Fedora
(Fedoraproject)| Date | ID | Summary | Products | Score | Patch |
|---|---|---|---|---|---|
| 2020-09-04 | CVE-2020-24659 | An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure. | Fedora, Gnutls | N/A | |
| 2019-12-12 | CVE-2017-18640 | The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564. | Fedora, Snakeyaml | N/A | |
| 2020-08-31 | CVE-2020-14364 | An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host. | Debian_linux, Fedora, Qemu, Enterprise_linux, Openstack | N/A | |
| 2020-06-09 | CVE-2020-10757 | A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system. | Debian_linux, Fedora, Linux_kernel, Leap, Enterprise_linux, Enterprise_mrg | N/A | |
| 2020-08-12 | CVE-2020-17507 | An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read. | Fedora, Qt | N/A | |
| 2019-09-11 | CVE-2019-16237 | Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_management.vala. | Ubuntu_linux, Debian_linux, Dino, Fedora | N/A | |
| 2019-09-11 | CVE-2019-16236 | Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala. | Ubuntu_linux, Debian_linux, Dino, Fedora | N/A | |
| 2019-09-11 | CVE-2019-16235 | Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala. | Ubuntu_linux, Debian_linux, Dino, Fedora | N/A | |
| 2020-04-28 | CVE-2020-10663 | The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. | Debian_linux, Fedora, Json, Leap | N/A | |
| 2020-06-12 | CVE-2020-4050 | In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31,... | Fedora, Wordpress | N/A |