 - https://lists.nongnu.org/archive/html/qemu-devel/2020-07/msg05745.html - https://usn.ubuntu.com/4467-1/ - https://www.debian.org/security/2020/dsa-4760 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00024.html - https://security.gentoo.org/glsa/202208-27
CVE ID: CVE-2020-15864 State: PUBLISHED Published: 2021-01-17T19:42:49 Last Updated: 2024-08-04T13:30:23.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Quali CloudShell 9.3. An XSS vulnerability in the login page allows an attacker to craft a URL, with a constructor.constructor substring in the username field, that executes a payload when the user visits the /Account/Login page. Additional Analyst Notes: - CVE Program Container: References: - https://www.quali.com/products/cloudshell-pro/ - https://burninatorsec.blogspot.com/2020/10/cve-2020-xxxxx-xss-in-quali-cloudshell.html
CVE ID: CVE-2020-15865 State: PUBLISHED Published: 2020-08-18T20:02:51 Last Updated: 2024-08-04T13:30:23.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution vulnerability in Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0 allows an attacker to encode C# scripts as base-64 in the report XML file so that they will be compiled and executed on the server that processes this file. This can be used to fully compromise the server. Additional Analyst Notes: - CVE Program Container: References: - http://burninatorsec.blogspot.com/2018/11/reporting-c-serialization-remote-code.html
CVE ID: CVE-2020-15866 State: PUBLISHED Published: 2020-07-21T14:54:09 Last Updated: 2024-08-04T13:30:22.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: mruby through 2.1.2-rc has a heap-based buffer overflow in the mrb_yield_with_class function in vm.c because of incorrect VM stack handling. It can be triggered via the stack_copy function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mruby/mruby/issues/5042 - https://lists.debian.org/debian-lts-announce/2022/05/msg00006.html
CVE ID: CVE-2020-15867 State: PUBLISHED Published: 2020-10-16T13:04:43 Last Updated: 2024-08-04T13:30:22.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in the UI, it could be considered a "Product UI does not Warn User of Unsafe Actions" issue. Additional Analyst Notes: - CVE Program Container: References: - https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-git
- CVE Program Container: References: - https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1125-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/ - http://packetstormsecurity.com/files/162123/Gogs-Git-Hooks-Remote-Code-Execution.html
CVE ID: CVE-2020-15868 State: PUBLISHED Published: 2020-08-12T21:20:40 Last Updated: 2024-08-04T13:30:23.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://support.sonatype.com/hc/en-us/articles/360052192533
CVE ID: CVE-2020-15869 State: PUBLISHED Published: 2020-07-31T19:49:18 Last Updated: 2024-08-04T13:30:22.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2). Additional Analyst Notes: - CVE Program Container: References: - https://support.sonatype.com - https://support.sonatype.com/hc/en-us/articles/360051424554
CVE ID: CVE-2020-15870 State: PUBLISHED Published: 2020-07-31T19:42:33 Last Updated: 2024-08-04T13:30:23.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2). Additional Analyst Notes: - CVE Program Container: References: - https://support.sonatype.com - https://support.sonatype.com/hc/en-us/articles/360051424754
CVE ID: CVE-2020-15871 State: PUBLISHED Published: 2020-07-31T19:59:01 Last Updated: 2024-08-04T13:30:23.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.sonatype.com - https://support.sonatype.com/hc/en-us/articles/360052192693
CVE ID: CVE-2020-15873 State: PUBLISHED Published: 2020-07-21T16:03:45 Last Updated: 2024-08-04T13:30:23.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php device_id POST parameter to ajax_form.php. Additional Analyst Notes: - CVE Program Container: References: - https://research.loginsoft.com/bugs/blind-sql-injection-in-librenms/ - https://community.librenms.org/c/announcements - https://github.com/librenms/librenms/compare/1.65...1.65.1 - https://github.com/librenms/librenms/pull/11923 - https://github.com/librenms/librenms/commit/8f3a29cde5bbd8608f9b42923a7d7e2598bcac4e
CVE ID: CVE-2020-15877 State: PUBLISHED Published: 2020-07-21T17:00:16 Last Updated: 2024-08-04T13:30:23.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" instead of "'middleware' => ['can:admin']" in routes/web.php. Additional Analyst Notes: - CVE Program Container: References: - https://community.librenms.org/c/announcements - https://github.com/librenms/librenms/compare/1.65...1.65.1 - https://github.com/librenms/librenms/releases/tag/1.65.1 - https://shielder.it/blog - https://github.com/librenms/librenms/pull/11915 - https://github.com/libr
leases/tag/1.65.1 - https://shielder.it/blog - https://github.com/librenms/librenms/pull/11915 - https://github.com/librenms/librenms/commit/e5bb6d80bc308fc56b9a01ffb76c34159995353c
CVE ID: CVE-2020-15879 State: PUBLISHED Published: 2020-07-21T16:59:13 Last Updated: 2024-08-04T13:30:22.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bitwarden/server/pull/827
CVE ID: CVE-2020-15881 State: PUBLISHED Published: 2020-07-23T13:49:17 Last Updated: 2024-08-04T13:30:23.001Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability in the munki_facts (aka Munki Conditions) module before 1.5 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the key name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/munkireport/munki_facts/releases - https://github.com/munkireport/munkireport-php - https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3 - https://github.com/munkireport/munkireport-php/wiki/20200722-munki_facts-XSS
CVE ID: CVE-2020-15882 State: PUBLISHED Published: 2020-07-23T13:48:23 Last Updated: 2024-08-04T13:30:23.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF issue in manager/delete_machine/{id} in MunkiReport before 5.6.3 allows attackers to delete arbitrary machines from the MunkiReport database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/munkireport/munkireport-php/releases - https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3 - https://github.com/munkireport/munkireport-php/wiki/20200722-CSRF-Bypass-On-Endpoints-With-No-Body-Parameters
CVE ID: CVE-2020-15883 State: PUBLISHED Published: 2020-07-23T13:42:39 Last Updated: 2024-08-04T13:30:22.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reported). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/munkireport/munkireport-php - https://github.com/munkireport/managedinstalls/releases/tag/v2.6 - https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3 - https://github.com
agedinstalls/releases/tag/v2.6 - https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3 - https://github.com/munkireport/munkireport-php/wiki/20200722-Reflected-XSS-In-Managedinstalls-Module
CVE ID: CVE-2020-15884 State: PUBLISHED Published: 2020-07-23T13:41:43 Last Updated: 2024-08-04T13:30:23.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order[0][dir] field on POST requests to /datatables/data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/munkireport/munkireport-php/releases - https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3 - https://github.com/munkireport/munkireport-php/wiki/20200722-SQL-Injection-In-Datatables-Order-By-In-Post-Body
CVE ID: CVE-2020-15885 State: PUBLISHED Published: 2020-07-23T13:39:59 Last Updated: 2024-08-04T13:30:22.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web script or HTML by posting a new comment. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/munkireport/munkireport-php - https://github.com/munkireport/comment/releases - https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3 - https://github.com/munkireport/munkireport-php/wiki/20200722--XSS-Filter-Bypass-On-Comments
CVE ID: CVE-2020-15886 State: PUBLISHED Published: 2020-07-23T13:37:58 Last Updated: 2024-08-04T13:30:22.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in reportdata_controller.php in the reportdata module before 3.5 for MunkiReport allows attackers to execute arbitrary SQL commands via the req parameter of the /module/reportdata/ip endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/munkireport/munkireport-php/releases - https://github.com/munkireport/reportdata/releases - https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3 - https://github.com/munkireport/munkireport-php/wiki/20200722-SQ
ub.com/munkireport/munkireport-php/releases/tag/v5.6.3 - https://github.com/munkireport/munkireport-php/wiki/20200722-SQL-Injection-In-Reportdata-Ip-In-%27req%27-GET-Parameter
CVE ID: CVE-2020-15887 State: PUBLISHED Published: 2020-07-23T13:36:34 Last Updated: 2024-08-04T13:30:22.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/get_tab_data/ endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/munkireport/munkireport-php/releases - https://github.com/munkireport/softwareupdate/releases - https://github.com/munkireport/munkireport-php/wiki/20200722-SQL-Injection-in-softwareupdate-module
areupdate/releases - https://github.com/munkireport/munkireport-php/wiki/20200722-SQL-Injection-in-softwareupdate-module - https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3
CVE ID: CVE-2020-15888 State: PUBLISHED Published: 2020-07-21T21:36:02 Last Updated: 2024-08-04T13:30:23.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lua/lua/commit/eb41999461b6f428186c55abd95f4ce1a76217d5 - https://github.com/lua/lua/commit/6298903e35217ab69c279056f925fb72900ce0b7 - http://lua-users.org/lists/lua-l/2020-07/msg00053.html - http://lua-users.org/lists/lua-l/2020-07/msg00054.html - http://lua-users.o
sers.org/lists/lua-l/2020-07/msg00053.html - http://lua-users.org/lists/lua-l/2020-07/msg00054.html - http://lua-users.org/lists/lua-l/2020-07/msg00071.html - http://lua-users.org/lists/lua-l/2020-07/msg00079.html
CVE ID: CVE-2020-15889 State: PUBLISHED Published: 2020-07-21T21:35:49 Last Updated: 2024-08-04T13:30:23.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members. Additional Analyst Notes: - CVE Program Container: References: - http://lua-users.org/lists/lua-l/2020-07/msg00078.html - https://github.com/lua/lua/commit/127e7a6c8942b362aa3c6627f44d660a4fb75312 - http://lua-users.org/lists/lua-l/2020-12/msg00157.html
CVE ID: CVE-2020-15890 State: PUBLISHED Published: 2020-07-21T21:35:32.000Z Last Updated: 2025-11-03T18:07:55.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: LuaJit through 2.1.0-beta3 has an out-of-bounds read because __gc handler frame traversal is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LuaJIT/LuaJIT/issues/601 - https://lists.debian.org/debian-lts-announce/2020/07/msg00026.html - https://usn.ubuntu.com/4501-1/
CVE ID: CVE-2020-15892 State: PUBLISHED Published: 2020-07-22T18:56:25 Last Updated: 2024-08-04T13:30:23.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the request values are being forwarded to the ssi binary. On the login page, the web interface restricts the password input field to a fixed length of 15 characters. The problem is that validation is being done on the client side, hence it can be bypassed. When an attacker manages to intercept the login request (POST based) and tampers with the vulnerable parameter (log_pass), t
an attacker manages to intercept the login request (POST based) and tampers with the vulnerable parameter (log_pass), to a larger length, the request will be forwarded to the webserver. This results in a stack-based buffer overflow. A few other POST variables, (transferred as part of the login request) are also vulnerable: html_response_page and log_user. Additional Analyst Notes: - CVE Program Container: References: - https://research.loginsoft.com/bugs/classic-stack-based-buffer-overflow-in-dlink-firmware-dap-1520/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169
CVE ID: CVE-2020-15893 State: PUBLISHED Published: 2020-07-22T18:56:05 Last Updated: 2024-08-04T13:30:22.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover packet. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169 - https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir
.aspx?name=SAP10169 - https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/
CVE ID: CVE-2020-15894 State: PUBLISHED Published: 2020-07-22T18:55:56 Last Updated: 2024-08-04T13:30:23.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by setting the value of _POST_SERVICES in the query string to DEVICE.ACCOUNT. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169 - https:/
Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169 - https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/
CVE ID: CVE-2020-15895 State: PUBLISHED Published: 2020-07-22T18:55:44 Last Updated: 2024-08-04T13:30:23.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter, before it's printed on the webpage. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169 - https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/
CVE ID: CVE-2020-15896 State: PUBLISHED Published: 2020-07-22T18:55:31 Last Updated: 2024-08-04T13:30:23.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. There exist a few pages that are directly accessible by any unauthorized user, e.g., logout.php and login.php. This occurs because of checking the value of NO_NEED_AUTH. If the value of NO_NEED_AUTH is 1, the user has direct access to the webpage without any authentication. By appending a query string NO_NEED_AUTH with the value of 1 to any protected URL, any unauthorized user can access the application directly, as demonstrate
AUTH with the value of 1 to any protected URL, any unauthorized user can access the application directly, as demonstrated by bsc_lan.php?NO_NEED_AUTH=1. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169 - https://research.loginsoft.com/bugs/authentication-bypass-in-d-link-firmware-dap-1522/
CVE ID: CVE-2020-15897 State: PUBLISHED Published: 2020-10-26T15:13:40 Last Updated: 2024-08-04T13:30:23.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause traffic loss or incorrect forwarding of traffic via a malformed link-state PDU to the IS-IS router. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/11760-security-advisory-54
CVE ID: CVE-2020-15898 State: PUBLISHED Published: 2020-12-28T18:16:58 Last Updated: 2024-08-04T13:30:23.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction. This vulnerability is only susceptible to exploitation by unidirectional traffic (ex. UDP) and not bidirectional traffic (ex. TCP). This affects: EOS 7170 platforms version 4.21.4.1F and below releases in the 4.21.x train; EOS X-Series versions 4.21.11M and below releases in the 4.21.x train; 4.22.6M and below releases in the 4.22.x train; 4.23.4M and below releases in the 4.23.x train; 4.24.2.1F and below releases in the 4.2
ow releases in the 4.22.x train; 4.23.4M and below releases in the 4.23.x train; 4.24.2.1F and below releases in the 4.24.x train. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/11996-security-advisory-56
CVE ID: CVE-2020-15899 State: PUBLISHED Published: 2020-07-28T16:31:58 Last Updated: 2024-08-04T13:30:23.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grin 3.0.0 before 4.0.0 has insufficient validation of data related to Mimblewimble. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mimblewimble/grin/compare/v3.1.1...v4.0.0 - https://github.com/mimblewimble/grin-security/blob/master/CVEs/CVE-2020-15899.md
CVE ID: CVE-2020-15900 State: PUBLISHED Published: 2020-07-28T15:17:14 Last Updated: 2024-08-04T13:30:23.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b. Additional Analyst Notes: - CVE Program Container: References: - http://git.ghostscript.com/?p=ghostpdl.git%3Ba=log - https://github.com/ArtifexSoftware/ghostpdl/commits/master/psi
s: - http://git.ghostscript.com/?p=ghostpdl.git%3Ba=log - https://github.com/ArtifexSoftware/ghostpdl/commits/master/psi/zstring.c - https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=5d499272b95a6b890a1397e11d20937de000d31b - https://github.com/ArtifexSoftware/ghostpdl/commit/5d499272b95a6b890a1397e11d20937de000d31b - https://artifex.com/security-advisories/CVE-2020-15900 - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00004.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00006.html - https://usn.ubuntu.com/4445-1/ - https://security.gentoo.org/glsa/202008-20