Opensuse: Security Vulnerabilities
An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker can access the shared memory without any specific permissions to trigger this vulnerability.
CVSS Score
5.1
EPSS Score
0.001
Published
2019-11-05
A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.
CVSS Score
3.3
EPSS Score
0.001
Published
2019-11-05
Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions
CVSS Score
5.3
EPSS Score
0.005
Published
2019-11-05
gdm3 3.14.2 and possibly later has an information leak before screen lock
CVSS Score
2.4
EPSS Score
0.002
Published
2019-11-05
Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary
CVSS Score
7.4
EPSS Score
0.002
Published
2019-11-05
The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code.
CVSS Score
9.8
EPSS Score
0.046
Published
2019-11-04
Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
CVSS Score
7.8
EPSS Score
0.001
Published
2019-11-04
The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
CVSS Score
7.8
EPSS Score
0.002
Published
2019-11-04
Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) or execute arbitrary code via a crafted executable file.
CVSS Score
7.8
EPSS Score
0.002
Published
2019-11-04
An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free.
CVSS Score
7.0
EPSS Score
0.009
Published
2019-11-04