Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Fedora
(Fedoraproject)| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2019-12-12 | CVE-2017-18640 | The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564. | Fedora, Peoplesoft_enterprise_pt_peopletools, Quarkus, Snakeyaml | 7.5 | ||
| 2019-12-12 | CVE-2019-19746 | make_arrow in arrow.c in Xfig fig2dev 3.2.7b allows a segmentation fault and out-of-bounds write because of an integer overflow via a large arrow type. | Fedora, Fig2dev | 5.5 | ||
| 2019-12-12 | CVE-2019-19769 | In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h). | Fedora, Linux_kernel | 6.7 | ||
| 2019-12-13 | CVE-2019-16775 | Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user... | Fedora, Npm, Leap, Graalvm, Enterprise_linux, Enterprise_linux_eus | 6.5 | ||
| 2019-12-13 | CVE-2019-16776 | Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts... | Fedora, Npm, Leap, Graalvm, Enterprise_linux, Enterprise_linux_eus | 8.1 | ||
| 2019-12-13 | CVE-2019-16777 | Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability... | Fedora, Npm, Leap, Graalvm, Enterprise_linux, Enterprise_linux_eus | 6.5 | ||
| 2019-12-13 | CVE-2019-19785 | ATasm 1.06 has a stack-based buffer overflow in the to_comma() function in asm.c via a crafted .m65 file. | Atasm, Fedora | 7.8 | ||
| 2019-12-13 | CVE-2019-19786 | ATasm 1.06 has a stack-based buffer overflow in the parse_expr() function in setparse.c via a crafted .m65 file. | Atasm, Fedora | 7.8 | ||
| 2019-12-13 | CVE-2019-19787 | ATasm 1.06 has a stack-based buffer overflow in the get_signed_expression() function in setparse.c via a crafted .m65 file. | Atasm, Fedora | 7.8 | ||
| 2019-12-13 | CVE-2019-19722 | In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push notifications are used, because of a NULL Pointer Dereference. The email must use a group address as either the sender or the recipient. | Dovecot, Fedora | 5.3 |