huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2019-15924: kernel: null pointer dereference in drivers/net/ethernet/intel/fm10k/fm10k_main.c
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-09-04T00:00:00+00:00

A flaw was found in the way the fm10k driver in the Linux kernel reacted to memory-related errors during driver initialization. This flaw allows a local attacker to cause a denial of service and crash the system.

Statement: This issue is rated as having Low impact because of the low memory conditions needed to trigger this issue.

Affected upstream versions: n/a
Fixed upstream versions: v5.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 01ca667133d019edc9f0a1f70a272447c84ec41f
CVE-2019-15925: kernel: out-of-bounds access in function hclge_tm_schd_mode_vnet_base_cfg
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-09-04T00:00:00+00:00

An out-of-bounds access flaw was found in the hclge_shaper_para_calc driver in the Linux kernel. Access to an array with an index higher than its maximum index will lead to an out-of-bounds access vulnerability. This could affect both data confidentiality and integrity as well as system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 04f25edb48c441fc278ecc154c270f16966cbb90
CVE-2019-15927: kernel: out-of-bounds in function build_audio_procunit in sound/usb/mixer.c
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-09-04T00:00:00+00:00

An out-of-bounds flaw was found in the ALSA usb-audio subsystem in the Linux kernel. An array boundary check was needed to restrict the array size; failing this can cause an out-of-bound access problem. Data confidentiality and integrity, as well as system availability, are all threats with this vulnerability.


Affected upstream versions: n/a
Fixed upstream versions: v5.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: f4351a199cc120ff9d59e06d02e8657d08e6cc46
CVE-2019-15945: opensc: Out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c
Component: opensc
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 6.4 (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-09-06T00:00:00+00:00

OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.


Affected upstream versions: n/a
Fixed upstream versions: 0.20.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: 412a6142c27a5973c61ba540e33cdc22d5608e68
CVE-2019-15946: opensc: Out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c
Component: opensc
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 6.4 (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-09-06T00:00:00+00:00

OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.


Affected upstream versions: n/a
Fixed upstream versions: 0.20.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: a3fc7693f3a035a8a7921cffb98432944bb42740
CVE-2019-16056: python: email.utils.parseaddr wrongly parses email addresses
Component: python
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-07-19T00:00:00+00:00

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.


Affected upstream versions: n/a
Fixed upstream versions: 3.9
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9
CVE-2019-16163: oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c
Component: oniguruma
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-07-28T00:00:00+00:00

Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.


Affected upstream versions: n/a
Fixed upstream versions: v6.9.3
Upstream repository: https://github.com/kkos/oniguruma
Upstream fix commit: 4097828d7cc87589864fecf452f2cd46c5f37180
CVE-2019-16680: file-roller: path traversal vulnerability via a specially crafted filename contained in malicious archive
Component: file-roller
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Public date: 2018-03-14T00:00:00+00:00

A path traversal vulnerability was discovered in the file-roller (Archive Manager for GNOME) in the way file paths with special characters are sanitized. Archives containing the sequence of characters "../" in a file path may be vulnerable to this flaw. A remote attacker could exploit this flaw by creating a specially crafted archive with a file inside one or more sub-directories. When opened by a victim, the file-roller would extract the file in the current working directory instead of a sub-directory, as it may be expected by inspecting the archive.


Affected upstream versions: n/a
Fixed upstream versions: 3.29.91
Upstream repository: https://gitlab.gnome.org/GNOME/file-roller
Upstream fix commit: 57268e51e59b61c9e3125eb0f65551c7084297e2
CVE-2019-16782: rubygem-rack: hijack sessions by using timing attacks targeting the session id
Component: rubygem-rack
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2019-12-18T00:00:00+00:00

A flaw was found in rubygem-rack in versions prior to 1.6.12 and 2.0.8. An information leak may allow an attacker to find and hijack sessions using timing attacks targeting the session ID. The highest threat from the vulnerability is to data confidentiality.

Statement: Because Red Hat OpenStack Platform 13.0 Operational Tools packaged the flawed code, but does not use its functionality, its Impact has been reduced to 'Low'.

Affected upstream versions: before 1.6.12 or 2.0.8
Fixed upstream versions: 2.1.0
Upstream repository: https://github.com/rack/rack
Upstream fix commit: 7fecaee81f59926b6e1913511c90650e76673b38
CVE-2019-16785: waitress: HTTP request smuggling through LF vs CRLF handling
Component: waitress
Severity: Important
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N)
Public date: 2019-12-20T00:00:00+00:00

An HTTP-request vulnerability was discovered in Waitress which implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately, if a front-end server does not process header fields with an LF the same way as it processes those with a CRLF, it can lead to the front-end and the back-end server processing the same HTTP message in two different ways. This vulnerability can lead to a potential for HTTP request smuggling and splitting where Waitress may see two requests, while the front-end server only sees a single HTTP message.

Statement: All affected Red Hat products ship but do not use the flawed version of python-waitress. The impact for these products is therefore rated as having a security impact of Low.

In Red Hat OpenStack Platform 13,  because the flawed code is not used and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP13 python-waitress package.

Affected upstream versions: <= 1.3.1 <= 1.3.1
Fixed upstream versions: v1.4.0
Upstream repository: https://github.com/Pylons/waitress
Upstream fix commit: 8eba394ad75deaf9e5cd15b78a3d16b12e6b0eba
CVE-2019-16786: waitress: HTTP request smuggling through invalid Transfer-Encoding
Component: waitress
Severity: Important
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N)
Public date: 2019-12-20T00:00:00+00:00

An HTTP-interpretation flaw was found in waitress which did not properly validate incoming HTTP headers. When parsing the Transfer-Encoding header, waitress would look only for a single string value. According to the HTTP standard, Transfer-Encoding should be a comma-separated list, with the inner-most encoding first, followed by any further transfer codings, ending with 'chunked'. Because of this flaw, requests sent with: "Transfer-Encoding: gzip, chunked" would get ignored, and waitress would use the Content-Length header instead to determine the body size of the HTTP message. A remote attacker could exploit this flaw to force waitress to accept potentially bad HTTP requests or treat a single request as multiple requests in the case of HTTP pipelining.

Statement: All affected Red Hat products ship but do not use the flawed version of python-waitress. The impact for these products is therefore rated as having a security impact of Low.

In Red Hat OpenStack Platform 13,  because the flawed code is not used and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP13 python-waitress package.

Affected upstream versions: <= 1.3.1 <= 1.3.1
Fixed upstream versions: v1.4.0
Upstream repository: https://github.com/Pylons/waitress
Upstream fix commit: f11093a6b3240fc26830b6111e826128af7771c3
CVE-2019-16789: waitress: HTTP Request Smuggling through Invalid whitespace characters in headers
Component: waitress
Severity: Important
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)
Public date: 2019-12-26T00:00:00+00:00

An HTTP-interpretation flaw was found in waitress, through version 1.4.0. If a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server, an HTTP request splitting could occur which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation. The highest threat from this vulnerability is data integrity.

Statement: All affected Red Hat products ship but do not use the flawed version of python-waitress. The impact for these products is therefore rated as having a security impact of Low.

For Red Hat OpenStack Platform 13,  because the flaw has a lower impact and  the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP13 python-waitress package.

Affected upstream versions: < 1.4.1 < 1.4.1
Fixed upstream versions: 1.4.1
Upstream repository: https://github.com/Pylons/waitress
Upstream fix commit: 11d9e138125ad46e951027184b13242a3c1de017
CVE-2019-16892: cfme: rubygem-rubyzip denial of service via crafted ZIP file
Component: cfme
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-09-25T00:00:00+00:00

A vulnerability in Rubyzip, versions prior to 1.3.0, allows a crafted ZIP file to bypass application checks on ZIP entry sizes. This allows an attacker to spoof data regarding the uncompressed size of the ZIP file, causing a denial of service due to disk consumption. Availability of the system is the highest threat.

Statement: Red Hat CloudForms 4.7 (5.10.13) release is affected, but not vulnerable as they include fixes for Rubyzip version 1.3.0. This issue was fixed in RHBA-2019:4047 (https://access.redhat.com/errata/RHBA-2019:4047) as part of CFME component.

Affected upstream versions: n/a
Fixed upstream versions: v1.3.0
Upstream repository: https://github.com/rubyzip/rubyzip
Upstream fix commit: d65fe7bd283ec94f9d6dc7605f61a6b0dd00f55e
CVE-2019-16994: kernel: Memory leak in sit_init_net() in net/ipv6/sit.c
Component: kernel
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-09-30T00:00:00+00:00

A flaw was found in the way the sit_init_net function in the Linux kernel handled resource cleanup on errors. This flaw allows an attacker to use the error conditions to crash the system.

Statement: This issue is rated as having Low impact because of the preconditions needed to trigger the error/resource cleanup code path (system-wide out-of-memory condition, high privileges or physical access).

Affected upstream versions: n/a
Fixed upstream versions: v5.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 07f12b26e21ab359261bf75cfcb424fdc7daeb6d
CVE-2019-17053: kernel: unprivileged users able to create RAW sockets in AF_IEEE802154 network protocol
Component: kernel
Severity: Moderate
CWE: CWE-250 (Execution with Unnecessary Privileges)
CVSS v3: 4 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L)
Public date: 2019-09-20T00:00:00+00:00

A vulnerability was discovered in the Linux kernel's AF_IEEE802154 networking module where permissions checks are not enforced. This can allow an unprivileged user to create raw sockets for this protocol leading to the potential for data leaks or system unavailability.

Statement: This flaw is rated as moderate; there are no known exploits using this mechanism as an attack surface against the system affected by this bug.

Affected upstream versions: n/a
Fixed upstream versions: v5.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 0edc3f703f7bcaf550774b5d43ab727bcd0fe06b
CVE-2019-17055: kernel: unprivileged users able to create RAW sockets in AF_ISDN network protocol
Component: kernel
Severity: Moderate
CWE: CWE-250 (Execution with Unnecessary Privileges)
CVSS v3: 4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2019-09-20T00:00:00+00:00

A vulnerability was found in the Linux kernel’s implementation of the AF_ISDN protocol, which does not enforce the CAP_NET_RAW capability. This flaw can allow unprivileged users to create a raw socket for this protocol. This could further allow the user to control the availability of an existing ISDN circuit.


Affected upstream versions: n/a
Fixed upstream versions: v5.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 0edc3f703f7bcaf550774b5d43ab727bcd0fe06b
CVE-2019-17451: binutils: integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c
Component: binutils
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 4.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)
Public date: 2019-10-07T00:00:00+00:00

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as demonstrated by nm.


Affected upstream versions: n/a
Upstream repository: https://sourceware.org/git/binutils-gdb.git
Upstream fix commit: 336bfbeb1848f4b9558456fdcf283ee8a32d7fd1
CVE-2019-17498: libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c
Component: libssh2
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2019-10-16T00:00:00+00:00

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

Statement: This flaw needs a malicious MITM SSH server. When an application compiled with libssh2 connects to such a MITM SSH server, the server can trigger an integer overflow leading to an OOB read in the SSH_MSG_DISCONNECT logic. This can cause the application compiled with libssh2 to crash. This is strictly a client side crash and the SSH server may not be affected.

Also note that when a user connects to a malicious MITM server there is already a  risk of disclosing password/keys irrespective of the flaw.

Affected upstream versions: n/a
Fixed upstream versions: libssh2-1.10.0
Upstream repository: https://github.com/libssh2/libssh2
Upstream fix commit: dedcbd106f8e52d5586b0205bc7677e4c9868f9c
CVE-2019-17541: ImageMagick: Use after free in ReadICCProfile function in coders/jpeg.c
Component: ImageMagick
Severity: Moderate
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-07-14T00:00:00+00:00

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-55
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: 39f226a9c137f547e12afde972eeba7551124493
CVE-2019-17546: libtiff: integer overflow leading to heap-based buffer overflow in tif_getimage.c
Component: libtiff
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-08-15T00:00:00+00:00

tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.


Affected upstream versions: n/a
Fixed upstream versions: 2.4.4
Upstream repository: https://github.com/OSGeo/gdal
Upstream fix commit: 21674033ee246f698887604c7af7ba1962a40ddf
CVE-2019-17666: kernel: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain upper-bound check, leading to a buffer overflow
Component: kernel
Severity: Important
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 6.3 (CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H)
Public date: 2019-10-18T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of the RealTek wireless drivers WiFi-direct (or WiFi peer-to-peer) driver implementation. When the RealTek wireless networking hardware is configured to accept WiFi-Direct or WiFi P2P connections, an attacker within the wireless network connectivity radio range can exploit a flaw in the WiFi-direct protocol known as "Notice of Absence" by creating specially crafted frames which can then corrupt kernel memory as the upper bounds on the length of the frame is unchecked and supplied by the incoming packet.


Affected upstream versions: n/a
Fixed upstream versions: v5.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 8c55dedb795be8ec0cf488f98c03a1c2176f7fb1
CVE-2019-18197: libxslt: use after free in xsltCopyText in transform.c could lead to information disclosure
Component: libxslt
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-10-18T00:00:00+00:00

In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.

Statement: Red Hat OpenStack consumes fixes from the base Red Hat Enterprise Linux Operating System. Therefore the libxslt package provided by Red Hat OpenStack has been marked as 'will not fix'.

Affected upstream versions: n/a
Fixed upstream versions: v1.1.34
Upstream repository: https://gitlab.gnome.org/GNOME/libxslt
Upstream fix commit: 2232473733b7313d67de8836ea3b29eec6e8e285
CVE-2019-18218: file: heap-based buffer overflow in cdf_read_property_info in cdf.c
Component: file
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-08-26T00:00:00+00:00

cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).

Statement: This issue affects the `file` package as shipped with Red Hat Enterprise Linux 8. However, this flaw has been rated as having a security impact of Moderate because it is only exploitable if the 32bit version is used, for example when an application uses the 32bit version of libmagic.so.

Affected upstream versions: n/a
Fixed upstream versions: FILE5_38
Upstream repository: https://github.com/file/file
Upstream fix commit: 46a8443f76cec4b41ec736eca396984c74664f84
CVE-2019-18224: libidn2: heap-based buffer overflow in idn2_to_ascii_4i in lib/lookup.c
Component: libidn2
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2019-01-07T00:00:00+00:00

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.


Affected upstream versions: n/a
Fixed upstream versions: 2.2.0
Upstream repository: https://github.com/libidn/libidn2
Upstream fix commit: e4d1558aa2c1c04a05066ee8600f37603890ba8c
CVE-2019-18276: bash: when effective UID is not equal to its real UID the saved UID is not dropped
Component: bash
Severity: Low
CWE: CWE-271 (Privilege Dropping / Lowering Errors)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-07-01T00:00:00+00:00

A privilege escalation vulnerability was found in bash in the way it dropped privileges when started with an effective user id not equal to the real user id. Bash may be vulnerable to this flaw if the setuid permission is set and the owner of the bash program itself is a non-root user. A local attacker could exploit this flaw to escalate their privileges on the system.


Affected upstream versions: n/a
Upstream repository: https://github.com/bminor/bash
Upstream fix commit: 951bdaad7a18cc0dc1036bba86b18b90874d39ff