Fedoraproject
Page 31 of 55 — Fedoraproject CVEs from a corpus of 5439, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-27842 | Medium | 5.5 | 2021-01-05 | There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a… |
CVE-2020-27841 | Medium | 5.5 | 2021-01-05 | There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpe… |
CVE-2020-36158 | High | 8.8 | 2021-01-05 | mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through 5.10.4 might allow remote attackers to execute arbit… |
CVE-2019-25013 | Medium | 5.9 | 2021-01-04 | The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a… |
CVE-2020-25275 | High | 7.5 | 2021-01-04 | Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices fo… |
CVE-2020-24386 | Medium | 6.8 | 2021-01-04 | An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, l… |
CVE-2020-35496 | Medium | 5.5 | 2021-01-04 | There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by o… |
CVE-2020-35495 | Medium | 5.5 | 2021-01-04 | There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer… |
CVE-2020-35494 | Medium | 6.1 | 2021-01-04 | There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninit… |
CVE-2020-35493 | Medium | 5.5 | 2021-01-04 | A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-… |
CVE-2020-35884 | Medium | 6.5 | 2020-12-31 | An issue was discovered in the tiny_http crate through 2020-06-16 for Rust. HTTP Request smuggling can occur via a malformed Transfer-Encoding header. |
CVE-2020-35730 | Medium | 6.1 | 2020-12-28 | An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message… |
CVE-2020-35738 | Medium | 6.1 | 2020-12-28 | WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties cl… |
CVE-2020-35376 | High | 7.5 | 2020-12-26 | Xpdf 4.02 allows stack consumption because of an incorrect subroutine reference in a Type 1C font charstring, related to the FoFiType1C::getOp() function. |
CVE-2020-29385 | Medium | 5.5 | 2020-12-26 | GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, se… |
CVE-2020-35680 | High | 7.5 | 2020-12-24 | smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointer dereference and d… |
CVE-2020-35679 | High | 7.5 | 2020-12-24 | smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an i… |
CVE-2020-27846 | Critical | 9.8 | 2020-12-21 | A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnera… |
CVE-2020-27781 | High | 7.1 | 2020-12-18 | User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manil… |
CVE-2020-35480 | Medium | 5.3 | 2020-12-18 | An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (accounts that have been explicitly hidden due t… |
CVE-2020-35479 | Medium | 6.1 | 2020-12-18 | MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in all code paths. For example, the return… |
CVE-2020-35478 | Medium | 6.1 | 2020-12-18 | MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace potentially can be output as raw HTML with SCRIPT tags via LogFormatter… |
CVE-2020-35477 | Medium | 5.3 | 2020-12-18 | MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visi… |
CVE-2020-35475 | High | 7.5 | 2020-12-18 | In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:U… |
CVE-2020-35474 | Medium | 6.1 | 2020-12-18 | In MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS because the definition of MediaWiki:recentchanges-legend-watchli… |
CVE-2020-26259 | Medium | 6.8 | 2020-12-16 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the loca… |
CVE-2020-26258 | Medium | 6.3 | 2020-12-16 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be acti… |
CVE-2020-35381 | High | 7.5 | 2020-12-15 | jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call. |
CVE-2020-29486 | Medium | 6.0 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Nodes in xenstore have an ownership. In oxenstored, a owner could give a node away. However, node ownership has… |
CVE-2020-29485 | Medium | 5.5 | 2020-12-15 | An issue was discovered in Xen 4.6 through 4.14.x. When acting upon a guest XS_RESET_WATCHES request, not all tracking information is freed. A guest can cause… |
CVE-2020-29484 | Medium | 6.0 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the xenstore client that registered the watch will receive a Xenstore message conta… |
CVE-2020-29483 | Medium | 6.5 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate via a shared memory page using a specific protocol. When a guest violates this… |
CVE-2020-29482 | Medium | 6.0 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths via absolute paths containing a full pathname, or via a relative path, which i… |
CVE-2020-29481 | High | 8.8 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Access rights of Xenstore nodes are per domid. Unfortunately, existing granted access rights are not removed whe… |
CVE-2020-29480 | Low | 2.3 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest admini… |
CVE-2020-29479 | High | 8.8 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. In the Ocaml xenstored implementation, the internal representation of the tree has special cases for the root no… |
CVE-2020-29571 | Medium | 6.2 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO event channels depends on the CPU observ… |
CVE-2020-29570 | Medium | 6.2 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into the control block is… |
CVE-2020-29567 | Medium | 6.2 | 2020-12-15 | An issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribute the load of IRQ handling, IRQ vectors are dynamically allocated and de-alloc… |
CVE-2020-29566 | Medium | 5.5 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must be temporarily de-scheduled. The device… |
CVE-2020-0499 | Medium | 4.3 | 2020-12-15 | In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote infor… |
CVE-2020-8286 | High | 7.5 | 2020-12-14 | curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. |
CVE-2020-8285 | High | 7.5 | 2020-12-14 | curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. |
CVE-2020-8284 | Low | 3.7 | 2020-12-14 | A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially… |
CVE-2020-35176 | Medium | 5.3 | 2020-12-12 | In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a… |
CVE-2020-26421 | Medium | 4.2 | 2020-12-11 | Crash in USB HID protocol dissector and possibly other dissectors in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafte… |
CVE-2020-26420 | Low | 3.1 | 2020-12-11 | Memory leak in RTPS protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file. |
CVE-2020-26419 | Low | 3.1 | 2020-12-11 | Memory leak in the dissection engine in Wireshark 3.4.0 allows denial of service via packet injection or crafted capture file. |
CVE-2020-26418 | Low | 3.1 | 2020-12-11 | Memory leak in Kafka protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file. |
CVE-2020-35132 | Medium | 5.4 | 2020-12-11 | An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other users at a later time… |
CVE-2020-27828 | High | 7.8 | 2020-12-11 | There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds writ… |
CVE-2020-29668 | Low | 3.7 | 2020-12-10 | Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie… |
CVE-2020-16592 | Medium | 5.5 | 2020-12-09 | A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that… |
CVE-2020-26257 | Medium | 6.5 | 2020-12-09 | Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-imple… |
CVE-2020-29661 | High | 7.8 | 2020-12-09 | A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSP… |
CVE-2020-29660 | Medium | 4.4 | 2020-12-09 | A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may al… |
CVE-2020-29651 | High | 7.5 | 2020-12-09 | A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-tim… |
CVE-2020-27918 | High | 7.8 | 2020-12-08 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iClou… |
CVE-2020-25664 | Medium | 6.1 | 2020-12-08 | In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when Po… |
CVE-2020-1971 | Medium | 5.9 | 2020-12-08 | The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a fu… |
CVE-2020-27818 | Low | 3.3 | 2020-12-08 | A flaw was found in the check_chunk_name() function of pngcheck-2.4.0. An attacker able to pass a malicious file to be processed by pngcheck could cause a temp… |
CVE-2020-29600 | Critical | 9.8 | 2020-12-07 | In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.co… |
CVE-2020-29562 | Medium | 4.8 | 2020-12-04 | The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion i… |
CVE-2020-27783 | Medium | 6.1 | 2020-12-03 | A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors betwee… |
CVE-2020-25693 | High | 8.1 | 2020-12-03 | A flaw was found in CImg in versions prior to 2.9.3. Integer overflows leading to heap buffer overflows in load_pnm() can be triggered by a specially crafted i… |
CVE-2020-25649 | High | 7.5 | 2020-12-03 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity… |
CVE-2020-13584 | High | 8.8 | 2020-12-03 | An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML web page can cause a use-after-free condit… |
CVE-2020-15257 | Medium | 5.2 | 2020-12-01 | containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the con… |
CVE-2020-11867 | Low | 3.3 | 2020-11-30 | Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to… |
CVE-2020-29130 | Medium | 4.3 | 2020-11-26 | slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. |
CVE-2020-29129 | Medium | 4.3 | 2020-11-26 | ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. |
CVE-2020-25653 | Medium | 6.3 | 2020-11-26 | A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest u… |
CVE-2020-25652 | Medium | 5.5 | 2020-11-26 | A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in `/run/… |
CVE-2020-25651 | Medium | 6.4 | 2020-11-26 | A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection of an illegitimate… |
CVE-2020-29074 | High | 8.8 | 2020-11-25 | scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other than the current user. |
CVE-2020-25650 | Medium | 5.5 | 2020-11-25 | A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user wit… |
CVE-2020-28928 | Medium | 5.5 | 2020-11-24 | In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source character limit, as demonstrated by an invalid… |
CVE-2020-26890 | High | 7.5 | 2020-11-24 | Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attac… |
CVE-2020-25660 | High | 8.8 | 2020-11-23 | A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then… |
CVE-2020-25725 | Medium | 5.0 | 2020-11-21 | In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed `t3GlyphStack->cache`, which causes an `heap-us… |
CVE-2020-20740 | High | 7.8 | 2020-11-20 | PDFResurrect before 0.20 lack of header validation checks causes heap-buffer-overflow in pdf_get_version(). |
CVE-2020-20739 | Medium | 5.3 | 2020-11-20 | im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path… |
CVE-2020-13671 | High | 8.8 | 2020-11-20 | Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as… |
CVE-2020-4788 | Medium | 4.7 | 2020-11-20 | IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating cir… |
CVE-2020-28924 | High | 7.5 | 2020-11-19 | An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords wit… |
CVE-2020-28949 | High | 7.8 | 2020-11-19 | Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite f… |
CVE-2020-28948 | High | 7.8 | 2020-11-19 | Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. |
CVE-2020-28941 | Medium | 5.5 | 2020-11-19 | An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the speakup driver coul… |
CVE-2020-25703 | Medium | 5.3 | 2020-11-19 | The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 t… |
CVE-2020-25702 | Medium | 6.1 | 2020-11-19 | In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10. |
CVE-2020-25701 | Medium | 5.3 | 2020-11-19 | If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable t… |
CVE-2020-25700 | Medium | 6.5 | 2020-11-19 | In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8… |
CVE-2020-25699 | High | 7.5 | 2020-11-19 | In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Ve… |
CVE-2020-25698 | High | 7.5 | 2020-11-19 | Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrollin… |
CVE-2020-8277 | High | 7.5 | 2020-11-19 | A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14… |
CVE-2020-28366 | High | 7.5 | 2020-11-18 | Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in… |
CVE-2020-28362 | High | 7.5 | 2020-11-18 | Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. |
CVE-2020-8698 | Medium | 5.5 | 2020-11-12 | Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local acces… |
CVE-2020-8696 | Medium | 5.5 | 2020-11-12 | Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable informat… |
CVE-2020-8695 | Medium | 5.5 | 2020-11-12 | Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local ac… |