Opensuse Backports vulnerabilities, page 3
97 vulnerabilities
Known vulnerabilities in Opensuse Backports, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2019-11328fedoraprojectfedora+6
EPSS score2.09%
An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within `/run/singularity/instances/sing/<user>/<instance>`. The manipulation of those files can change the behavior of the starter-suid program when instances are joined resulting in potential privilege escalation on the host.CVE-2019-20053debianupx-ucl+4EPSS score1.23%
An invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.CVE-2019-14524debianschism+4EPSS score1.34%
An issue was discovered in Schism Tracker through 20190722. There is a heap-based buffer overflow via a large number of song patterns in fmt_mtm_load_song in fmt/mtm.c, a different vulnerability than CVE-2019-14465.CVE-2019-7443debiankauth+25EPSS score2.35%
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.CVE-2019-18899apt-cacher-ng_projectapt-cacher-ng+3EPSS score0.26%
The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influence the outcome of these operations. This issue affects: openSUSE Leap 15.1 apt-cacher-ng versions prior to 3.1-lp151.3.3.1.CVE-2019-5459debianvlc+5EPSS score2.81%
An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.CVE-2019-5838debianchromium+6EPSS score0.77%
Insufficient policy enforcement in extensions API in Google Chrome prior to 75.0.3770.80 allowed an attacker who convinced a user to install a malicious extension to bypass restrictions on file URIs via a crafted Chrome Extension.CVE-2019-5805debianchromium+6EPSS score1.46%
Use-after-free in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.CVE-2019-5828debianchromium+6EPSS score1.36%
Object lifecycle issue in ServiceWorker in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.CVE-2019-5817ubuntuchromium-browser+5EPSS score1.85%
Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2019-5824debianchromium+6EPSS score1.35%
Parameter passing error in media in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2019-5791debianchromium+4EPSS score1.54%
Inappropriate optimization in V8 in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.CVE-2019-5839debianchromium+6EPSS score1.25%
Excessive data validation in URL parser in Google Chrome prior to 75.0.3770.80 allowed a remote attacker who convinced a user to input a URL to bypass website URL validation via a crafted URL.CVE-2019-5460debianvlc+3EPSS score2.53%
Double Free in VLC versions <= 3.0.6 leads to a crash.CVE-2019-5827canonicalubuntu_linux+10EPSS score1.95%
Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2019-5795debianchromium+4EPSS score1.22%
Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file.CVE-2019-5837debianchromium+6EPSS score1.52%
Resource size information leakage in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.CVE-2019-5840debianchromium+6EPSS score1.04%
Incorrect security UI in popup blocker in Google Chrome on iOS prior to 75.0.3770.80 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.CVE-2019-5788debianchromium+4EPSS score9.09%
An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.CVE-2019-5810debianchromium+6EPSS score1.08%
Information leak in autofill in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.