deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-13916
Published: 2020-04-13
Description: An issue was discovered in Cypress (formerly Broadcom) WICED Studio 6.2 CYW20735B1 and CYW20819A1. As a Bluetooth Low Energy (BLE) packet is received, it is copied into a Heap (ThreadX Block) buffer. The buffer allocated in dhmulp_getRxBuffer is four bytes too small to hold the maximum of 255 bytes plus headers. It is possible to corrupt a pointer in the linked list holding the free buffers of the g_mm_BLEDeviceToHostPool Block pool. This pointer can be fully controlled by overflowing with 3 bytes of packet data and the first byte of the packet CRC checksum. The checksum can be freely chosen by adapting the packet data accordingly. An attacker might be able to allocate the overwritten address as a receive buffer resulting in a write-what-where condition. This is fixed in BT SDK2.4 and BT SDK2.45.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://community.cypress.com/thread/53681; https://github.com/seemoo-lab/frankenstein/blob/master/doc/CVE_2019_13916.md; https://community.cypress.com/thread/53681
CVE: CVE-2019-1866
Published: 2020-04-13
Description: Cisco Webex Business Suite before 39.1.0 contains a vulnerability that could allow an unauthenticated, remote attacker to affect the integrity of the application. The vulnerability is due to improper validation of host header values. An attacker with a privileged network position, either a man-in-the-middle or by intercepting wireless network traffic, could exploit this vulnerability to manipulate header values sent by a client to the affected application. The attacker could cause the application to use input from the header to redirect a user from the Cisco Webex Meetings Online site to an arbitrary site of the attacker's choosing.
CVSS Score: 3.1 (LOW)
CWE: CWE-284, CWE-345
References: https://quickview.cloudapps.cisco.com/quickview/bug/CSCvm98833; https://quickview.cloudapps.cisco.com/quickview/bug/CSCvm98833
CVE: CVE-2020-11734
Published: 2020-04-13
Description: cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/tonykuo76/d2480727faeb768a97800db3058dceed; https://www.chtsecurity.com/news/6b907733-c475-4504-b3b7-793442d34335; https://www.cybersolutions.co.jp/product/cybermail/
CVE: CVE-2020-3126
Published: 2020-04-13
Description: vulnerability within the Multimedia Viewer feature of Cisco Webex Meetings could allow an authenticated, remote attacker to bypass security protections. The vulnerability is due to missing security warning dialog boxes when a room host views shared multimedia files. An authenticated, remote attacker could exploit this vulnerability by using the host role to share files within the Multimedia sharing feature and convincing a former room host to view that file. A warning dialog normally appears cautioning users before the file is displayed; however, the former host would not see that warning dialog, and any shared multimedia would be rendered within the user's browser. The attacker could leverage this behavior to conduct additional attacks by including malicious files within a targeted room host's browser window.
CVSS Score: 3.0 (LOW)
CWE: CWE-284, CWE-20
References: https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs24436; https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs24436
CVE: CVE-2020-6423
Published: 2020-04-13
Description: Use after free in audio in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6430
Published: 2020-04-13
Description: Type Confusion in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6431
Published: 2020-04-13
Description: Insufficient policy enforcement in full screen in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6432
Published: 2020-04-13
Description: Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6433
Published: 2020-04-13
Description: Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6434
Published: 2020-04-13
Description: Use after free in devtools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6435
Published: 2020-04-13
Description: Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6436
Published: 2020-04-13
Description: Use after free in window management in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6437
Published: 2020-04-13
Description: Inappropriate implementation in WebView in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted application.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6438
Published: 2020-04-13
Description: Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6439
Published: 2020-04-13
Description: Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6440
Published: 2020-04-13
Description: Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information via a crafted Chrome Extension.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6441
Published: 2020-04-13
Description: Insufficient policy enforcement in omnibox in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6442
Published: 2020-04-13
Description: Inappropriate implementation in cache in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-668
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6443
Published: 2020-04-13
Description: Insufficient data validation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-345
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6444
Published: 2020-04-13
Description: Uninitialized use in WebRTC in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-908
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6445
Published: 2020-04-13
Description: Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6446
Published: 2020-04-13
Description: Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6447
Published: 2020-04-13
Description: Inappropriate implementation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6448
Published: 2020-04-13
Description: Use after free in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6450
Published: 2020-04-13
Description: Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_31.html
CVE: CVE-2020-6451
Published: 2020-04-13
Description: Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_31.html
CVE: CVE-2020-6452
Published: 2020-04-13
Description: Heap buffer overflow in media in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_31.html
CVE: CVE-2020-6454
Published: 2020-04-13
Description: Use after free in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6455
Published: 2020-04-13
Description: Out of bounds read in WebSQL in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-6456
Published: 2020-04-13
Description: Insufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92 allowed a local attacker to bypass site isolation via crafted clipboard contents.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html; https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
CVE: CVE-2020-10642
Published: 2020-04-13
Description: In Rockwell Automation RSLinx Classic versions 4.11.00 and prior, an authenticated local attacker could modify a registry key, which could lead to the execution of malicious code using system privileges when opening RSLinx Classic.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.us-cert.gov/ics/advisories/icsa-20-100-01; https://www.us-cert.gov/ics/advisories/icsa-20-100-01
CVE: CVE-2020-10646
Published: 2020-04-13
Description: Fuji Electric V-Server Lite all versions prior to 4.0.9.0 contains a heap based buffer overflow. The buffer allocated to read data, when parsing VPR files, is too small.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.us-cert.gov/ics/advisories/icsa-20-098-04; https://www.us-cert.gov/ics/advisories/icsa-20-098-04
CVE: CVE-2020-11736
Published: 2020-04-13
Description: fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.
CVSS Score: 3.9 (LOW)
CWE: CWE-22, CWE-59
References: https://gitlab.gnome.org/GNOME/file-roller/-/commit/21dfcdbfe258984db89fb65243a1a888924e45a0; https://lists.debian.org/debian-lts-announce/2020/04/msg00013.html; https://security.gentoo.org/glsa/202009-06
CVE: CVE-2020-1730
Published: 2020-04-13
Description: A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1730; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2A7BIFKUYIYKTY7FX4BEWVC2OHS5DPOU/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLSWHBQ3EPKGTGLQNH554Z746BJ3C554/
CVE: CVE-2020-11738
Published: 2020-04-13
Description: The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.html; http://packetstormsecurity.com/files/164533/WordPress-Duplicator-1.3.26-Arbitrary-File-Read.html; https://cwe.mitre.org/data/definitions/23.html
CVE: CVE-2019-11480
Published: 2020-04-14
Description: The pc-kernel snap build process hardcoded the --allow-insecure-repositories and --allow-unauthenticated apt options when creating the build chroot environment. This could allow an attacker who is able to perform a MITM attack between the build environment and the Ubuntu archive to install a malicious package within the build chroot. This issue affects pc-kernel versions prior to and including 2019-07-16
CVSS Score: 8.4 (HIGH)
CWE: CWE-353, CWE-345
References: https://bugs.launchpad.net/bugs/1836041; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11480; https://bugs.launchpad.net/bugs/1836041
CVE: CVE-2020-11739
Published: 2020-04-14
Description: An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the "critical" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html; http://www.openwall.com/lists/oss-security/2020/04/14/2; http://xenbits.xen.org/xsa/advisory-314.html
CVE: CVE-2020-11740
Published: 2020-04-14
Description: An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guests. Unprivileged guests can request to map xenoprof buffers, even if profiling has not been enabled for those guests. These buffers were not scrubbed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-212
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html; http://www.openwall.com/lists/oss-security/2020/04/14/1; http://xenbits.xen.org/xsa/advisory-313.html
CVE: CVE-2020-11741
Published: 2020-04-14
Description: An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information about other guests, cause a denial of service, or possibly gain privileges. For guests for which "active" profiling was enabled by the administrator, the xenoprof code uses the standard Xen shared ring structure. Unfortunately, this code did not treat the guest as a potential adversary: it trusts the guest not to modify buffer size information or modify head / tail pointers in unexpected ways. This can crash the host (DoS). Privilege escalation cannot be ruled out.
CVSS Score: 8.8 (HIGH)
CWE: CWE-909
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html; http://www.openwall.com/lists/oss-security/2020/04/14/1; http://xenbits.xen.org/xsa/advisory-313.html
CVE: CVE-2020-11742
Published: 2020-04-14
Description: An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of bad continuation handling in GNTTABOP_copy. Grant table operations are expected to return 0 for success, and a negative number for errors. The fix for CVE-2017-12135 introduced a path through grant copy handling where success may be returned to the caller without any action taken. In particular, the status fields of individual operations are left uninitialised, and may result in errant behaviour in the caller of GNTTABOP_copy. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to copy a grant, it hits the incorrect exit path. This returns success to the caller without doing anything, which may cause crashes or other incorrect behaviour.
CVSS Score: 5.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html; http://www.openwall.com/lists/oss-security/2020/04/14/4; http://xenbits.xen.org/xsa/advisory-318.html