huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2020-11100: haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes
Component: haproxy
Severity: Critical
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-04-02T13:00:00+00:00

A flaw was found in the way HAProxy processed certain HTTP/2 request packets. This flaw allows an attacker to send crafted HTTP/2 request packets, which cause memory corruption, leading to a crash or potential remote arbitrary code execution with the permissions of the user running HAProxy.

Statement: HAProxy packages shipped with Red Hat Enterprise Linux 6 and 7 do not contain support for HTTP/2; therefore, they are not affected by this flaw.

OpenShift Container Platform versions through 4.3 contain the vulnerable code; exploitation requires setting ROUTER_USE_HTTP2 in the OpenShift Ingress Operator, which is not currently possible. The impact of this vulnerability is therefore reduced in OCP 4.x, prior to version 4.4, to low.

OpenShift Container Platform 3.11 added a configuration option to ose-haproxy-router that made enabling HTTP/2 support easy. However, it is not enabled by default on that version.

Affected upstream versions: n/a
Fixed upstream versions: v2.2.0
Upstream repository: https://git.haproxy.org/haproxy.git
Upstream fix commit: 5dfc5d5cd0d2128d77253ead3acf03a421ab5b88
CVE-2020-11501: gnutls: DTLS client hello contains a random value of all zeroes
Component: gnutls
Severity: Moderate
CWE: CWE-327 (Use of a Broken or Risky Cryptographic Algorithm)
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2020-03-27T00:00:00+00:00

A cryptographic weakness was found in the way DLTS implementation of GnuTLS, used zeros in place of random numbers. This flaw can break the security guarantee of the DTLS protocol.

Statement: The earliest affected version is gnuTLS-3.6.3. Therefore versions of gnuTLS shipped with Red Hat Enterprise Linux 5, 6 and 7 are not affected by this flaw.

Affected upstream versions: n/a
Fixed upstream versions: 3.6.13
Upstream repository: https://gitlab.com/gnutls/gnutls
Upstream fix commit: 5b595e8e52653f6c5726a4cdd8fddeb6e83804d2
CVE-2020-11525: freerdp: out-of-bounds read in bitmap.c
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 2.2 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)
Public date: 2020-04-09T00:00:00+00:00

libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.


Affected upstream versions: n/a
Fixed upstream versions: 2.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 58dc36b3c883fd460199cedb6d30e58eba58298c
CVE-2020-11565: kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)
Public date: 2020-04-01T00:00:00+00:00

An out-of-bounds write flaw was found in the Linux kernel. An empty nodelist in mempolicy.c is mishandled durig mount option parsing leading to a stack-based out-of-bounds write. The highest threat from this vulnerability is to system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.7
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: aa9f7d5172fac9bf1f09e678c35e287a40a7b7dd
CVE-2020-11608: kernel: NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs in drivers/media/usb/gspca/ov519.c
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.3 (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-03-12T00:00:00+00:00

A flaw was found in the way the ov519 driver in the Linux kernel handled certain types of USB descriptors. This flaw allows an attacker with the ability to induce the error conditions to crash the system.

Statement: This issue is rated as having Low impact because of the preconditions needed to trigger the issue (physical access).

Affected upstream versions: n/a
Fixed upstream versions: v5.7
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 998912346c0da53a6dbb71fab3a138586b596b30
CVE-2020-11668: kernel: mishandles invalid descriptors in drivers/media/usb/gspca/xirlink_cit.c
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Public date: 2020-01-03T00:00:00+00:00

A NULL pointer dereference flaw was found in the Xirlink camera USB driver 'xirlink-cit' in the Linux kernel. The driver mishandles invalid descriptors leading to a denial-of-service (DoS). This could allow a local attacker with user privilege to crash the system or leak kernel internal information.


Affected upstream versions: n/a
Fixed upstream versions: v5.7
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: a246b4d547708f33ff4d4b9a7a5dbac741dc89d8
CVE-2020-11669: kernel: powerpc: guest can cause DoS on POWER9 KVM hosts
Component: kernel
Severity: Moderate
CWE: CWE-393 (Return of Wrong Status Code)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-04-10T00:00:00+00:00

A flaw was found in the way Linux kernel running on the Power9  processor saves and restores its registers while going in and coming out of an idle state. The issue occurs when a guest kernel has Kernel Userspace Address Protection (KUAP) feature enabled. The idle_book3s function does not save and restore the Authority Mask Register (AMR), Authority Mask Override Register (AMOR) and User Authority Mask Override Register (UAMOR). A guest user may use this flaw to render the host system unusable resulting in DoS issue.

Statement: This issue does not affect the versions of the kernel package as shipped with the Red Hat Enterprise Linux 5, 6, 7, 8 and Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v5.2
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 53a712bae5dd919521a58d7bad773b949358add0
CVE-2020-11736: file-roller: directory traversal via directory symlink pointing outside of the target directory
Component: file-roller
Severity: Low
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 3.9 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L)
Public date: 2020-04-12T00:00:00+00:00

fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.


Affected upstream versions: n/a
Fixed upstream versions: 3.36.2
Upstream repository: https://gitlab.gnome.org/GNOME/file-roller
Upstream fix commit: 21dfcdbfe258984db89fb65243a1a888924e45a0
CVE-2020-11884: Kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation
Component: Kernel
Severity: Important
CWE: CWE-1251 (Mirrored Regions with Different Values)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-04-28T18:00:00+00:00

A flaw was found in the Linux kernel on s390 architecture. The issue occurs on multiprocessing systems when one s390 CPU is in Secondary Address Mode and another CPU does a kernel page table upgrade. An inter-processor interrupt (IPI) is then sent to each active CPU to update the control registers with new page table addresses. In Secondary Address Mode the CPU's CR1 register may hold kernel space address to fetch instructions from, but after IPI processing, the same CR1 register is set to point to a user space address. An unprivileged user or process on the system may use this flaw to crash the system or escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: This issue does not affect the versions of the kernel package as shipped with the Red Hat Enterprise Linux 5, 6, 7, and Red Hat Enterprise MRG 2.

This issue affects the versions of the kernel package as shipped with the Red Hat Enterprise Linux 8. Future kernel updates for the Red Hat Enterprise Linux 8 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v5.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3f777e19d171670ab558a6d5e6b1ac7f9b6c574f
CVE-2020-11945: squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution
Component: squid
Severity: Important
CWE: CWE-284 (Improper Access Control)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-04-24T00:00:00+00:00

A flaw was found in Squid, where a remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This issue occurs because the attacker can overflow the nonce reference counter, which results in remote code execution if the pooled token credentials are freed.


Affected upstream versions: n/a
Fixed upstream versions: SQUID_4_11
Upstream repository: https://github.com/squid-cache/squid
Upstream fix commit: eeebf0f37a72a2de08348e85ae34b02c34e9a811
CVE-2020-11947: QEMU: heap buffer overflow in iscsi_aio_ioctl_cb() in block/iscsi.c may lead to information disclosure
Component: QEMU
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 3.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
Public date: 2020-04-20T00:00:00+00:00

A heap buffer overflow flaw was found in the iSCSI support of QEMU. This flaw could lead to an out-of-bounds read access and possible information disclosure from the QEMU process memory to a malicious guest. The highest threat from this vulnerability is to data confidentiality.

Statement: This flaw has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 7. Red Hat Enterprise Linux 7 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v5.0.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: ff0507c239a246fd7215b31c5658fc6a3ee1e4c5
CVE-2020-12243: openldap: denial of service via nested boolean expressions in LDAP search filters
Component: openldap
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-04-28T00:00:00+00:00

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

Statement: This issue does not affect Red Hat Enterprise Linux 8 because we don't ship openldap-servers subpackage with the Red Hat Enterprise Linux 8  (it is only present in the buildroot).

Affected upstream versions: n/a
Fixed upstream versions: OPENLDAP_REL_ENG_2_4_50
Upstream repository: https://git.openldap.org/openldap/openldap
Upstream fix commit: 98464c11df8247d6a11b52e294ba5dd4f0380440
CVE-2020-12268: jbig2dec: heap-based buffer overflow in jbig2_image_compose in jbig2_image.c
Component: jbig2dec
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-01-27T00:00:00+00:00

An integer overflow was found in jbig2dec, which causes an out-of-bounds read/write in the jbig2_image_compose function. This flaw could potentially result in the execution of code on the system. Applications that use jbig2dec with untrusted input may be vulnerable to this flaw. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Affected upstream versions: n/a
Fixed upstream versions: 0.18
Upstream repository: https://github.com/ArtifexSoftware/jbig2dec
Upstream fix commit: 0726320a4b55078e9d8deb590e477d598b3da66e
CVE-2020-12464: kernel: use-after-free in usb_sg_cancel function in drivers/usb/core/message.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-03-23T00:00:00+00:00

A use-after-free flaw was found in usb_sg_cancel in drivers/usb/core/message.c in the USB core subsystem. This flaw allows a local attacker with a special user or root privileges to crash the system due to a race problem in the scatter-gather cancellation and transfer completion in usb_sg_wait. This vulnerability can also lead to a leak of internal kernel information.


Affected upstream versions: n/a
Fixed upstream versions: v5.7
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 056ad39ee9253873522f6469c3364964a322912b
CVE-2020-12465: kernel: buffer overflow in mt76_add_fragment function in drivers/net/wireless/mediatek/mt76/dma.c
Component: kernel
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-03-03T00:00:00+00:00

A memory overflow and data corruption flaw were found in the Mediatek MT76 driver module for WiFi in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c. An oversized packet with too many rx fragments causes an overflow and corruption in memory of adjacent pages. A local attacker with a special user or root privileges can cause a denial of service or a leak of internal kernel information.


Affected upstream versions: n/a
Fixed upstream versions: v5.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: b102f0c522cf668c8382c56a4f771b37d011cda2
CVE-2020-12653: kernel: buffer overflow in mwifiex_cmd_append_vsie_tlv function in drivers/net/wireless/marvell/mwifiex/scan.c
Component: kernel
Severity: Important
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-01-27T00:00:00+00:00

A flaw was found in the way the mwifiex_cmd_append_vsie_tlv()  in Linux kernel's Marvell WiFi-Ex driver handled vendor specific information elements. A local user could use this flaw to escalate their privileges on the system.


Affected upstream versions: n/a
Fixed upstream versions: v5.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: b70261a288ea4d2f4ac7cd04be08a9f0f2de4f4d
CVE-2020-12654: kernel: heap-based buffer overflow in mwifiex_ret_wmm_get_status function in drivers/net/wireless/marvell/mwifiex/wmm.c
Component: kernel
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.1 (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2020-01-27T00:00:00+00:00

A flaw was found in the Linux kernel. The Marvell mwifiex driver allows a remote WiFi access point to trigger a heap-based memory buffer overflow due to an incorrect memcpy operation. The highest threat from this vulnerability is to data integrity and system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 3a9b153c5591548612c3955c9600a98150c81875
CVE-2020-12655: kernel: sync of excessive duration via an XFS v5 image with crafted metadata
Component: kernel
Severity: Low
CWE: CWE-606 (Unchecked Input for Loop Condition)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2020-03-02T00:00:00+00:00

A flaw was discovered in the XFS source in the Linux kernel. This flaw allows an attacker with the ability to mount an XFS filesystem, to trigger a denial of service while attempting to sync a file located on an XFS v5 image with crafted metadata.

Statement: This issue is rated as having Low impact because of the preconditions needed to trigger it (administrative account or physical access).

Affected upstream versions: n/a
Fixed upstream versions: v5.7
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: d0c7feaf87678371c2c09b3709400be416b2dc62
CVE-2020-12657: kernel: use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-05-05T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of the BFQ IO scheduler. This flaw allows a local user able to groom system memory to cause kernel memory corruption and possible privilege escalation by abusing a race condition in the IO scheduler.


Affected upstream versions: n/a
Fixed upstream versions: v5.7
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 2f95fa5c955d0a9987ffdc3a095e2f4e62c5f2a9
CVE-2020-12659: kernel: xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write which could result in crash and data coruption
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-05-05T00:00:00+00:00

An out-of-bounds (OOB) memory access flaw was found in the Network XDP (the eXpress Data Path) module in the Linux kernel's xdp_umem_reg function in net/xdp/xdp_umem.c. When a user with special user privilege of CAP_NET_ADMIN (or root) calls setsockopt to register umem ring on XDP socket, passing the headroom value larger than the available space in the chunk, it leads to an out-of-bounds write, causing panic or possible memory corruption. This flaw may lead to privilege escalation if a local end-user is granted permission to influence the execution of code in this manner.


Affected upstream versions: n/a
Fixed upstream versions: v5.7
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02
CVE-2020-12723: perl: corruption of intermediate language state of compiled regular expression due to recursive S_study_chunk() calls leads to DoS
Component: perl
Severity: Moderate
CWE: CWE-624 (Executable Regular Expression Error)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-06-02T00:00:00+00:00

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

Statement: A vulnerability in the Perl regular expression compiler affects Red Hat Enterprise Linux 7 and 8. The flaw exists in the S_study_chunk() function's handling of GOSUB opcodes during regular expression compilation. When processing untrusted regular expressions, recursive calls to S_study_chunk() can corrupt the intermediate language state, allowing an attacker to inject malicious instructions into the compiled regular expression. This network-accessible vulnerability can lead to denial of service. To mitigate, applications should not allow compilation of untrusted regular expressions. Note that this issue affects regular expression compilation, not pattern matching against untrusted input.

Affected upstream versions: n/a
Fixed upstream versions: v5.30.3
Upstream repository: https://github.com/perl/perl5
Upstream fix commit: 66bbb51b93253a3f87d11c2695cfb7bdb782184a
CVE-2020-12770: kernel: sg_write function lacks an sg_remove_request call in a certain failure case
Component: kernel
Severity: Moderate
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-04-14T00:00:00+00:00

A vulnerability was found in sg_write in drivers/scsi/sg.c in the SCSI generic (sg) driver subsystem. This flaw allows an attacker with local access and special user or root privileges to cause a denial of service if the allocated list is not cleaned with an invalid (Sg_fd * sfp) pointer at the time of failure, also possibly causing a kernel internal information leak problem.


Affected upstream versions: n/a
Fixed upstream versions: v5.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 83c6f2390040f188cc25b270b4befeb5628c1aee
CVE-2020-12826: kernel: possible to send arbitrary signals to a privileged (suidroot) parent process
Component: kernel
Severity: Moderate
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2020-05-12T05:40:00+00:00

A flaw was found in the Linux kernel loose validation of child/parent process identification handling while filtering signal handlers.  A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.


Affected upstream versions: n/a
Fixed upstream versions: v5.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: d1e7fd6462ca9fc76650fbe6ca800e35b24267da
CVE-2020-13112: libexif: several buffer over-reads in EXIF MakerNote handling can lead to information disclosure and DoS
Component: libexif
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Public date: 2020-05-16T00:00:00+00:00

A heap-buffer out-of-bounds read flaw was found in libexif's MakerNote tag parser. This flaw allows an unauthenticated attacker or authenticated attacker with low privileges to exploit the flaw remotely in an application that uses libexif to process EXIF data from media files if the file upload is allowed. An attacker could create a specially crafted image file that, when processed by libexif, would cause the application to crash or, potentially expose data from the application's memory. This attack leads to a denial of service or a memory information leak that could assist in further exploitation.


Affected upstream versions: n/a
Fixed upstream versions: libexif-0_6_22-release
Upstream repository: https://github.com/libexif/libexif
Upstream fix commit: 435e21f05001fb03f9f186fa7cbc69454afd00d1
CVE-2020-13113: libexif: use of uninitialized memory in EXIF Makernote handling can lead to crashes and use-after-free
Component: libexif
Severity: Moderate
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Public date: 2020-05-16T00:00:00+00:00

An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.


Affected upstream versions: n/a
Fixed upstream versions: libexif-0_6_22-release
Upstream repository: https://github.com/libexif/libexif
Upstream fix commit: ec412aa4583ad71ecabb967d3c77162760169d1f
CVE-2020-13114: libexif: unrestricted size in handling Canon EXIF MakerNote data can lead to consumption of large amounts of compute time
Component: libexif
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-05-16T00:00:00+00:00

An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data.


Affected upstream versions: n/a
Fixed upstream versions: libexif-0_6_22-release
Upstream repository: https://github.com/libexif/libexif
Upstream fix commit: e6a38a1a23ba94d139b1fa2cd4519fdcfe3c9bab
CVE-2020-13249: mariadb-connector-c: Improper validation of content in a OK packet received from server
Component: mariadb-connector-c
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2020-05-20T00:00:00+00:00

libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.


Affected upstream versions: n/a
Fixed upstream versions: v3.1.8
Upstream repository: https://github.com/mariadb-corporation/mariadb-connector-c
Upstream fix commit: 2759b87d72926b7c9b5426437a7c8dd15ff57945