deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-5606
Published: 2019-07-26
Description: In FreeBSD 12.0-STABLE before r349805, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r349806, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, code which handles close of a descriptor created by posix_openpt fails to undo a signal configuration. This causes an incorrect signal to be raised leading to a write after free of kernel memory allowing a malicious user to gain root privileges or escape a jail.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://packetstormsecurity.com/files/153748/FreeBSD-Security-Advisory-FreeBSD-SA-19-13.pts.html; https://security.FreeBSD.org/advisories/FreeBSD-SA-19:13.pts.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-5607
Published: 2019-07-26
Description: In FreeBSD 12.0-STABLE before r350222, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350223, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, rights transmitted over a domain socket did not properly release a reference on transmission error allowing a malicious user to cause the reference counter to wrap, forcing a free event. This could allow a malicious local user to gain root privileges or escape from a jail.
CVSS Score: 7.8 (HIGH)
CWE: CWE-404, CWE-682
References: http://packetstormsecurity.com/files/153755/FreeBSD-Security-Advisory-FreeBSD-SA-19-17.fd.html; https://security.FreeBSD.org/advisories/FreeBSD-SA-19:17.fd.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-14274
Published: 2019-07-26
Description: MCPP 2.7.2 has a heap-based buffer overflow in the do_msg() function in support.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00038.html; https://security.gentoo.org/glsa/202208-04
CVE: CVE-2019-14275
Published: 2019-07-26
Description: Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calc_arrow function in bound.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00043.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00019.html; https://lists.debian.org/debian-lts-announce/2020/01/msg00018.html
CVE: CVE-2019-14277
Published: 2019-07-26
Description: Axway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration) is vulnerable to unauthenticated blind XML injection (and XXE) in the resetPassword functionality via the REST API. This vulnerability can lead to local file disclosure, DoS, or URI invocation attacks (i.e., SSRF with resultant remote code execution). NOTE: The vendor disputes this issues as not being a vulnerability because “All attacks that use external entities are blocked (no external DTD or file inclusions, no SSRF). The impact on confidentiality, integrity and availability is not proved on any version.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-91
References: https://community.axway.com/s/article/SecureTransport-Security-Notice; https://community.axway.com/s/article/SecureTransport-Security-Notice-re-CVE-2019-14277-Unauthenticated-XML-Injection-and-XXE; https://gist.githubusercontent.com/zeropwn/59f17727dfaba239b0ace6f33b752974/raw/9b6541a94ac5ec181a88e6c84cb3e3001025b8fd/Axway%2520SecureTransport%25205.x%2520Unauthenticated%2520XXE
CVE: CVE-2019-14280
Published: 2019-07-26
Description: In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/154276/Craft-CMS-2.7.9-3.2.5-Information-Disclosure.html; https://github.com/craftcms/cms/blob/develop-v2/CHANGELOG-v2.md#2710---2019-07-24; https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#326---2019-07-23
CVE: CVE-2018-20854
Published: 2019-07-26
Description: An issue was discovered in the Linux kernel before 4.20. drivers/phy/mscc/phy-ocelot-serdes.c has an off-by-one error with a resultant ctrl->phys out-of-bounds read.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6acb47d1a318e5b3b7115354ebc4ea060c59d3a1; https://github.com/torvalds/linux/commit/6acb47d1a318e5b3b7115354ebc4ea060c59d3a1; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-20855
Published: 2019-07-26
Description: An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace.
CVSS Score: 3.3 (LOW)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00055.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html; https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.7
CVE: CVE-2018-20856
Published: 2019-07-26
Description: An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-after-free because a certain error case is mishandled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://packetstormsecurity.com/files/154059/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; http://packetstormsecurity.com/files/154408/Kernel-Live-Patch-Security-Notice-LSN-0055-1.html; http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html
CVE: CVE-2019-14281
Published: 2019-07-26
Description: The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/rubygems/rubygems.org/issues/2072; https://rubygems.org/gems/datagrid/versions; https://snyk.io/vuln/SNYK-RUBY-DATAGRID-455500
CVE: CVE-2019-14282
Published: 2019-07-26
Description: The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/rubygems/rubygems.org/issues/2073; https://rubygems.org/gems/simple_captcha2/versions/; https://snyk.io/vuln/SNYK-RUBY-SIMPLECAPTCHA2-455501
CVE: CVE-2018-20857
Published: 2019-07-26
Description: Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as a name_id node with user@example.com followed by <!---->. and then the attacker's domain name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/zendesk/samlr/compare/v2.6.1...v2.6.2; https://github.com/zendesk/samlr/compare/v2.6.1...v2.6.2
CVE: CVE-2019-13057
Published: 2019-07-26
Description: An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)
CVSS Score: 4.9 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html; http://seclists.org/fulldisclosure/2019/Dec/26
CVE: CVE-2019-13382
Published: 2019-07-26
Description: UploaderService in SnagIT 2019.1.2 allows elevation of privilege by placing an invalid presentation file in %PROGRAMDATA%\TechSmith\TechSmith Recorder\QueuedPresentations and then creating a symbolic link in %PROGRAMDATA%\Techsmith\TechSmith Recorder\InvalidPresentations that points to an arbitrary folder with an arbitrary file name. TechSmith Relay Classic Recorder prior to 5.2.1 on Windows is vulnerable. The vulnerability was introduced in SnagIT Windows 12.4.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://posts.specterops.io/cve-2019-13382-local-privilege-escalation-in-snagit-abe5f31c349; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010; https://support.techsmith.com/hc/en-us/articles/[PII_REDACTED]7-Snagit-Windows-Version-History
CVE: CVE-2019-13385
Published: 2019-07-26
Description: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enumerate users and check for active users of the application by reading /tmp/login.log.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/153877/CentOS-Control-Web-Panel-0.9.8.840-User-Enumeration.html; https://centos-webpanel.com/changelog-cwp7; https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13385.md
CVE: CVE-2019-13386
Published: 2019-07-26
Description: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., obtain a reverse shell with user privilege.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://packetstormsecurity.com/files/153876/CentOS-Control-Web-Panel-0.9.8.836-Remote-Command-Execution.html; https://centos-webpanel.com/changelog-cwp7; https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13386.md
CVE: CVE-2019-13387
Published: 2019-07-26
Description: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir) allows attackers to steal a cookie or session, or redirect to a phishing website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153878/CentOS-Control-Web-Panel-0.9.8.846-Cross-Site-Scripting.html; https://centos-webpanel.com/changelog-cwp7; https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13387.md
CVE: CVE-2019-13565
Published: 2019-07-26
Description: An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html; http://seclists.org/fulldisclosure/2019/Dec/26
CVE: CVE-2019-13638
Published: 2019-07-26
Description: GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2[PII_REDACTED].
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html; https://access.redhat.com/errata/RHSA-2019:2798; https://access.redhat.com/errata/RHSA-2019:2964
CVE: CVE-2019-13954
Published: 2019-07-26
Description: Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to memory exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system. Malicious code cannot be injected.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: http://packetstormsecurity.com/files/153733/Mikrotik-RouterOS-Resource-Stack-Exhaustion.html; https://seclists.org/fulldisclosure/2019/Jul/20; http://packetstormsecurity.com/files/153733/Mikrotik-RouterOS-Resource-Stack-Exhaustion.html
CVE: CVE-2019-13955
Published: 2019-07-26
Description: Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server via recursive parsing of JSON. Malicious code cannot be injected.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: http://packetstormsecurity.com/files/153733/Mikrotik-RouterOS-Resource-Stack-Exhaustion.html; https://seclists.org/fulldisclosure/2019/Jul/20; http://packetstormsecurity.com/files/153733/Mikrotik-RouterOS-Resource-Stack-Exhaustion.html
CVE: CVE-2019-14228
Published: 2019-07-26
Description: Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at admin/includes/adminprocess.php. If there is an error when registering the user, the unsanitized username will reflect via the error page. Due to the lack of CSRF protection on the admin/includes/adminprocess.php endpoint, an attacker is able to chain the XSS with CSRF in order to cause remote exploitation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://codecanyon.net/item/xavier-php-login-script-user-management/9146226; https://m-q-t.github.io/notes/xavier-csrf-to-xss-takeover/; https://codecanyon.net/item/xavier-php-login-script-user-management/9146226
CVE: CVE-2019-14283
Published: 2019-07-26
Description: In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125, CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00055.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html; http://packetstormsecurity.com/files/154059/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE: CVE-2019-14284
Published: 2019-07-26
Description: In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-369
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00055.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html; http://packetstormsecurity.com/files/154059/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE: CVE-2019-6002
Published: 2019-07-26
Description: Cross-site scripting vulnerability in Central Dogma 0.17.0 to 0.40.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN94889214/index.html; https://github.com/line/centraldogma/releases/tag/centraldogma-0.41.0; http://jvn.jp/en/jp/JVN94889214/index.html
CVE: CVE-2019-9492
Published: 2019-07-26
Description: A DLL side-loading vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow an authenticated attacker to gain code execution and terminate the product's process - disabling endpoint protection. The attacker must have already gained authentication and have local access to the vulnerable system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://success.trendmicro.com/solution/1123045; https://www.nsslabs.com/blog-posts/2019/7/24/your-advanced-endpoint-protection-aep-product-protects-your-computer-but-can-it-protect-itself; https://success.trendmicro.com/solution/1123045
CVE: CVE-2019-13990
Published: 2019-07-26
Description: initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-611
References: https://confluence.atlassian.com/security/ssot-117-cve-2019-13990-xxe-xml-external-entity-injection-vulnerability-in-jira-service-management-data-center-and-jira-service-management-server[PII_REDACTED].html; https://github.com/quartz-scheduler/quartz/issues/467; https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115af91bcc1651b4e870bb82%40%3Cdev.tomee.apache.org%3E
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2[PII_REDACTED]. Reason: This candidate is a reservation duplicate of CVE-2[PII_REDACTED]. Notes: All CVE users should reference CVE-2[PII_REDACTED] instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-10263
Published: 2019-07-26
Description: An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When creating a trial account, it is possible to inject XSS in the Alias field, allowing the attacker to retrieve the admin's cookie and take over the account.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.wbsec.nl/ahsay/; https://www.wbsec.nl/ahsay/
CVE: CVE-2019-10264
Published: 2019-07-26
Description: An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. With a valid administrator account, the "Move / Import / Export Users" screen has an Import Users option. This option accepts a ZIP archive containing a users.xml file that can trigger XXE.
CVSS Score: 7.2 (HIGH)
CWE: CWE-611
References: https://www.wbsec.nl/ahsay/; https://www.wbsec.nl/ahsay/
CVE: CVE-2019-10265
Published: 2019-07-26
Description: An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. On the /cbs/system/ShowAdvanced.do "File Explorer" screen, it is possible to change the directory in the JavaScript code. If changed to (for example) "C:" then one can browse the whole server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.wbsec.nl/ahsay/; https://www.wbsec.nl/ahsay/
CVE: CVE-2019-10266
Published: 2019-07-26
Description: An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file structure and even the content of files without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: http://packetstormsecurity.com/files/153772/Ahsay-Backup-7.x-8.x-XML-Injection.html; https://www.wbsec.nl/ahsay/; http://packetstormsecurity.com/files/153772/Ahsay-Backup-7.x-8.x-XML-Injection.html
CVE: CVE-2019-10267
Published: 2019-07-26
Description: An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the configured user (e.g., Administrator).
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/153770/Ahsay-Backup-7.x-8.x-File-Upload-Remote-Code-Execution.html; http://packetstormsecurity.com/files/153771/Ahsay-Backup-7.x-8.x-File-Upload-Remote-Code-Execution.html; https://www.wbsec.nl/ahsay/
CVE: CVE-2019-13588
Published: 2019-07-26
Description: A cross-site scripting (XSS) vulnerability in getPagingStart() in core/lists/PAGING.php in WIKINDX before 5.8.2 allows remote attackers to inject arbitrary web script or HTML via the PagingStart parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sourceforge.net/p/wikindx/code/2794/; https://sourceforge.net/p/wikindx/code/2801/tree//wikindx/trunk/CHANGELOG.txt?diff=51060a0c271846770c56c75a:2800; https://sourceforge.net/p/wikindx/code/commit_browser
CVE: CVE-2019-14286
Published: 2019-07-27
Description: In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/26bedd8a68c32a2f14460a8eac2a9fb09923392b; https://github.com/MISP/MISP/commit/26bedd8a68c32a2f14460a8eac2a9fb09923392b
CVE: CVE-2019-14288
Published: 2019-07-27
Description: An issue was discovered in Xpdf 4.01.01. There is an Integer overflow in the function JBIG2Bitmap::combine at JBIG2Stream.cc for the "one byte per line" case.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41851; https://github.com/TeamSeri0us/pocs/tree/master/xpdf/4.01.01; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41851
CVE: CVE-2019-14289
Published: 2019-07-27
Description: An issue was discovered in Xpdf 4.01.01. There is an integer overflow in the function JBIG2Bitmap::combine at JBIG2Stream.cc for the "multiple bytes per line" case.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41851; https://github.com/TeamSeri0us/pocs/tree/master/xpdf/4.01.01; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41851
CVE: CVE-2019-14290
Published: 2019-07-27
Description: An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA==6 case 2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41851; https://github.com/TeamSeri0us/pocs/tree/master/xpdf/4.01.01; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41851
CVE: CVE-2019-14291
Published: 2019-07-27
Description: An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA==6 case 3.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41851; https://github.com/TeamSeri0us/pocs/tree/master/xpdf/4.01.01; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41851
CVE: CVE-2019-14292
Published: 2019-07-27
Description: An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA!=6 case 1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41851; https://github.com/TeamSeri0us/pocs/tree/master/xpdf/4.01.01; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41851
CVE: CVE-2019-14293
Published: 2019-07-27
Description: An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA!=6 case 2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41851; https://github.com/TeamSeri0us/pocs/tree/master/xpdf/4.01.01; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41851
CVE: CVE-2019-14294
Published: 2019-07-27
Description: An issue was discovered in Xpdf 4.01.01. There is a use-after-free in the function JPXStream::fillReadBuf at JPXStream.cc, due to an out of bounds read.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-416
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41851; https://github.com/TeamSeri0us/pocs/tree/master/xpdf/4.01.01; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41851
CVE: CVE-2019-14295
Published: 2019-07-27
Description: An Integer overflow in the getElfSections function in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an allocation of excessive memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/upx/upx/issues/286; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCJ43HTM45GZCAQ2FLEBDNBM76V22RG/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T52JATXV6NTPTMGXCRGT37H6KXERYNZN/