huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2018-14719: jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes
Component: jackson-databind
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-07-27T00:00:00+00:00

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using blaze classes. An attacker could use this flaw to execute arbitrary code.

Statement: The following Red Hat products are not affected by this issue as they do not bundle or provide the requisite gadget jars to exploit this vulnerability:
Red Hat Satellite 6
Red Hat Enterprise Virtualization 4
Red Hat Fuse 6, 7, and Fuse Integration Services 2
Red Hat A-MQ 6

Affected upstream versions: n/a
Fixed upstream versions: jackson-databind-2.6.7.2
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: 87d29af25e82a249ea15858e2d4ecbf64091db44
CVE-2018-14720: jackson-databind: exfiltration/XXE in some JDK classes
Component: jackson-databind
Severity: Moderate
CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2018-07-27T00:00:00+00:00

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the slf4j, flex messaging, sun DRSHelper and JAX-WS gadgets when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

Statement: Red Hat Satellite 6 is not affected by this issue, since its only supported Java runtime (openJDK) doesn't bundle the com.sun.deploy.security.ruleset.DRSHelper class.

Red Hat Enterprise Virtualization 4 is not affected by this issue, since its only supported Java runtime (openJDK) doesn't bundle the com.sun.deploy.security.ruleset.DRSHelper class.

Affected upstream versions: n/a
Fixed upstream versions: jackson-databind-2.6.7.2
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: 87d29af25e82a249ea15858e2d4ecbf64091db44
CVE-2018-14721: jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class
Component: jackson-databind
Severity: Moderate
CWE: CWE-352 (Cross-Site Request Forgery (CSRF))
CVSS v3: 6.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)
Public date: 2018-07-27T00:00:00+00:00

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

Statement: Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn't bundle axis2-jaxws jar.

Red Hat Virtualization is not affected by this issue, since its does not bundle axis2-jaxws jar.

Affected upstream versions: n/a
Fixed upstream versions: jackson-databind-2.6.7.2
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: 87d29af25e82a249ea15858e2d4ecbf64091db44
CVE-2018-14734: kernel: use-after-free in ucma_leave_multicast in drivers/infiniband/core/ucma.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2018-06-01T00:00:00+00:00

A flaw was found in the Linux Kernel in the ucma_leave_multicast() function in drivers/infiniband/core/ucma.c which allows access to a certain data structure after freeing it in ucma_process_join(). This allows an attacker to cause a use-after-free bug and to induce kernel memory corruption, leading to a system crash or other unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.


Affected upstream versions: n/a
Fixed upstream versions: v4.18
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: cb2595c1393b4a5211534e6f0a0fbad369e21ad8
CVE-2018-14879: tcpdump: Out of bounds read/write in in get_next_file() in tcpdump.c
Component: tcpdump
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-10-02T00:00:00+00:00

An out-of-bounds write vulnerability was discovered in tcpdump while reading the file passed to the -V option of the command line program. An attacker may abuse this flaw by tricking a victim user into using a malicious file with the -V option, which would make the program read one byte before a stack-based allocated buffer and potentially write a NULL byte to it.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: 9ba91381954ad325ea4fd26b9c65a8bd9a2a85b6
CVE-2018-14880: tcpdump: Buffer over-read in ospf6_print_lshdr() function in print-ospf6.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

An out-of-bounds read vulnerability was discovered in tcpdump while printing OSPFv3 packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: e01c9bf76740802025c9328901b55ee4a0c49ed6
CVE-2018-14881: tcpdump: Buffer over-read in bgp_capabilities_print() function in print-bgp.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

An out-of-bounds read vulnerability was discovered in tcpdump while printing BGP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: 86326e880d31b328a151d45348c35220baa9a1ff
CVE-2018-14882: tcpdump: Buffer over-read in function rpl_dio_printopt in print-icmp6.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

An out-of-bounds read vulnerability was discovered in tcpdump while printing ICMP6 packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: d7505276842e85bfd067fa21cdb32b8a2dc3c5e4
CVE-2018-15473: openssh: User enumeration via malformed packets in authentication requests
Component: openssh
Severity: Low
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2018-08-16T00:00:00+00:00

A user enumeration vulnerability flaw was found in OpenSSH, though version 7.7. The vulnerability occurs by not delaying bailout for an invalid authenticated user until after the packet containing the request has been fully parsed. The highest threat from this vulnerability is to data confidentiality.

Statement: Red Hat Product Security has rated this issue as having Low severity. An attacker could use this flaw to determine whether given usernames exist or not on the server, but no further information is disclosed and there is no availability or integrity impact. A future update may address this issue.

Affected upstream versions: n/a
Upstream repository: https://github.com/openbsd/src
Upstream fix commit: 779974d35b4859c07bc3cb8a12c74b43b0a7d1e0
CVE-2018-15594: kernel: Mishandling of indirect calls weakens Spectre mitigation for paravirtual guests
Component: kernel
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.6 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)
Public date: 2018-08-03T00:00:00+00:00

It was found that paravirt_patch_call/jump() functions in the arch/x86/kernel/paravirt.c in the Linux kernel mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtualized guests.


Affected upstream versions: n/a
Fixed upstream versions: v4.19
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 5800dc5c19f34e6e03b5adab1282535cb102fafd
CVE-2018-15853: libxkbcommon: xkbcomp: Endless recursion in xkbcomp/expr.c resulting in a crash
Component: libxkbcommon
Severity: Low
CWE: CWE-674 (Uncontrolled Recursion)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-03-10T00:00:00+00:00

An uncontrolled recursion flaw was found in libxkbcommon and xkbcomp in the way it parses boolean expressions. A specially crafted file provided to xkbcomp could crash the application.


Affected upstream versions: n/a
Fixed upstream versions: xkbcommon-0.8.1
Upstream repository: https://github.com/xkbcommon/libxkbcommon
Upstream fix commit: 1f9d1248c07cda8aaff762429c0dce146de8632a
CVE-2018-15854: libxkbcommon: NULL pointer dereference resulting in a crash
Component: libxkbcommon
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-03-10T00:00:00+00:00

Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly.


Affected upstream versions: n/a
Fixed upstream versions: xkbcommon-0.8.1
Upstream repository: https://github.com/xkbcommon/libxkbcommon
Upstream fix commit: e3cacae7b1bfda0d839c280494f23284a1187adf
CVE-2018-15855: libxkbcommon: NULL pointer dereference when handling xkb_geometry
Component: libxkbcommon
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-03-11T00:00:00+00:00

Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled.


Affected upstream versions: n/a
Fixed upstream versions: xkbcommon-0.8.1
Upstream repository: https://github.com/xkbcommon/libxkbcommon
Upstream fix commit: 917636b1d0d70205a13f89062b95e3a0fc31d4ff
CVE-2018-15856: libxkbcommon: Infinite loop when reaching EOL unexpectedly resulting in a crash
Component: libxkbcommon
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-03-12T00:00:00+00:00

An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted keymap files.


Affected upstream versions: n/a
Fixed upstream versions: xkbcommon-0.8.1
Upstream repository: https://github.com/xkbcommon/libxkbcommon
Upstream fix commit: 842e4351c2c97de6051cab6ce36b4a81e709a0e1
CVE-2018-15857: libxkbcommon: Invalid free in ExprAppendMultiKeysymList resulting in a crash
Component: libxkbcommon
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2018-07-30T00:00:00+00:00

An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file.


Affected upstream versions: n/a
Fixed upstream versions: xkbcommon-0.8.1
Upstream repository: https://github.com/xkbcommon/libxkbcommon
Upstream fix commit: c1e5ac16e77a21f87bdf3bc4dea61b037a17dddb
CVE-2018-15859: libxkbcommon: xkbcomp: NULL pointer dereference when parsing invalid atoms in ExprResolveLhs resulting in a crash
Component: libxkbcommon
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2017-10-30T00:00:00+00:00

Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled.


Affected upstream versions: n/a
Fixed upstream versions: xkbcommon-0.8.2
Upstream repository: https://github.com/xkbcommon/libxkbcommon
Upstream fix commit: bb4909d2d8fa6b08155e449986a478101e2b2634
CVE-2018-15861: libxkbcommon: xkbcomp: NULL pointer dereference in ExprResolveLhs resulting in a crash
Component: libxkbcommon
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2017-06-26T00:00:00+00:00

Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure.


Affected upstream versions: n/a
Fixed upstream versions: xkbcommon-0.8.2
Upstream repository: https://github.com/xkbcommon/libxkbcommon
Upstream fix commit: 38e1766bc6e20108948aec8a0b222a4bad0254e9
CVE-2018-15862: libxkbcommon: NULL pointer dereference in LookupModMask resulting in a crash
Component: libxkbcommon
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2017-06-26T00:00:00+00:00

Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers.


Affected upstream versions: n/a
Fixed upstream versions: xkbcommon-0.8.2
Upstream repository: https://github.com/xkbcommon/libxkbcommon
Upstream fix commit: 4e2ee9c3f6050d773f8bbe05bc0edb17f1ff8371
CVE-2018-15863: libxkbcommon: xkbcomp: NULL pointer dereference in ResolveStateAndPredicate resulting in a crash
Component: libxkbcommon
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2017-06-26T00:00:00+00:00

Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression.


Affected upstream versions: n/a
Fixed upstream versions: xkbcommon-0.8.2
Upstream repository: https://github.com/xkbcommon/libxkbcommon
Upstream fix commit: 96df3106d49438e442510c59acad306e94f3db4d
CVE-2018-15864: libxkbcommon: NULL pointer dereference in resolve_keysym resulting in a crash
Component: libxkbcommon
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2017-06-26T00:00:00+00:00

Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created.


Affected upstream versions: n/a
Fixed upstream versions: xkbcommon-0.8.2
Upstream repository: https://github.com/xkbcommon/libxkbcommon
Upstream fix commit: a8ea7a1d3daa7bdcb877615ae0a252c189153bd2
CVE-2018-15908: ghostscript: .tempfile file permission issues (699657)
Component: ghostscript
Severity: Important
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-08-21T00:00:00+00:00

It was discovered that the ghostscript .tempfile function did not properly handle file permissions. An attacker could possibly exploit this to exploit this to bypass the -dSAFER protection and delete files or disclose their content via a specially crafted PostScript document.


Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 0d3901189f245232f0161addf215d7268c4d05a3
CVE-2018-15909: ghostscript: shading_param incomplete type checking (699660)
Component: ghostscript
Severity: Important
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-08-28T00:00:00+00:00

It was discovered that the ghostscript .shfill operator did not properly validate certain types. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted PostScript document.

Statement: This issue affects the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: e01e77a36cbb2e0277bc3a63852244bec41be0f6
CVE-2018-15910: ghostscript: LockDistillerParams type confusion (699656)
Component: ghostscript
Severity: Important
CWE: CWE-704 (Incorrect Type Conversion or Cast)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-08-21T00:00:00+00:00

It was discovered that the type of the LockDistillerParams parameter is not properly verified. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted PostScript document.

Statement: This issue affects the versions of ghostscript as shipped with Red Hat Enterprise Linux 6 and 7.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: c3476dde7743761a4e1d39a631716199b696b880
CVE-2018-15911: ghostscript: Uninitialized memory access in the aesdecode operator (699665)
Component: ghostscript
Severity: Moderate
CWE: CWE-456 (Missing Initialization of a Variable)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-06T00:00:00+00:00

It was discovered that ghostscript did not properly verify the key used in aesdecode. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted PostScript document.

Statement: This issue did affect the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7. 

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 8e9ce5016db968b40e4ec255a3005f2786cce45f
CVE-2018-16057: wireshark: Radiotap dissector crash
Component: wireshark
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2018-08-29T00:00:00+00:00

In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Radiotap dissector could crash. This was addressed in epan/dissectors/packet-ieee80211-radiotap-iter.c by validating iterator operations.


Affected upstream versions: n/a
Fixed upstream versions: v2.4.9
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: bbf46eb46ae38392af8e6cd288795f0def50a621
CVE-2018-16062: elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file
Component: elfutils
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-08-17T00:00:00+00:00

An out-of-bounds read was discovered in elfutils in the way it reads DWARF address ranges information. Function dwarf_getaranges() in dwarf_getaranges.c does not properly check whether it reads beyond the limits of the ELF section. An attacker could use this flaw to cause a denial of service via a crafted file.


Affected upstream versions: n/a
Upstream repository: https://sourceware.org/git/elfutils.git
Upstream fix commit: 29e31978ba51c1051743a503ee325b5ebc03d7e9
CVE-2018-16227: tcpdump: Buffer over-read in print-802_11.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

An out-of-bounds read vulnerability was discovered in tcpdump while printing IEEE 802.11 packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: 4846b3c5d0a850e860baf4f07340495d29837d09