Security Vulnerabilities - CVEs Published In 2020
Artifex MuJS through 1.0.7 has a use-after-free in jsrun.c because of unconditional marking in jsgc.c.
CVSS Score
7.8
EPSS Score
0.008
Published
2020-08-13
JerryScript through 2.3.0 has a (function({a=arguments}){const arguments}) buffer over-read.
CVSS Score
7.1
EPSS Score
0.008
Published
2020-08-13
JerryScript through 2.3.0 allows stack consumption via function a(){new new Proxy(a,{})}JSON.parse("[]",a). NOTE: the vendor states that the problem is the lack of the --stack-limit option
CVSS Score
7.8
EPSS Score
0.008
Published
2020-08-13
njs through 0.4.3, used in NGINX, has a use-after-free in njs_json_parse_iterator_call in njs_json.c.
CVSS Score
7.8
EPSS Score
0.01
Published
2020-08-13
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_lvlhsh_level_find in njs_lvlhsh.c.
CVSS Score
5.5
EPSS Score
0.004
Published
2020-08-13
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.
CVSS Score
7.8
EPSS Score
0.005
Published
2020-08-13
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).
CVSS Score
7.8
EPSS Score
0.005
Published
2020-08-13
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.
CVSS Score
5.5
EPSS Score
0.006
Published
2020-08-13
In C2 flame devices, there is a possible bypass of seccomp due to a missing configuration file. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-146059841
CVSS Score
7.8
EPSS Score
0.002
Published
2020-08-13
In Wireshark 3.2.0 to 3.2.5, the Kafka protocol dissector could crash. This was addressed in epan/dissectors/packet-kafka.c by avoiding a double free during LZ4 decompression.
CVSS Score
6.5
EPSS Score
0.026
Published
2020-08-13