Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
visories/brocade-security-advisory-2019-767 - https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html - https://security.netapp.com/advisory/ntap-20190327-0005/ - http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/ - https://www.debian.org/security/2019/dsa-4431 - https://seclists.org/bugtraq/2019/Apr/25 - https://access.redhat.com/errata/RHSA-2019:1884 - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.
rata/RHSA-2019:1884 - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpujan2020.html
CVE ID: CVE-2019-3863 State: PUBLISHED Published: 2019-03-25T17:52:10.000Z Last Updated: 2025-04-23T19:48:19.703Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: The libssh2 Project Products: libssh2 Problem Types: CWE-190, CWE-787 Description: A flaw was found in libssh2 before 1.8.1. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used as an index to copy memory causing in an out of bounds memory write error. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3863 - h
Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3863 - https://www.libssh2.org/CVE-2019-3863.html - https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html - https://security.netapp.com/advisory/ntap-20190327-0005/ - https://access.redhat.com/errata/RHSA-2019:0679 - http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/ - https://www.debian.org/security/2019/dsa-4431 - https://seclists.org/bu
.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/ - https://www.debian.org/security/2019/dsa-4431 - https://seclists.org/bugtraq/2019/Apr/25 - https://access.redhat.com/errata/RHSA-2019:1175 - https://access.redhat.com/errata/RHSA-2019:1652 - https://access.redhat.com/errata/RHSA-2019:1791 - https://access.redhat.com/errata/RHSA-2019:1943 - https://access.redhat.com/errata/RHSA-2019:2399 - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
CVE ID: CVE-2019-3864 State: PUBLISHED Published: 2020-01-21T15:44:00 Last Updated: 2024-08-04T19:19:18.674Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: quay Problem Types: CWE-352 Description: A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF token. The token is not refreshed for every request or when a user logged out and in again. An attacker could use a leaked token to gain access to the system using the user's account. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bu
the user's account. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3864
CVE ID: CVE-2019-3865 State: PUBLISHED Published: 2020-06-22T17:51:19 Last Updated: 2024-08-04T19:19:18.608Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: quay Problem Types: CWE-79 Description: A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3865
CVE ID: CVE-2019-3866 State: PUBLISHED Published: 2019-11-08T14:45:58 Last Updated: 2024-08-04T19:19:18.586Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: openstack-mistral Problem Types: CWE-732 Description: An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3866
CVE ID: CVE-2019-3867 State: PUBLISHED Published: 2021-03-18T18:04:18 Last Updated: 2024-08-04T19:19:18.613Z Vendors: n/a Products: quay Problem Types: CWE-613 Description: A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could use it to control or delete a user's container repository. Red Hat Quay 2 and 3 are vulnerable to this issue. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1772704
CVE ID: CVE-2019-3868 State: PUBLISHED Published: 2019-04-24T15:21:50 Last Updated: 2024-08-04T19:19:18.678Z Severity: LOW (CVSS 3.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: keycloak Problem Types: CWE-200 Description: Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3868 - http://www.securityfocus.com/bid/108061 - https://access.redhat.com/errata/RHSA
dhat.com/show_bug.cgi?id=CVE-2019-3868 - http://www.securityfocus.com/bid/108061 - https://access.redhat.com/errata/RHSA-2019:1140 - https://access.redhat.com/errata/RHSA-2019:2998
CVE ID: CVE-2019-3869 State: PUBLISHED Published: 2019-03-28T13:04:59 Last Updated: 2024-08-04T19:19:18.595Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Tower Problem Types: CWE-214 Description: When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ansible/awx/pull/3505 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3869
CVE ID: CVE-2019-3870 State: PUBLISHED Published: 2019-04-09T15:17:43 Last Updated: 2024-08-04T19:19:18.603Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: The Samba Project Products: samba Problem Types: CWE-276 Description: A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory,
ions it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTJVFA3RZ6G2IZDTVKLHRMX6QBYA4GPA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6354GALK73CZWQKFUG7AWB6EIEGFMF62/ - https://www.samba.org/samba/security/CVE-2019-3870.html - https://bugzilla.samba.org/show_
LK73CZWQKFUG7AWB6EIEGFMF62/ - https://www.samba.org/samba/security/CVE-2019-3870.html - https://bugzilla.samba.org/show_bug.cgi?id=13834 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3870 - https://www.synology.com/security/advisory/Synology_SA_19_15 - https://support.f5.com/csp/article/K20804356
CVE ID: CVE-2019-3871 State: PUBLISHED Published: 2019-03-21T20:42:35 Last Updated: 2024-08-04T19:19:18.676Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: The PowerDNS Project Products: pdns Problem Types: CWE-20 Description: A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and some
to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/03/18/4 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3871 - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.html - http://www.securityfocus.com/bid/107491 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWUHF6MRSQ3YO7UUISGLV7MXCAGBW2VD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fe
rg/message/GWUHF6MRSQ3YO7UUISGLV7MXCAGBW2VD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ROFI6OTWF4GKONNSNEDUCW6LVSSEBZNF/ - https://lists.debian.org/debian-lts-announce/2019/03/msg00039.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00022.html - https://www.debian.org/security/2019/dsa-4424 - https://seclists.org/bugtraq/2019/Apr/8
CVE ID: CVE-2019-3872 State: PUBLISHED Published: 2019-06-12T13:45:56 Last Updated: 2024-08-04T19:19:18.614Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: picketlink Problem Types: CWE-79 Description: It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x. An attacker could use this to send a malicious script to achieve cross-site scripting and obtain unauthorized information or conduct further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3872 - http://www.securityfo
- CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3872 - http://www.securityfocus.com/bid/108732
CVE ID: CVE-2019-3873 State: PUBLISHED Published: 2019-06-12T13:43:46 Last Updated: 2024-08-04T19:19:18.682Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L) Vendors: Red Hat Products: picketlink Problem Types: CWE-79 Description: It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3873 - http://www.securityfocus.com/bid/108739
CVE ID: CVE-2019-3874 State: PUBLISHED Published: 2019-03-25T18:30:37 Last Updated: 2024-08-04T19:19:18.619Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: The Linux Foundation Products: kernel Problem Types: CWE-400 Description: The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack. Kernel 3.10.x and 4.18.x branches are believed to be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3981-1/ - https://usn.ubuntu.com/3980-1/ - https://usn.ubuntu.com/3979-1/ - https://usn.ubuntu.com/3982-2/ - https://
om/3981-1/ - https://usn.ubuntu.com/3980-1/ - https://usn.ubuntu.com/3979-1/ - https://usn.ubuntu.com/3982-2/ - https://usn.ubuntu.com/3982-1/ - https://usn.ubuntu.com/3980-2/ - https://usn.ubuntu.com/3981-2/ - https://access.redhat.com/errata/RHSA-2019:3309 - https://access.redhat.com/errata/RHSA-2019:3517 - https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3874 - https://security.netapp.com/advisory/ntap-20190411-0003/
CVE ID: CVE-2019-3875 State: PUBLISHED Published: 2019-06-12T13:51:38 Last Updated: 2024-08-04T19:19:18.609Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: keycloak Problem Types: CWE-345, CWE-295 Description: A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certi
k through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3875 - http://www.securityfocus.com/bid/108748
CVE ID: CVE-2019-3876 State: PUBLISHED Published: 2019-04-01T14:15:42 Last Updated: 2024-08-04T19:19:18.679Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: web-console Problem Types: CWE-352 Description: A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107664 - https://access.redhat.co
Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107664 - https://access.redhat.com/errata/RHSA-2019:1851 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3876
CVE ID: CVE-2019-3877 State: PUBLISHED Published: 2019-03-27T12:19:19 Last Updated: 2024-08-04T19:19:18.685Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: uninett Products: mod_auth_mellon Problem Types: CWE-601 Description: A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function. Additional Analyst Notes: - CVE Program
attacker to bypass the redirect URL validation logic in apr_uri_parse function. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3877 - https://github.com/Uninett/mod_auth_mellon/issues/35 - https://github.com/Uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8 - https://usn.ubuntu.com/3924-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/ - https://access.redhat.com/errata/RHSA-2019:0766
ce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/ - https://access.redhat.com/errata/RHSA-2019:0766 - https://access.redhat.com/errata/RHSA-2019:3421
CVE ID: CVE-2019-3878 State: PUBLISHED Published: 2019-03-26T17:44:29 Last Updated: 2024-08-04T19:19:18.665Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: uninett Products: mod_auth_mellon Problem Types: CWE-305 Description: A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.r
an be used to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878 - https://github.com/Uninett/mod_auth_mellon/pull/196 - https://usn.ubuntu.com/3924-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/ - https://access.redhat.com/errata/RHSA-2019:0746 - https://access.redhat.com/errata/RHSA-2019:0766 - https://access.redhat.com/errata/RHSA-2019:0985 - https://access.redhat.com/errata/RH
redhat.com/errata/RHSA-2019:0766 - https://access.redhat.com/errata/RHSA-2019:0985 - https://access.redhat.com/errata/RHBA-2019:0959
CVE ID: CVE-2019-3879 State: PUBLISHED Published: 2019-03-25T18:30:17 Last Updated: 2024-08-04T19:19:18.612Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: unspecified Products: ovirt-engine Problem Types: CWE-862 Description: It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges (eg Basic Operations) could exploit this flaw to delete disks attached to guests. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?i
d to guests. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3879 - http://www.securityfocus.com/bid/107561 - https://access.redhat.com/errata/RHBA-2019:0802
CVE ID: CVE-2019-3880 State: PUBLISHED Published: 2019-04-09T15:18:08 Last Updated: 2024-08-04T19:19:18.589Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: The Samba Project Products: samba Problem Types: CWE-22 Description: A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://www.samba.org/samba/secur
.10.2 are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://www.samba.org/samba/security/CVE-2019-3880.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3880 - https://lists.debian.org/debian-lts-announce/2019/04/msg00013.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00050.html - https://security.netapp.com/advisory/ntap-20190411-0004/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTJVFA3RZ6G2IZDTVKLHRMX6QBYA4GPA/ - https://www.synology.com/security/advisory/Synology_SA_19_15 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messa
isory/Synology_SA_19_15 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6354GALK73CZWQKFUG7AWB6EIEGFMF62/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00106.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRLRO7BPRFETVFZ4TVJL2VFZEPHKJY4/ - https://support.f5.com/csp/article/K20804356 - https://access.redhat.com/errata/RHSA-2019:1966 - https://access.redhat.com/errata/RHSA-2019:1967 - https://access.redhat.com/errata/RHSA-2019:2099 - https://access.redhat.com/errata/RHSA-2019:3582
CVE ID: CVE-2019-3881 State: PUBLISHED Published: 2020-09-04T00:00:00 Last Updated: 2024-08-04T19:19:18.600Z Vendors: n/a Products: rubygem-bundler Problem Types: CWE-427 Description: Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1651826
CVE ID: CVE-2019-3882 State: PUBLISHED Published: 2019-04-24T15:23:10 Last Updated: 2024-08-04T19:19:18.633Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: The Linux Foundation Products: kernel Problem Types: CWE-770 Description: A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). Versions 3.10, 4.14 and 4.18 are vulnerable. Additional Analyst Notes: - CVE Program Container: Ref
al of service (DoS). Versions 3.10, 4.14 and 4.18 are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3981-1/ - https://usn.ubuntu.com/3980-1/ - https://usn.ubuntu.com/3979-1/ - https://usn.ubuntu.com/3982-2/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00037.html - https://usn.ubuntu.com/3982-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html - https://usn.ubuntu.com/3980-2/ - https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html - https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html - https://usn.ubuntu.com/3981-2/ - http://lists.opensuse.org/opensuse-security-an
ian-lts-announce/2019/05/msg00042.html - https://usn.ubuntu.com/3981-2/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html - https://access.redhat.com/errata/RHSA-2019:2043 - https://access.redhat.com/errata/RHSA-2019:2029 - https://seclists.org/bugtraq/2019/Aug/18 - https://www.debian.org/security/2019/dsa-4497 - https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html - https://access.redhat.com/errata/RHSA-2019:3309 - https://access.redhat.com/errata/RHSA-2019:3517 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3882 - https://security.netapp.com/advisory/ntap-20190517-0005/