deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-15806
Published: 2019-08-29
Description: CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/basic_sett.html. Any user connected to the Wi-Fi can exploit this.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-326
References: https://medium.com/%40v.roberthoutenbrink/commscope-vulnerability-authentication-bypass-in-arris-tr4400-firmware-version-a1-00-004-180301-4a90aa8e7570; https://medium.com/%40v.roberthoutenbrink/commscope-vulnerability-authentication-bypass-in-arris-tr4400-firmware-version-a1-00-004-180301-4a90aa8e7570
CVE: CVE-2019-15807
Published: 2019-08-29
Description: In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails. This will cause a BUG and denial of service.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-401
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.13; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3b[PII_REDACTED]fbe7f42867e310e0c9eb6295364d; https://lists.debian.org/debian-lts-announce/2019/09/msg00014.html
CVE: CVE-2019-13608
Published: 2019-08-29
Description: Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://support.citrix.com/article/CTX251988; https://support.citrix.com/article/CTX251988; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-13608
CVE: CVE-2019-14533
Published: 2019-08-29
Description: The Control function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://git.videolan.org/?p=vlc.git&a=search&h=refs/heads/master&st=commit&s=cve-2019; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html
CVE: CVE-2019-14534
Published: 2019-08-29
Description: In VideoLAN VLC media player 3.0.7.1, there is a NULL pointer dereference at the function SeekPercent of demux/asf/asf.c that will lead to a denial of service attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://git.videolan.org/?p=vlc.git&a=search&h=refs/heads/master&st=commit&s=cve-2019; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html
CVE: CVE-2019-14776
Published: 2019-08-29
Description: A heap-based buffer over-read exists in DemuxInit() in demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 via a crafted .mkv file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://git.videolan.org/?p=vlc.git&a=search&h=refs/heads/master&st=commit&s=cve-2019; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html
CVE: CVE-2019-14777
Published: 2019-08-29
Description: The Control function of demux/mkv/mkv.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://git.videolan.org/?p=vlc.git&a=search&h=refs/heads/master&st=commit&s=cve-2019; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html
CVE: CVE-2019-14778
Published: 2019-08-29
Description: The mkv::virtual_segment_c::seek method of demux/mkv/virtual_segment.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://git.videolan.org/?p=vlc.git&a=search&h=refs/heads/master&st=commit&s=cve-2019; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html
CVE: CVE-2019-14970
Published: 2019-08-29
Description: A vulnerability in mkv::event_thread_t in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://git.videolan.org/?p=vlc.git&a=search&h=refs/heads/master&st=commit&s=cve-2019; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html
CVE: CVE-2019-14977
Published: 2019-08-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-14978
Published: 2019-08-29
Description: /payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as demonstrated by purchasing an item for lower than the intended price.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://gkaim.com/cve-2019-14978-vikas-chaudhary/; https://wpvulndb.com/vulnerabilities/9959; https://gkaim.com/cve-2019-14978-vikas-chaudhary/
CVE: CVE-2019-14979
Published: 2019-08-29
Description: cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://gkaim.com/cve-2019-14979-vikas-chaudhary/; https://wordpress.org/support/topic/vulnerabilty-in-plugin/#post-11899173; https://gkaim.com/cve-2019-14979-vikas-chaudhary/
CVE: CVE-2019-15811
Published: 2019-08-29
Description: In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154270/DomainMod-4.13-Cross-Site-Scripting.html; https://github.com/domainmod/domainmod/issues/108; https://zerodays.lol/
CVE: CVE-2019-11396
Published: 2019-08-29
Description: An issue was discovered in Avira Free Security Suite 10. The permissive access rights on the SoftwareUpdater folder (files / folders and configuration) are incompatible with the privileged file manipulation performed by the product. Files can be created that can be used by an unprivileged user to obtain SYSTEM privileges. Arbitrary file creation can be achieved by abusing the SwuConfig.json file creation: an unprivileged user can replace these files by pseudo-symbolic links to arbitrary files. When an update occurs, a privileged service creates a file and sets its access rights, offering write access to the Everyone group in any directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://packetstormsecurity.com/files/153868/Avira-Free-Security-Suite-2019-Software-Updater-2.0.6.13175-Improper-Access-Control.html; https://medium.com/sidechannel-br/vulnerabilidade-no-avira-security-suite-pode-levar-%C3%A0-escala%C3%A7%C3%A3o-de-privil%C3%A9gios-no-windows-71964236c077; https://seclists.org/fulldisclosure/2019/Aug/1
CVE: CVE-2019-11363
Published: 2019-08-29
Description: A SQL injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to execute arbitrary SQL commands via the AgentConsole/UserGroupQuery.php ShowUser parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://prophecyinternational.atlassian.net/wiki/spaces/SC7/pages/158760961/Release+Notes+for+Snare+Central+v7.4.5; https://prophecyinternational.atlassian.net/wiki/spaces/SC7/pages/158760961/Release+Notes+for+Snare+Central+v7.4.5
CVE: CVE-2019-11364
Published: 2019-08-29
Description: An OS Command Injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to inject arbitrary OS commands via the ServerConf/DataManagement/DiskManager.php FORMNAS_share parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://prophecyinternational.atlassian.net/wiki/spaces/SC7/pages/158760961/Release+Notes+for+Snare+Central+v7.4.5; https://prophecyinternational.atlassian.net/wiki/spaces/SC7/pages/158760961/Release+Notes+for+Snare+Central+v7.4.5
CVE: CVE-2019-8461
Published: 2019-08-29
Description: Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH location on a clean image without Endpoint Client installed. An attacker can leverage this to gain LPE using a specially crafted DLL placed in any PATH location accessible with write permissions to the user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-114, CWE-426
References: https://safebreach.com/Post/Check-Point-Endpoint-Security-Initial-Client-for-Windows-Privilege-Escalation-to-SYSTEM; https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk160812; https://safebreach.com/Post/Check-Point-Endpoint-Security-Initial-Client-for-Windows-Privilege-Escalation-to-SYSTEM
CVE: CVE-2018-15510
Published: 2019-08-30
Description: Cross-site scripting (XSS) vulnerability in the 'Certificate' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitrary web script or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.contextis.com/en/resources/advisories/cve-2018-15510; https://www.contextis.com/en/resources/advisories/cve-2018-15510
CVE: CVE-2018-15511
Published: 2019-08-30
Description: Cross-site scripting (XSS) vulnerability in the 'Notification template' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitrary web script or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.contextis.com/en/resources/advisories/cve-2018-15511; https://www.contextis.com/en/resources/advisories/cve-2018-15511
CVE: CVE-2018-15512
Published: 2019-08-30
Description: Cross-site scripting (XSS) vulnerability in the 'Authorisation Service' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitrary web script or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.contextis.com/en/resources/advisories/cve-2018-15512; https://www.contextis.com/en/resources/advisories/cve-2018-15512
CVE: CVE-2018-15513
Published: 2019-08-30
Description: Log viewer in totemomail 6.0.0 build 570 allows access to sessionIDs of high privileged users by leveraging access to a read-only auditor role.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://www.contextis.com/en/resources/advisories/cve-2018-15513; https://www.contextis.com/en/resources/advisories/cve-2018-15513
CVE: CVE-2018-18370
Published: 2019-08-30
Description: The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. A stored cross-site scripting (XSS) vulnerability in the WebFTP mode allows a remote attacker to inject malicious JavaScript code in ASG/ProxySG's web listing of a remote FTP server. Exploiting the vulnerability requires the attacker to be able to upload crafted files to the remote FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.symantec.com/us/en/article.SYMSA1472.html; https://support.symantec.com/us/en/article.SYMSA1472.html
CVE: CVE-2018-18371
Published: 2019-08-30
Description: The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. An information disclosure vulnerability in the WebFTP mode allows a malicious user to obtain plaintext authentication credentials for a remote FTP server from the ASG/ProxySG's web listing of the FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327
References: https://support.symantec.com/us/en/article.SYMSA1472.html; https://support.symantec.com/us/en/article.SYMSA1472.html
CVE: CVE-2019-11658
Published: 2019-08-30
Description: Information exposure in Micro Focus Content Manager, versions 9.1, 9.2 and 9.3. This vulnerability when configured to use an Oracle database, allows valid system users to gain access to a limited subset of records they would not normally be able to access when the system is in an undisclosed abnormal state.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://softwaresupport.softwaregrp.com/doc/KM03496282; https://softwaresupport.softwaregrp.com/doc/KM03496282
CVE: CVE-2019-12402
Published: 2019-08-30
Description: The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://lists.apache.org/thread.html/308cc15f1f1dc53e97046fddbac240e6cd16de89a2746cf257be7f5b%40%3Cdev.commons.apache.org%3E; https://lists.apache.org/thread.html/54cc4e9fa6b24520135f6fa4724dfb3465bc14703c7dc7e52353a0ea%40%3Ccommits.creadur.apache.org%3E; https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
CVE: CVE-2019-12753
Published: 2019-08-30
Description: An information disclosure vulnerability in Symantec Reporter web UI 10.3 prior to 10.3.2.5 allows a malicious authenticated administrator user to obtain passwords for external SMTP, FTP, FTPS, LDAP, and Cloud Log Download servers that they might not otherwise be authorized to access. The malicious administrator user can also obtain the passwords of other Reporter web UI users.
CVSS Score: 4.9 (MEDIUM)
References: https://support.symantec.com/us/en/article.SYMSA1489.html; https://support.symantec.com/us/en/article.SYMSA1489.html
CVE: CVE-2019-12754
Published: 2019-08-30
Description: Symantec My VIP portal, previous version which has already been auto updated, was susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users or potentially bypass access controls such as the same-origin policy.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://support.symantec.com/us/en/article.SYMSA1491.html; https://support.symantec.com/us/en/article.SYMSA1491.html
CVE: CVE-2019-13526
Published: 2019-08-30
Description: Datalogic AV7000 Linear barcode scanner all versions prior to 4.6.0.0 is vulnerable to authentication bypass, which may allow an attacker to remotely execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288, CWE-287
References: https://www.us-cert.gov/ics/advisories/icsa-19-239-02; https://www.us-cert.gov/ics/advisories/icsa-19-239-02
CVE: CVE-2019-1966
Published: 2019-08-30
Description: A vulnerability in a specific CLI command within the local management (local-mgmt) context for Cisco UCS Fabric Interconnect Software could allow an authenticated, local attacker to gain elevated privileges as the root user on an affected device. The vulnerability is due to extraneous subcommand options present for a specific CLI command within the local-mgmt context. An attacker could exploit this vulnerability by authenticating to an affected device, entering the local-mgmt context, and issuing a specific CLI command and submitting user input. A successful exploit could allow the attacker to execute arbitrary operating system commands as root on an affected device. The attacker would need to have valid user credentials for the device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-ucs-privescalation; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-ucs-privescalation
CVE: CVE-2019-1967
Published: 2019-08-30
Description: A vulnerability in the Network Time Protocol (NTP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to excessive use of system resources when the affected device is logging a drop action for received MODE_PRIVATE (Mode 7) NTP packets. An attacker could exploit this vulnerability by flooding the device with a steady stream of Mode 7 NTP packets. A successful exploit could allow the attacker to cause high CPU and memory usage on the affected device, which could cause internal system processes to restart or cause the affected device to unexpectedly reload. Note: The NTP feature is enabled by default.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399, CWE-400
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-ntp-dos; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-ntp-dos
CVE: CVE-2019-1968
Published: 2019-08-30
Description: A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly restart. The vulnerability is due to incorrect validation of the HTTP header of a request that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API on an affected device. A successful exploit could allow the attacker to cause a denial of service (DoS) condition in the NX-API service; however, the NX-OS device itself would still be available and passing network traffic. Note: The NX-API feature is disabled by default.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-116
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-api-dos; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-api-dos
CVE: CVE-2019-1969
Published: 2019-08-30
Description: A vulnerability in the implementation of the Simple Network Management Protocol (SNMP) Access Control List (ACL) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to perform SNMP polling of an affected device, even if it is configured to deny SNMP traffic. The vulnerability is due to an incorrect length check when the configured ACL name is the maximum length, which is 32 ASCII characters. An attacker could exploit this vulnerability by performing SNMP polling of an affected device. A successful exploit could allow the attacker to perform SNMP polling that should have been denied. The attacker has no control of the configuration of the SNMP ACL name.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-264, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-snmp-bypass; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-snmp-bypass
CVE: CVE-2019-1977
Published: 2019-08-30
Description: A vulnerability within the Endpoint Learning feature of Cisco Nexus 9000 Series Switches running in Application Centric Infrastructure (ACI) mode could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an endpoint device in certain circumstances. The vulnerability is due to improper endpoint learning when packets are received on a specific port from outside the ACI fabric and destined to an endpoint located on a border leaf when Disable Remote Endpoint Learning has been enabled. This can result in a Remote (XR) entry being created for the impacted endpoint that will become stale if the endpoint migrates to a different port or leaf switch. This results in traffic not reaching the impacted endpoint until the Remote entry can be relearned by another mechanism.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-371, CWE-371
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nexus-aci-dos; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nexus-aci-dos
CVE: CVE-2019-5608
Published: 2019-08-30
Description: In FreeBSD 12.0-STABLE before r350648, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350650, 11.3-RELEASE before 11.3-RELEASE-p2, and 11.2-RELEASE before 11.2-RELEASE-p13, the ICMPv6 input path incorrectly handles cases where an MLDv2 listener query packet is internally fragmented across multiple mbufs. A remote attacker may be able to cause an out-of-bounds read or write that may cause the kernel to attempt to access an unmapped page and subsequently panic.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-787
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-19:19.mldv2.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-19:19.mldv2.asc
CVE: CVE-2019-5609
Published: 2019-08-30
Description: In FreeBSD 12.0-STABLE before r350619, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350619, 11.3-RELEASE before 11.3-RELEASE-p2, and 11.2-RELEASE before 11.2-RELEASE-p13, the bhyve e1000 device emulation used a guest-provided value to determine the size of the on-stack buffer without validation when TCP segmentation offload is requested for a transmitted packet. A misbehaving bhyve guest could overwrite memory in the bhyve process on the host.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-19:21.bhyve.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-19:21.bhyve.asc
CVE: CVE-2019-5610
Published: 2019-08-30
Description: In FreeBSD 12.0-STABLE before r350637, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350638, 11.3-RELEASE before 11.3-RELEASE-p2, and 11.2-RELEASE before 11.2-RELEASE-p13, the bsnmp library is not properly validating the submitted length from a type-length-value encoding. A remote user could cause an out-of-bounds read or trigger a crash of the software such as bsnmpd resulting in a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://packetstormsecurity.com/files/153959/FreeBSD-Security-Advisory-FreeBSD-SA-19-20.bsnmp.html; https://seclists.org/bugtraq/2019/Aug/6; https://security.FreeBSD.org/advisories/FreeBSD-SA-19:20.bsnmp.asc
CVE: CVE-2019-5611
Published: 2019-08-30
Description: In FreeBSD 12.0-STABLE before r350828, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r350829, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, a missing check in the function to arrange data in a chain of mbufs could cause data returned not to be contiguous. Extra checks in the IPv6 stack could catch the error condition and trigger a kernel panic, leading to a remote denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/154170/FreeBSD-Security-Advisory-FreeBSD-SA-19-22.mbuf.html; https://seclists.org/bugtraq/2019/Aug/33; https://security.FreeBSD.org/advisories/FreeBSD-SA-19:22.mbuf.asc
CVE: CVE-2019-5612
Published: 2019-08-30
Description: In FreeBSD 12.0-STABLE before r351264, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r351265, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, the kernel driver for /dev/midistat implements a read handler that is not thread-safe. A multi-threaded program can exploit races in the handler to copy out kernel memory outside the boundaries of midistat's data buffer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-19:23.midi.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-19:23.midi.asc