The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of Debian

computer vulnerability announce CVE-2019-3901

Linux kernel: information disclosure via perf_event_open

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via perf_event_open() of the Linux kernel, in order to obtain sensitive information.
Impacted products: Debian.
Severity: 1/4.
Consequences: data reading.
Provenance: user shell.
Creation date: 28/05/2019.
Identifiers: 1701245, CVE-2019-3901, DLA-1799-1, DLA-1799-2, VIGILANCE-VUL-29427.

Description of the vulnerability

An attacker can bypass access restrictions to data via perf_event_open() of the Linux kernel, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2019-11815

Linux kernel: use after free via rds_tcp_kill_sock

Synthesis of the vulnerability

An attacker can force the usage of a freed memory area via rds_tcp_kill_sock() of the Linux kernel, in order to trigger a denial of service, and possibly to run code.
Impacted products: Debian, Linux, openSUSE Leap, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 1/4.
Consequences: administrator access/rights, privileged access/rights, user access/rights, denial of service on server, denial of service on service, denial of service on client.
Provenance: LAN.
Creation date: 09/05/2019.
Revision date: 24/05/2019.
Identifiers: CERTFR-2019-AVI-244, CERTFR-2019-AVI-254, CERTFR-2019-AVI-277, CVE-2019-11815, DLA-1824-1, DSA-4465-1, openSUSE-SU-2019:1404-1, openSUSE-SU-2019:1407-1, openSUSE-SU-2019:1479-1, SUSE-SU-2019:1527-1, SUSE-SU-2019:1529-1, SUSE-SU-2019:1530-1, SUSE-SU-2019:1532-1, SUSE-SU-2019:1534-1, SUSE-SU-2019:1535-1, SUSE-SU-2019:1536-1, SUSE-SU-2019:1550-1, USN-4005-1, USN-4008-1, USN-4008-3, VIGILANCE-VUL-29259.

Description of the vulnerability

An attacker can force the usage of a freed memory area via rds_tcp_kill_sock() of the Linux kernel, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2019-12155

QEMU: NULL pointer dereference in the QXL device driver

Synthesis of the vulnerability

An attacker, inside a guest system, can force a NULL pointer to be dereferenced via QXL of QEMU, in order to trigger a denial of service on the host system.
Impacted products: Debian, QEMU.
Severity: 1/4.
Consequences: denial of service on server, denial of service on service, denial of service on client.
Provenance: document.
Creation date: 22/05/2019.
Identifiers: CVE-2019-12155, DSA-4454-1, DSA-4454-2, VIGILANCE-VUL-29384.

Description of the vulnerability

An attacker, inside a guest system, can force a NULL pointer to be dereferenced via QXL of QEMU, in order to trigger a denial of service on the host system.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2019-11833

Linux kernel: information disclosure via ext4/extents.c

Synthesis of the vulnerability

A local attacker can read a memory fragment via ext4/extents.c of the Linux kernel, in order to obtain sensitive information.
Impacted products: Debian, Fedora, Linux, openSUSE Leap, SUSE Linux Enterprise Desktop, SLES.
Severity: 1/4.
Consequences: data reading.
Provenance: privileged shell.
Creation date: 22/05/2019.
Identifiers: CERTFR-2019-AVI-277, CVE-2019-11833, DLA-1823-1, DLA-1824-1, DSA-4465-1, FEDORA-2019-48b34fc991, openSUSE-SU-2019:1479-1, openSUSE-SU-2019:1570-1, openSUSE-SU-2019:1579-1, SUSE-SU-2019:1527-1, SUSE-SU-2019:1529-1, SUSE-SU-2019:1530-1, SUSE-SU-2019:1532-1, SUSE-SU-2019:1533-1, SUSE-SU-2019:1534-1, SUSE-SU-2019:1535-1, SUSE-SU-2019:1536-1, SUSE-SU-2019:1550-1, SUSE-SU-2019:1692-1, VIGILANCE-VUL-29379.

Description of the vulnerability

A local attacker can read a memory fragment via ext4/extents.c of the Linux kernel, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability bulletin CVE-2019-3795

spring-security: bad quality of the PRNG SecureRandomFactoryBean

Synthesis of the vulnerability

An attacker can make profit of the badness of the PRNG SecureRandomFactoryBean.
Impacted products: Debian.
Severity: 1/4.
Consequences: client access/rights, data reading.
Provenance: internet client.
Creation date: 20/05/2019.
Identifiers: CVE-2019-3795, DLA-1794-1, VIGILANCE-VUL-29353.

Description of the vulnerability

An attacker can make profit of the badness of the PRNG SecureRandomFactoryBean.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2019-11579

dhcpcd5: out-of-bounds memory reading

Synthesis of the vulnerability

An attacker can force a read at an invalid address of dhcpcd5, in order to trigger a denial of service, or to obtain sensitive information.
Impacted products: Debian.
Severity: 1/4.
Consequences: data reading, denial of service on server, denial of service on service, denial of service on client.
Provenance: intranet server.
Creation date: 20/05/2019.
Identifiers: CVE-2019-11579, DLA-1793-1, VIGILANCE-VUL-29352.

Description of the vulnerability

An attacker can force a read at an invalid address of dhcpcd5, in order to trigger a denial of service, or to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2019-0221

Apache Tomcat: Cross Site Scripting via SSI printenv

Synthesis of the vulnerability

An attacker can trigger a Cross Site Scripting via SSI printenv of Apache Tomcat, in order to run JavaScript code in the context of the web site.
Impacted products: Tomcat, Debian, Fedora, openSUSE Leap, SUSE Linux Enterprise Desktop, SLES.
Severity: 2/4.
Consequences: client access/rights.
Provenance: document.
Creation date: 17/05/2019.
Identifiers: CVE-2019-0221, DLA-1810-1, FEDORA-2019-1a3f878d27, FEDORA-2019-d66febb5df, openSUSE-SU-2019:1673-1, SUSE-SU-2019:1693-1, SUSE-SU-2019:1866-1, SUSE-SU-2019:1895-1, VIGILANCE-VUL-29350.

Description of the vulnerability

An attacker can trigger a Cross Site Scripting via SSI printenv of Apache Tomcat, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2018-12126 CVE-2018-12127 CVE-2018-12130

Intel processors: information disclosure via performance measurement

Synthesis of the vulnerability

An attacker can measure performances of his process, in order to get sensitive information about other process or, if the host is virtualized, about other guest systems.
Impacted products: XenServer, Debian, Fedora, FortiAnalyzer, FortiGate, FortiManager, FortiOS, FreeBSD, Linux, Windows 10, Windows 2008 R0, Windows 2008 R2, Windows 2012, Windows 2016, Windows 2019, Windows 7, Windows 8, Windows RT, OpenBSD, openSUSE Leap, PAN-OS, pfSense, RHEL, SIMATIC, SUSE Linux Enterprise Desktop, SLES, Synology DSM, Synology DS***, Synology RS***, Ubuntu, ESXi, vCenter Server, VMware vSphere Hypervisor, Xen.
Severity: 1/4.
Consequences: data reading.
Provenance: user shell.
Number of vulnerabilities in this bulletin: 4.
Creation date: 15/05/2019.
Revision date: 15/05/2019.
Identifiers: CERTFR-2019-AVI-209, CERTFR-2019-AVI-211, CERTFR-2019-AVI-212, CERTFR-2019-AVI-213, CERTFR-2019-AVI-215, CERTFR-2019-AVI-217, CERTFR-2019-AVI-229, CERTFR-2019-AVI-230, CERTFR-2019-AVI-233, CERTFR-2019-AVI-311, CTX251995, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091, DLA-1787-1, DLA-1789-1, DLA-1789-2, DLA-1799-1, DLA-1799-2, DSA-4444-1, DSA-4447-1, DSA-4447-2, FEDORA-2019-0731828893, FEDORA-2019-1f5832fc0e, FEDORA-2019-640f8d8dd1, FEDORA-2019-6458474bf2, FEDORA-2019-c36afa818c, FEDORA-2019-e6bf55e821, FEDORA-2019-eb08fb0c5f, FG-IR-18-002, FreeBSD-SA-19:07.mds, INTEL-SA-00233, openSUSE-SU-2019:1402-1, openSUSE-SU-2019:1403-1, openSUSE-SU-2019:1404-1, openSUSE-SU-2019:1405-1, openSUSE-SU-2019:1407-1, openSUSE-SU-2019:1408-1, openSUSE-SU-2019:1419-1, openSUSE-SU-2019:1420-1, openSUSE-SU-2019:1468-1, openSUSE-SU-2019:1505-1, PAN-SA-2019-0012, RHSA-2019:1155-01, RHSA-2019:1167-01, RHSA-2019:1168-01, RHSA-2019:1169-01, RHSA-2019:1170-01, RHSA-2019:1171-01, RHSA-2019:1172-01, RHSA-2019:1174-01, RHSA-2019:1175-01, RHSA-2019:1176-01, RHSA-2019:1177-01, RHSA-2019:1178-01, RHSA-2019:1180-01, RHSA-2019:1181-01, RHSA-2019:1182-01, RHSA-2019:1183-01, RHSA-2019:1184-01, RHSA-2019:1185-01, RHSA-2019:1186-01, RHSA-2019:1187-01, RHSA-2019:1188-01, RHSA-2019:1189-01, RHSA-2019:1190-01, RHSA-2019:1193-01, RHSA-2019:1194-01, RHSA-2019:1195-01, RHSA-2019:1196-01, RHSA-2019:1197-01, RHSA-2019:1198-01, SSA-616472, SUSE-SU-2019:1235-1, SUSE-SU-2019:1236-1, SUSE-SU-2019:1238-1, SUSE-SU-2019:1239-1, SUSE-SU-2019:1240-1, SUSE-SU-2019:1241-1, SUSE-SU-2019:1242-1, SUSE-SU-2019:1243-1, SUSE-SU-2019:1244-1, SUSE-SU-2019:1245-1, SUSE-SU-2019:1248-1, SUSE-SU-2019:1268-1, SUSE-SU-2019:1269-1, SUSE-SU-2019:1272-1, SUSE-SU-2019:1287-1, SUSE-SU-2019:1289-1, SUSE-SU-2019:1296-1, SUSE-SU-2019:1313-1, SUSE-SU-2019:1347-1, SUSE-SU-2019:1348-1, SUSE-SU-2019:1349-1, SUSE-SU-2019:1356-1, SUSE-SU-2019:1371-1, SUSE-SU-2019:14048-1, SUSE-SU-2019:14051-1, SUSE-SU-2019:14052-1, SUSE-SU-2019:14063-1, SUSE-SU-2019:1423-1, SUSE-SU-2019:1438-1, SUSE-SU-2019:1452-1, SUSE-SU-2019:1490-1, SUSE-SU-2019:1547-1, SUSE-SU-2019:1550-1, Synology-SA-19:24, USN-3977-1, USN-3977-2, USN-3977-3, USN-3978-1, USN-3979-1, USN-3980-1, USN-3981-1, USN-3981-2, USN-3982-1, USN-3982-2, USN-3983-1, USN-3983-2, USN-3984-1, USN-3985-1, USN-3985-2, VIGILANCE-VUL-29300, VMSA-2019-0008, XSA-297, ZombieLoad.

Description of the vulnerability

An attacker can measure performances of his process, in order to get sensitive information about other process or, if the host is virtualized, about other guest systems.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2019-12046

Lemonldap-ng: privilege escalation via the option tokenUseGlobalStorage

Synthesis of the vulnerability

An attacker can bypass restrictions via tokenUseGlobalStorage of Lemonldap::ng, in order to escalate his privileges.
Impacted products: Debian.
Severity: 2/4.
Consequences: privileged access/rights, user access/rights.
Provenance: internet client.
Creation date: 15/05/2019.
Identifiers: CERTFR-2019-AVI-226, CVE-2019-12046, DLA-1790-1, DLA-1791-1, DSA-4446-1, VIGILANCE-VUL-29302.

Description of the vulnerability

An attacker can bypass restrictions via tokenUseGlobalStorage of Lemonldap::ng, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2018-16860

Samba: Man-in-the-Middle

Synthesis of the vulnerability

An attacker can act as a Man-in-the-Middle on Samba, in order to read or write data in the session.
Impacted products: Debian, Fedora, openSUSE Leap, Samba, SLES, Synology DSM, Synology DS***, Synology RS***, Ubuntu.
Severity: 2/4.
Consequences: data reading, data creation/edition.
Provenance: intranet client.
Creation date: 14/05/2019.
Identifiers: CERTFR-2019-AVI-206, CVE-2018-16860, DLA-1788-1, DSA-4443-1, DSA-4455-1, FEDORA-2019-208cc34d40, FEDORA-2019-307e117a2e, openSUSE-SU-2019:1682-1, openSUSE-SU-2019:1688-1, Synology-SA-19:23, USN-3976-1, USN-3976-2, USN-3976-3, USN-3976-4, VIGILANCE-VUL-29289.

Description of the vulnerability

An attacker can act as a Man-in-the-Middle on Samba, in order to read or write data in the session.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about Debian: