From bca2c56fc21fec72fe99a4e8cf0b1d5134edb40e Mon Sep 17 00:00:00 2001 From: CVE Team Date: Wed, 6 Feb 2019 15:07:25 -0500 Subject: [PATCH] - Synchronized data. --- 2018/16xxx/CVE-2018-16890.json | 145 +++++++++++++++++---------------- 2019/3xxx/CVE-2019-3820.json | 145 +++++++++++++++++---------------- 2019/3xxx/CVE-2019-3822.json | 145 +++++++++++++++++---------------- 2019/3xxx/CVE-2019-3823.json | 145 +++++++++++++++++---------------- 2019/3xxx/CVE-2019-3825.json | 137 +++++++++++++++---------------- 2019/7xxx/CVE-2019-7542.json | 18 ++++ 6 files changed, 383 insertions(+), 352 deletions(-) create mode 100644 2019/7xxx/CVE-2019-7542.json diff --git a/2018/16xxx/CVE-2018-16890.json b/2018/16xxx/CVE-2018-16890.json index b6a953cd4cc..46bf097075d 100644 --- a/2018/16xxx/CVE-2018-16890.json +++ b/2018/16xxx/CVE-2018-16890.json @@ -1,74 +1,77 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", - "CVE_data_meta": { - "ID": "CVE-2018-16890", - "ASSIGNER": "psampaio@redhat.com" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "vendor_name": "The curl Project", - "product": { - "product_data": [ - { - "product_name": "curl", - "version": { - "version_data": [ - { - "version_value": "7.64.0" - } - ] - } - } - ] - } - } + "CVE_data_meta" : { + "ASSIGNER" : "psampaio@redhat.com", + "ID" : "CVE-2018-16890", + "STATE" : "PUBLIC" + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "product_name" : "curl", + "version" : { + "version_data" : [ + { + "version_value" : "7.64.0" + } + ] + } + } + ] + }, + "vendor_name" : "The curl Project" + } + ] + } + }, + "data_format" : "MITRE", + "data_type" : "CVE", + "data_version" : "4.0", + "description" : { + "description_data" : [ + { + "lang" : "eng", + "value" : "libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds." + } + ] + }, + "impact" : { + "cvss" : [ + [ + { + "vectorString" : "5.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", + "version" : "3.0" + } + ] + ] + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "CWE-125" + } ] - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ - { - "lang": "eng", - "value": "CWE-125" - } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16890", - "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16890", - "refsource": "CONFIRM" - }, - { - "url": "https://curl.haxx.se/docs/CVE-2018-16890.html" - } - ] - }, - "description": { - "description_data": [ - { - "lang": "eng", - "value": "libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds." - } - ] - }, - "impact": { - "cvss": [ - [ - { - "vectorString": "5.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", - "version": "3.0" - } - ] - ] - } + } + ] + }, + "references" : { + "reference_data" : [ + { + "name" : "https://curl.haxx.se/docs/CVE-2018-16890.html", + "refsource" : "MISC", + "url" : "https://curl.haxx.se/docs/CVE-2018-16890.html" + }, + { + "name" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16890", + "refsource" : "CONFIRM", + "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16890" + } + ] + } } diff --git a/2019/3xxx/CVE-2019-3820.json b/2019/3xxx/CVE-2019-3820.json index e0462fd406f..4adebf61a48 100644 --- a/2019/3xxx/CVE-2019-3820.json +++ b/2019/3xxx/CVE-2019-3820.json @@ -1,74 +1,77 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", - "CVE_data_meta": { - "ID": "CVE-2019-3820", - "ASSIGNER": "psampaio@redhat.com" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "vendor_name": "The Gnome Project", - "product": { - "product_data": [ - { - "product_name": "gnome-shell", - "version": { - "version_data": [ - { - "version_value": "since 3.15.91" - } - ] - } - } - ] - } - } + "CVE_data_meta" : { + "ASSIGNER" : "psampaio@redhat.com", + "ID" : "CVE-2019-3820", + "STATE" : "PUBLIC" + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "product_name" : "gnome-shell", + "version" : { + "version_data" : [ + { + "version_value" : "since 3.15.91" + } + ] + } + } + ] + }, + "vendor_name" : "The Gnome Project" + } + ] + } + }, + "data_format" : "MITRE", + "data_type" : "CVE", + "data_version" : "4.0", + "description" : { + "description_data" : [ + { + "lang" : "eng", + "value" : "It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions." + } + ] + }, + "impact" : { + "cvss" : [ + [ + { + "vectorString" : "4.8/CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", + "version" : "3.0" + } + ] + ] + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "CWE-285" + } ] - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ - { - "lang": "eng", - "value": "CWE-285" - } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3820", - "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3820", - "refsource": "CONFIRM" - }, - { - "url": "https://gitlab.gnome.org/GNOME/gnome-shell/issues/851" - } - ] - }, - "description": { - "description_data": [ - { - "lang": "eng", - "value": "It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions." - } - ] - }, - "impact": { - "cvss": [ - [ - { - "vectorString": "4.8/CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", - "version": "3.0" - } - ] - ] - } + } + ] + }, + "references" : { + "reference_data" : [ + { + "name" : "https://gitlab.gnome.org/GNOME/gnome-shell/issues/851", + "refsource" : "MISC", + "url" : "https://gitlab.gnome.org/GNOME/gnome-shell/issues/851" + }, + { + "name" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3820", + "refsource" : "CONFIRM", + "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3820" + } + ] + } } diff --git a/2019/3xxx/CVE-2019-3822.json b/2019/3xxx/CVE-2019-3822.json index 3236ba1a04e..62928c7c945 100644 --- a/2019/3xxx/CVE-2019-3822.json +++ b/2019/3xxx/CVE-2019-3822.json @@ -1,74 +1,77 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", - "CVE_data_meta": { - "ID": "CVE-2019-3822", - "ASSIGNER": "psampaio@redhat.com" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "vendor_name": "The curl Project", - "product": { - "product_data": [ - { - "product_name": "curl", - "version": { - "version_data": [ - { - "version_value": "7.64.0" - } - ] - } - } - ] - } - } + "CVE_data_meta" : { + "ASSIGNER" : "psampaio@redhat.com", + "ID" : "CVE-2019-3822", + "STATE" : "PUBLIC" + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "product_name" : "curl", + "version" : { + "version_data" : [ + { + "version_value" : "7.64.0" + } + ] + } + } + ] + }, + "vendor_name" : "The curl Project" + } + ] + } + }, + "data_format" : "MITRE", + "data_type" : "CVE", + "data_version" : "4.0", + "description" : { + "description_data" : [ + { + "lang" : "eng", + "value" : "libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header." + } + ] + }, + "impact" : { + "cvss" : [ + [ + { + "vectorString" : "7.1/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", + "version" : "3.0" + } + ] + ] + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "CWE-121" + } ] - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ - { - "lang": "eng", - "value": "CWE-121" - } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://curl.haxx.se/docs/CVE-2019-3822.html" - }, - { - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822", - "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822", - "refsource": "CONFIRM" - } - ] - }, - "description": { - "description_data": [ - { - "lang": "eng", - "value": "libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header." - } - ] - }, - "impact": { - "cvss": [ - [ - { - "vectorString": "7.1/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", - "version": "3.0" - } - ] - ] - } + } + ] + }, + "references" : { + "reference_data" : [ + { + "name" : "https://curl.haxx.se/docs/CVE-2019-3822.html", + "refsource" : "MISC", + "url" : "https://curl.haxx.se/docs/CVE-2019-3822.html" + }, + { + "name" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822", + "refsource" : "CONFIRM", + "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822" + } + ] + } } diff --git a/2019/3xxx/CVE-2019-3823.json b/2019/3xxx/CVE-2019-3823.json index 5349cef6008..a9850245839 100644 --- a/2019/3xxx/CVE-2019-3823.json +++ b/2019/3xxx/CVE-2019-3823.json @@ -1,74 +1,77 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", - "CVE_data_meta": { - "ID": "CVE-2019-3823", - "ASSIGNER": "psampaio@redhat.com" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "vendor_name": "The curl Project", - "product": { - "product_data": [ - { - "product_name": "curl", - "version": { - "version_data": [ - { - "version_value": "7.64.0" - } - ] - } - } - ] - } - } + "CVE_data_meta" : { + "ASSIGNER" : "psampaio@redhat.com", + "ID" : "CVE-2019-3823", + "STATE" : "PUBLIC" + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "product_name" : "curl", + "version" : { + "version_data" : [ + { + "version_value" : "7.64.0" + } + ] + } + } + ] + }, + "vendor_name" : "The curl Project" + } + ] + } + }, + "data_format" : "MITRE", + "data_type" : "CVE", + "data_version" : "4.0", + "description" : { + "description_data" : [ + { + "lang" : "eng", + "value" : "libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller." + } + ] + }, + "impact" : { + "cvss" : [ + [ + { + "vectorString" : "4.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", + "version" : "3.0" + } + ] + ] + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "CWE-125" + } ] - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ - { - "lang": "eng", - "value": "CWE-125" - } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://curl.haxx.se/docs/CVE-2019-3823.html" - }, - { - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3823", - "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3823", - "refsource": "CONFIRM" - } - ] - }, - "description": { - "description_data": [ - { - "lang": "eng", - "value": "libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller." - } - ] - }, - "impact": { - "cvss": [ - [ - { - "vectorString": "4.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", - "version": "3.0" - } - ] - ] - } + } + ] + }, + "references" : { + "reference_data" : [ + { + "name" : "https://curl.haxx.se/docs/CVE-2019-3823.html", + "refsource" : "MISC", + "url" : "https://curl.haxx.se/docs/CVE-2019-3823.html" + }, + { + "name" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3823", + "refsource" : "CONFIRM", + "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3823" + } + ] + } } diff --git a/2019/3xxx/CVE-2019-3825.json b/2019/3xxx/CVE-2019-3825.json index de14a6302ea..e6cb784792a 100644 --- a/2019/3xxx/CVE-2019-3825.json +++ b/2019/3xxx/CVE-2019-3825.json @@ -1,71 +1,72 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", - "CVE_data_meta": { - "ID": "CVE-2019-3825", - "ASSIGNER": "psampaio@redhat.com" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "vendor_name": "The Gnome Projectr", - "product": { - "product_data": [ - { - "product_name": "gdm", - "version": { - "version_data": [ - { - "version_value": "3.31.4" - } - ] - } - } - ] - } - } + "CVE_data_meta" : { + "ASSIGNER" : "psampaio@redhat.com", + "ID" : "CVE-2019-3825", + "STATE" : "PUBLIC" + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "product_name" : "gdm", + "version" : { + "version_data" : [ + { + "version_value" : "3.31.4" + } + ] + } + } + ] + }, + "vendor_name" : "The Gnome Projectr" + } + ] + } + }, + "data_format" : "MITRE", + "data_type" : "CVE", + "data_version" : "4.0", + "description" : { + "description_data" : [ + { + "lang" : "eng", + "value" : "A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to expire, at which time they would gain access to the logged-in user's session." + } + ] + }, + "impact" : { + "cvss" : [ + [ + { + "vectorString" : "6.3/CVSS:3.0/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", + "version" : "3.0" + } + ] + ] + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "CWE-287" + } ] - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ - { - "lang": "eng", - "value": "CWE-287" - } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3825", - "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3825", - "refsource": "CONFIRM" - } - ] - }, - "description": { - "description_data": [ - { - "lang": "eng", - "value": "A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to expire, at which time they would gain access to the logged-in user's session." - } - ] - }, - "impact": { - "cvss": [ - [ - { - "vectorString": "6.3/CVSS:3.0/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", - "version": "3.0" - } - ] - ] - } + } + ] + }, + "references" : { + "reference_data" : [ + { + "name" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3825", + "refsource" : "CONFIRM", + "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3825" + } + ] + } } diff --git a/2019/7xxx/CVE-2019-7542.json b/2019/7xxx/CVE-2019-7542.json new file mode 100644 index 00000000000..6a5f70b7073 --- /dev/null +++ b/2019/7xxx/CVE-2019-7542.json @@ -0,0 +1,18 @@ +{ + "CVE_data_meta" : { + "ASSIGNER" : "cve@mitre.org", + "ID" : "CVE-2019-7542", + "STATE" : "RESERVED" + }, + "data_format" : "MITRE", + "data_type" : "CVE", + "data_version" : "4.0", + "description" : { + "description_data" : [ + { + "lang" : "eng", + "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +}