deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-17376
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2017-17377
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2017-17378
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2017-17379
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2017-17380
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16891
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16892
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16893
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16894
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16895
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16896
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16897
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16898
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16899
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16900
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16901
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16902
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16903
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16904
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16905
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16906
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16907
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16908
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16909
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16910
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16911
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16912
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16913
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16914
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16915
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16916
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16917
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16918
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16919
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16920
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16921
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16922
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16923
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16924
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16925
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16926
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16927
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16928
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16929
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16930
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16931
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16932
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16933
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16934
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16935
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2018-16936
Published: 2020-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-15708
Published: 2020-11-06
Description: Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-732, CWE-732
References: https://usn.ubuntu.com/usn/usn-4452-1; https://usn.ubuntu.com/usn/usn-4452-1
CVE: CVE-2020-27347
Published: 2020-11-06
Description: In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/tmux/tmux/commit/a868bacb46e3c900530bed47a1c6f85b0fbe701c; https://raw.githubusercontent.com/tmux/tmux/3.1c/CHANGES; https://security.gentoo.org/glsa/202011-10
CVE: CVE-2020-5643
Published: 2020-11-06
Description: Improper input validation vulnerability in Cybozu Garoon 5.0.0 to 5.0.2 allows a remote authenticated attacker to delete some data of the bulletin board via unspecified vector.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://jvn.jp/en/jp/JVN57942454/index.html; https://kb.cybozu.support/article/36725/; https://jvn.jp/en/jp/JVN57942454/index.html
CVE: CVE-2020-5644
Published: 2020-11-06
Description: Buffer overflow vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://jvn.jp/vu/JVNVU99562395/index.html; https://us-cert.cisa.gov/ics/advisories/icsa-20-310-02; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-014.pdf
CVE: CVE-2020-5645
Published: 2020-11-06
Description: Session fixation vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-384
References: https://jvn.jp/vu/JVNVU99562395/index.html; https://us-cert.cisa.gov/ics/advisories/icsa-20-310-02; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-014.pdf
CVE: CVE-2020-5646
Published: 2020-11-06
Description: NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://jvn.jp/vu/JVNVU99562395/index.html; https://us-cert.cisa.gov/ics/advisories/icsa-20-310-02; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-014.pdf
CVE: CVE-2020-5647
Published: 2020-11-06
Description: Improper access control vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QMBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QLBDE CoreOS version ’05.65.00.BD’ and earlier, GT1455HS-QTBDE CoreOS version ’05.65.00.BD’ and earlier, and GT1450HS-QMBDE CoreOS version ’05.65.00.BD’ and earlier) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
CVSS Score: 9.8 (CRITICAL)
References: https://jvn.jp/vu/JVNVU99562395/index.html; https://us-cert.cisa.gov/ics/advisories/icsa-20-310-02; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-014.pdf
CVE: CVE-2020-5648
Published: 2020-11-06
Description: Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows unauthenticated attackers on adjacent network to stop the network functions of the products via a specially crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88
References: https://jvn.jp/vu/JVNVU99562395/index.html; https://us-cert.cisa.gov/ics/advisories/icsa-20-310-02; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-014.pdf
CVE: CVE-2020-5649
Published: 2020-11-06
Description: Resource management error vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
CVSS Score: 7.5 (HIGH)
References: https://jvn.jp/vu/JVNVU99562395/index.html; https://us-cert.cisa.gov/ics/advisories/icsa-20-310-02; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-014.pdf
CVE: CVE-2020-5667
Published: 2020-11-06
Description: Studyplus App for Android v6.3.7 and earlier and Studyplus App for iOS v8.29.0 and earlier use a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-798
References: https://jvn.jp/en/jp/JVN00414047/index.html; https://jvn.jp/en/jp/JVN00414047/index.html
CVE: CVE-2020-28241
Published: 2020-11-06
Description: libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3; https://github.com/maxmind/libmaxminddb/issues/236; https://github.com/maxmind/libmaxminddb/pull/237
CVE: CVE-2020-28242
Published: 2020-11-06
Description: An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5. If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: http://downloads.asterisk.org/pub/security/AST-2020-002.html; https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QUS54QTQCYKR36EIULYD544GXDA644HB/
CVE: CVE-2020-28249
Published: 2020-11-06
Description: Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/fhlip0/JopinXSS; https://github.com/laurent22/joplin/releases; https://github.com/fhlip0/JopinXSS
CVE: CVE-2020-28250
Published: 2020-11-06
Description: Cellinx NVT Web Server 5.0.0.014b.test 2019-09-05 allows a remote user to run commands as root via SetFileContent.cgi because authentication is on the client side.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/summtime/CVE/tree/master/CVE-2020-28250; https://github.com/summtime/CVE/tree/master/CVE-2020-28250
CVE: CVE-2020-16846
Published: 2020-11-06
Description: An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html; http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html; https://github.com/saltstack/salt/releases
CVE: CVE-2020-17490
Published: 2020-11-06
Description: The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html; https://docs.saltstack.com/en/latest/topics/releases/index.html#latest-branch-release; https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html
CVE: CVE-2020-25592
Published: 2020-11-06
Description: In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html; http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html; https://docs.saltstack.com/en/latest/topics/releases/index.html
CVE: CVE-2020-26521
Published: 2020-11-06
Description: The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2020/11/02/2; https://github.com/nats-io/nats-server/commits/master; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT67XCLIIBYRT762SVFBYFFTQFVSM3SI/
CVE: CVE-2020-26892
Published: 2020-11-06
Description: The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/nats-io/nats-server/commits/master; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT67XCLIIBYRT762SVFBYFFTQFVSM3SI/; https://www.openwall.com/lists/oss-security/2020/11/02/2
CVE: CVE-2020-27152
Published: 2020-11-06
Description: An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering, aka CID-77377064c3a9.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://www.openwall.com/lists/oss-security/2020/11/03/1; https://bugzilla.kernel.org/show_bug.cgi?id=208767; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.2
CVE: CVE-2020-27616
Published: 2020-11-06
Description: ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-682
References: http://www.openwall.com/lists/oss-security/2020/11/03/2; https://lists.nongnu.org/archive/html/qemu-devel/2020-10/msg05018.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-27617
Published: 2020-11-06
Description: eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: http://www.openwall.com/lists/oss-security/2020/11/02/1; https://lists.debian.org/debian-lts-announce/2020/11/msg00047.html; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE: CVE-2020-28196
Published: 2020-11-06
Description: MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674, CWE-674
References: https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E; https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E