Gnu: Security Vulnerabilities
idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.
CVSS Score
9.8
EPSS Score
0.024
Published
2019-10-21
GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365.
CVSS Score
7.8
EPSS Score
0.001
Published
2019-10-17
There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
CVSS Score
5.3
EPSS Score
0.0
Published
2019-10-14
There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
CVSS Score
5.4
EPSS Score
0.001
Published
2019-10-14
libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character.
CVSS Score
9.1
EPSS Score
0.003
Published
2019-10-14
find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.
CVSS Score
6.5
EPSS Score
0.01
Published
2019-10-10
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as demonstrated by nm.
CVSS Score
6.5
EPSS Score
0.007
Published
2019-10-10
GNU cflow through 1.6 has a use-after-free in the reference function in parser.c.
CVSS Score
6.5
EPSS Score
0.005
Published
2019-09-09
GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c.
CVSS Score
6.5
EPSS Score
0.005
Published
2019-09-09
The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.
CVSS Score
7.5
EPSS Score
0.005
Published
2019-09-02