CVE Vulnerability Catalog

In the Linux kernel up to version 4.13.5, there is an issue with nested virtualization that improperly traverses guest pagetable entries, allowing L1 guest OS users to execute arbitrary code on the host or cause a denial of service.

GraphicsMagick 1.3.26 has a use-after-free issue in the ReadOneJNGImage function in coders/png.c when the height or width is zero, related to ReadJNGImage.

Tiandy IP cameras version 5.56.17.120 do not properly restrict a certain proprietary protocol, allowing remote attackers to read settings via a crafted request to TCP port 3001.

The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that corresponds to the exact filename.

Incorrect policy enforcement in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows attackers with local or physical access to bypass enforcement of integrity protections via manipulation of firmware storage.

Insufficient input validation in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows local attackers to execute arbitrary code via manipulation of memory.

Insecure platform configuration in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows an attacker with physical presence to run arbitrary code via unauthorized firmware modification during BIOS Recovery.

Insufficient protection of password storage in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows local attackers to bypass Administrator and User passwords via access to password storage.

In Wireshark versions 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed by changing the memory-allocation approach.

In Wireshark versions 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, there was a bug in the BT ATT dissector that could lead to application crashes. This issue was addressed by considering a case where not all BTATT packets have the same encapsulation level.

In Wireshark versions 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed by validating a string length in epan/dissectors/packet-dmp.c.

In Wireshark versions 2.4.0 to 2.4.1, there was a bug in the RTSP dissector that could lead to application crashes. This issue was addressed by correcting the scope of a variable in the packet-rtsp.c file.

In Wireshark versions 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. This was addressed by adding decrements in plugins/docsis/packet-docsis.c.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability related to buffer overread while parsing Netlink attributes. This affects all Android releases from CAF using the Linux kernel.

In Android for MSM, Firefox OS for MSM, and QRD Android, a vulnerability exists related to buffer over-read while processing a vendor command.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability that allows out of bound memory access in the limCheckRxRSNIeMatch function when an incorrect RSNIE is received from the client in the association request.

In Android for MSM, Firefox OS for MSM, and QRD Android, with all Android releases using the Linux kernel, an out-of-bounds access can potentially occur in a display driver.

In Android for MSM, Firefox OS for MSM, and QRD Android, a race condition can allow access to already freed memory while reading command registration table entries in diag_dbgfs_read_table.

In Android for MSM, Firefox OS for MSM, and QRD Android, issues arise from concurrent access to the debugfs file, leading to double-free and Use-After-Free situations.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is a potential vulnerability related to double free/use after free in the SPS driver when debugfs logging is used.