huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2018-19477: ghostscript: access bypass in psi/zfjbig2.c (700168)
Component: ghostscript
Severity: Important
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-11-20T00:00:00+00:00

psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode type confusion.

Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: ghostpdl-9.26
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: ef252e7dc214bcbd9a2539216aab9202848602bb
CVE-2018-19486: git: Improper handling of PATH allows for commands to be executed from the current directory
Component: git
Severity: Important
CWE: CWE-426 (Untrusted Search Path)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-10-24T00:00:00+00:00

Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.


Affected upstream versions: n/a
Fixed upstream versions: v2.19.2
Upstream repository: https://git.kernel.org/pub/scm/git/git.git
Upstream fix commit: 321fd82389742398d2924640ce3a61791fd27d60
CVE-2018-19622: wireshark: Infinite loop in the MMSE dissector
Component: wireshark
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-11-27T00:00:00+00:00

A vulnerability in MMSE dissector allows Wireshark to loop infinitely when parsing a specially crafted pcap file. Remote attacker could cause a denial of service to Wireshark by injecting malicious packets into the network that are automatically processed.

Statement: This issue affects the versions of wireshark as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v2.4.11
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 3b7555d32d11862f0e500ec466ad6bfe54190076
CVE-2018-19824: kernel: Use-after-free in sound/usb/card.c:usb_audio_probe()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.6 (CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-12-04T00:00:00+00:00

A flaw was found In the Linux kernel, through version 4.19.6, where a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c.  An attacker could corrupt memory and possibly escalate privileges if the attacker is able to have physical access to the system.


Affected upstream versions: n/a
Fixed upstream versions: v4.20
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 5f8cf712582617d523120df67d392059eaf2fc4b
CVE-2018-19840: wawpack: Infinite loop in WavpackPackInit function lead to DoS
Component: wawpack
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-11-26T00:00:00+00:00

The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero.

Statement: This issue affects the versions of wavpack as shipped with Red Hat Enterprise Linux 6 and 7.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: 5.2.0
Upstream repository: https://github.com/dbry/WavPack
Upstream fix commit: 070ef6f138956d9ea9612e69586152339dbefe51
CVE-2018-19841: wawpack: Out-of-bounds read in WavpackVerifySingleBlock function leads to DoS
Component: wawpack
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-11-29T00:00:00+00:00

The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack.

Statement: This issue did not affect the versions of wavpack as shipped with Red Hat Enterprise Linux 6 and 7.

Affected upstream versions: n/a
Fixed upstream versions: 5.2.0
Upstream repository: https://github.com/dbry/WavPack
Upstream fix commit: bba5389dc598a92bdf2b297c3ea34620b6679b5b
CVE-2018-19854: kernel: Information Disclosure in crypto_report_one in crypto/crypto_user.c
Component: kernel
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2018-11-03T00:00:00+00:00

An issue was discovered in the Linux kernel in the crypto_report_one() and related functions in the crypto/crypto_user.c (the crypto user configuration API) which do not fully initialize structures that are copied to userspace, potentially leaking sensitive kernel memory content to a userspace.


Affected upstream versions: n/a
Fixed upstream versions: v4.20
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: f43f39958beb206b53292801e216d9b8a660f087
CVE-2018-20102: haproxy: Out-of-bounds read in dns.c:dns_validate_dns_response() allows for memory disclosure
Component: haproxy
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Public date: 2018-12-12T00:00:00+00:00

An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due to a missing check when validating DNS responses, remote attackers might be able read the 16 bytes corresponding to an AAAA record from the non-initialized part of the buffer, possibly accessing anything that was left on the stack, or even past the end of the 8193-byte buffer, depending on the value of accepted_payload_size.

Statement: This issue did not affect the versions of haproxy as shipped with Red Hat Enterprise Linux 6 and 7.

Affected upstream versions: n/a
Fixed upstream versions: v1.9.0
Upstream repository: https://git.haproxy.org/haproxy.git
Upstream fix commit: efbbdf72992cd20458259962346044cafd9331c0
CVE-2018-20103: haproxy: Infinite recursion via crafted packet allows stack exhaustion and denial of service
Component: haproxy
Severity: Important
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-12-12T00:00:00+00:00

An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion.

Statement: This issue did not affect the versions of haproxy as shipped with Red Hat Enterprise Linux 6 and 7.

Affected upstream versions: n/a
Fixed upstream versions: v1.9.0
Upstream repository: https://git.haproxy.org/haproxy.git
Upstream fix commit: 58df5aea0a0c926b2238f65908f5e9f83d1cca25
CVE-2018-20169: kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.4 (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-12-05T00:00:00+00:00

A flaw was discovered in the Linux kernel's USB subsystem in the __usb_get_extra_descriptor() function in the drivers/usb/core/usb.c which mishandles a size check during the reading of an extra descriptor data. By using a specially crafted USB device which sends a forged extra descriptor, an unprivileged user with physical access to the system can potentially cause a  privilege escalation or trigger a system crash or lock up and thus to cause a denial of service (DoS).


Affected upstream versions: n/a
Fixed upstream versions: v4.20
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 704620afc70cf47abb9d6a1a57f3825d2bca49cf
CVE-2018-20217: krb5: Reachable assertion in the KDC using S4U2Self requests
Component: krb5
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-12-02T00:00:00+00:00

A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.


Affected upstream versions: n/a
Fixed upstream versions: krb5-1.18-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: 5e6d1796106df8ba6bc1973ee0917c170d929086
CVE-2018-20406: python: Integer overflow in Modules/_pickle.c allows for memory exhaustion if serializing gigabytes of data
Component: python
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-09-21T00:00:00+00:00

Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.7, v3.6.7rc1, v3.6.7rc2, v3.6.8, v3.6.8rc1, v3.6.9, v3.6.9rc1; v3.7.1, v3.7.1rc1, v3.7.1rc2, v3.7.2, v3.7.2rc1, v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Statement: This issue did not affect the versions of python as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Affected upstream versions: n/a
Fixed upstream versions: 3.8
Upstream repository: https://github.com/python/cpython
Upstream fix commit: a4ae828ee416a66d8c7bf5ee71d653c2cc6a26dd
CVE-2018-20467: ImageMagick: infinite loop in coders/bmp.c
Component: ImageMagick
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-12-06T00:00:00+00:00

In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.

Statement: This issue affects the versions of ImageMagick as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-16
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: db0add932fb850d762b02604ca3053b7d7ab6deb
CVE-2018-20650: poppler: reachable Object::dictLookup assertion in FileSpec class in FileSpec.cc
Component: poppler
Severity: Low
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-12-28T00:00:00+00:00

A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.


Affected upstream versions: n/a
Fixed upstream versions: poppler-0.73.0
Upstream repository: https://gitlab.freedesktop.org/poppler/poppler
Upstream fix commit: de0c0b8324e776f0b851485e0fc9622fc35695b7
CVE-2018-20662: poppler: SIGABRT PDFDoc::setup class in PDFDoc.cc
Component: poppler
Severity: Low
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-12-30T00:00:00+00:00

In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing.


Affected upstream versions: n/a
Fixed upstream versions: poppler-0.73.0
Upstream repository: https://gitlab.freedesktop.org/poppler/poppler
Upstream fix commit: 9fd5ec0e6e5f763b190f2a55ceb5427cfe851d5f
CVE-2018-20685: openssh: scp client improper directory name validation
Component: openssh
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2018-11-16T00:00:00+00:00

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.

Statement: This issue affects the scp client shipped with openssh. The SSH protocol or the SSH client is not affected. For more detailed analysis please refer to: https://bugzilla.redhat.com/show_bug.cgi?id=1665785#c4

Affected upstream versions: n/a
Fixed upstream versions: V_8_0_P1
Upstream repository: https://github.com/openssh/openssh-portable
Upstream fix commit: 6010c0303a422a9c5fa8860c061bf7105eb7f8b2
CVE-2018-20784: kernel: infinite loop in update_blocked_averages() in kernel/sched/fair.c leading to denial of service
Component: kernel
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-12-28T00:00:00+00:00

The CFS Linux kernel scheduler mishandles handling of leaf cfs_rq's in the kernel/sched/fair.c code, which allows a local unprivileged attacker to cause a denial of service (DoS) by entering an infinite loop in update_blocked_averages() function by inducing a high load on a system. Due to the nature of the flaw, a remote network attack (by initiating a magnitude of remote requests) cannot be fully ruled out.


Affected upstream versions: n/a
Fixed upstream versions: v5.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: c40f7d74c741a907cfaeb73a7697081881c497d0
CVE-2018-20815: QEMU: device_tree: heap buffer overflow while loading device tree blob
Component: QEMU
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H)
Public date: 2018-12-14T00:00:00+00:00

A heap buffer overflow issue was found in the load_device_tree() function of QEMU, which is invoked to load a device tree blob at boot time. It occurs due to device tree size manipulation before buffer allocation, which could overflow a signed int type. A user/process could use this flaw to potentially execute arbitrary code on a host system with privileges of the QEMU process.


Affected upstream versions: n/a
Fixed upstream versions: v4.0.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: da885fe1ee8b4589047484bd7fa05a4905b52b17
CVE-2018-20834: nodejs-tar: Arbitrary file overwrites when extracting tarballs containing a hard-link
Component: nodejs-tar
Severity: Important
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-04-30T00:00:00+00:00

A flaw was found in nodejs-tar in versions prior to 4.4.2. An arbitrary file overwrite can occur when extracting tarballs containing a hard-link to a file that already exists in the system. Further, a file that matches the hard-link may overwrite the system's files with the contents of the extracted file. The highest threat from the vulnerability is to data confidentiality and integrity as well as system availability.

Statement: In Red Hat OpenShift Logging the openshift-logging/kibana6-rhel8 container bundles many nodejs packages as a build time dependencies, including the tar package. 
The vulnerable nodejs tar package is not used in a way that makes this vulnerability exploitable, hence the impact to OpenShift Logging by this vulnerability is Low.

Affected upstream versions: n/a
Fixed upstream versions: v4.4.2
Upstream repository: https://github.com/npm/node-tar
Upstream fix commit: b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8
CVE-2018-20836: kernel: race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c leads to use-after-free
Component: kernel
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-09-25T00:00:00+00:00

A flaw was found in the Linux kernel’s implementation of the SAS expander subsystem, where a race condition exists in the smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c. An attacker could abuse this flaw to corrupt memory and escalate privileges.


Affected upstream versions: n/a
Fixed upstream versions: v4.20
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: b90cd6f2b905905fb42671009dc0e27c310a16ae
CVE-2018-20843: expat: large number of colons in input makes parser consume high amount of resources, leading to DoS
Component: expat
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-06-24T00:00:00+00:00

It was discovered that the "setElementTypePrefix()" function incorrectly extracted XML namespace prefixes. By tricking an application into processing a specially crafted XML file, an attacker could cause unusually high consumption of memory resources and possibly lead to a denial of service.

Statement: When processing a specially crafted XML file, expat may use more memory than ultimately necessary, which can also lead to increased CPU usage and longer processing times. Depending on available system resources and configuration, this may also lead to the application triggering the Out-Of-Memory-Killer, causing the application to be terminated.

Affected upstream versions: n/a
Fixed upstream versions: R_2_2_7
Upstream repository: https://github.com/libexpat/libexpat
Upstream fix commit: 11f8838bf99ea0a6f0b76f9760c43704d00c4ff6
CVE-2018-20845: openjpeg: division-by-zero in functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c
Component: openjpeg
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2019-06-26T00:00:00+00:00

Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).


Affected upstream versions: n/a
Fixed upstream versions: v2.3.1
Upstream repository: https://github.com/uclouvain/openjpeg
Upstream fix commit: c5bd64ea146162967c29bd2af0cbb845ba3eaaaf
CVE-2018-20847: openjpeg: integer overflow in function opj_get_encoding_parameters in openjp2/pi.c
Component: openjpeg
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2019-06-26T00:00:00+00:00

An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow.

Statement: This issue did not affect the versions of openjpeg as shipped with Red Hat Enterprise Linux 7 as they did not include the vulnerable code, due to an older version of the tool being shipped.
This issue did not affect the versions of openjpeg2 as shipped with Red Hat Enterprise Linux 7 as they already contain the patched code.

Affected upstream versions: n/a
Fixed upstream versions: v2.3.1
Upstream repository: https://github.com/uclouvain/openjpeg
Upstream fix commit: c58df149900df862806d0e892859b41115875845
CVE-2018-20856: kernel: Use-after-free in __blk_drain_queue() function in block/blk-core.c
Component: kernel
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-07-26T00:00:00+00:00

A flaw was found in the Linux kernel’s block driver implementation (blk_drain_queue() function) where a use-after-free condition could be triggered while draining the outstanding command queue in the systems block device subsystem. An attacker could use this flaw to crash the system or corrupt local memory, which may lead to privilege escalation.


Affected upstream versions: n/a
Fixed upstream versions: v4.19
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 54648cf1ec2d7f4b6a71767799c45676a138ca24
CVE-2018-20969: patch: do_ed_script in pch.c does not block strings beginning with a ! character
Component: patch
Severity: Important
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-08-16T00:00:00+00:00

A flaw was found in GNU patch through version 2.7.6. Strings beginning with a exclamation mark are not blocked by default. When ed receives an exclamation mark-prefixed command line argument, the argument is executed as a shell command. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/patch.git
Upstream fix commit: 3fcd042d26d70856e826a42b5f93dc4854d80bf0