From eaec28d07178c250dfb9d61567c5e953560ed19c Mon Sep 17 00:00:00 2001 From: CVE Team Date: Thu, 19 Mar 2020 16:01:27 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2014/2xxx/CVE-2014-2721.json | 58 ++++++++++++++--- 2014/2xxx/CVE-2014-2722.json | 58 ++++++++++++++--- 2014/2xxx/CVE-2014-2723.json | 58 ++++++++++++++--- 2019/14xxx/CVE-2019-14871.json | 111 +++++++++++++++++---------------- 2019/14xxx/CVE-2019-14872.json | 111 +++++++++++++++++---------------- 2019/14xxx/CVE-2019-14873.json | 111 +++++++++++++++++---------------- 2019/14xxx/CVE-2019-14874.json | 111 +++++++++++++++++---------------- 2019/14xxx/CVE-2019-14875.json | 111 +++++++++++++++++---------------- 2019/14xxx/CVE-2019-14876.json | 111 +++++++++++++++++---------------- 2019/14xxx/CVE-2019-14877.json | 111 +++++++++++++++++---------------- 2019/14xxx/CVE-2019-14878.json | 111 +++++++++++++++++---------------- 2019/16xxx/CVE-2019-16010.json | 4 +- 2019/16xxx/CVE-2019-16012.json | 4 +- 2020/10xxx/CVE-2020-10679.json | 18 ++++++ 2020/1xxx/CVE-2020-1705.json | 5 +- 2020/2xxx/CVE-2020-2099.json | 5 ++ 2020/2xxx/CVE-2020-2100.json | 5 ++ 2020/2xxx/CVE-2020-2101.json | 5 ++ 2020/2xxx/CVE-2020-2102.json | 5 ++ 2020/2xxx/CVE-2020-2103.json | 5 ++ 2020/2xxx/CVE-2020-2104.json | 5 ++ 2020/2xxx/CVE-2020-2105.json | 5 ++ 2020/3xxx/CVE-2020-3264.json | 4 +- 2020/3xxx/CVE-2020-3265.json | 4 +- 2020/3xxx/CVE-2020-3266.json | 4 +- 25 files changed, 667 insertions(+), 473 deletions(-) create mode 100644 2020/10xxx/CVE-2020-10679.json diff --git a/2014/2xxx/CVE-2014-2721.json b/2014/2xxx/CVE-2014-2721.json index 8be48ca99f6..dd483e63b92 100644 --- a/2014/2xxx/CVE-2014-2721.json +++ b/2014/2xxx/CVE-2014-2721.json @@ -1,17 +1,61 @@ { - "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", - "ID": "CVE-2014-2721", - "STATE": "RESERVED" - }, - "data_format": "MITRE", "data_type": "CVE", + "data_format": "MITRE", "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2014-2721", + "ASSIGNER": "cve@mitre.org", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "CONFIRM", + "name": "https://fortiguard.com/advisory/FG-IR-14-010", + "url": "https://fortiguard.com/advisory/FG-IR-14-010" + } + ] + }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged access to affected systems using SSH. The vulnerability is caused by a configuration error, and is not the result of an underlying SSH defect." } ] } diff --git a/2014/2xxx/CVE-2014-2722.json b/2014/2xxx/CVE-2014-2722.json index 83051db7648..0443bd13455 100644 --- a/2014/2xxx/CVE-2014-2722.json +++ b/2014/2xxx/CVE-2014-2722.json @@ -1,17 +1,61 @@ { - "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", - "ID": "CVE-2014-2722", - "STATE": "RESERVED" - }, - "data_format": "MITRE", "data_type": "CVE", + "data_format": "MITRE", "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2014-2722", + "ASSIGNER": "cve@mitre.org", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "CONFIRM", + "name": "https://fortiguard.com/advisory/FG-IR-14-010", + "url": "https://fortiguard.com/advisory/FG-IR-14-010" + } + ] + }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged access to affected systems using SSH. The vulnerability is caused by a configuration error, and is not the result of an underlying SSH defect." } ] } diff --git a/2014/2xxx/CVE-2014-2723.json b/2014/2xxx/CVE-2014-2723.json index 73110385b1b..a36f2e9255f 100644 --- a/2014/2xxx/CVE-2014-2723.json +++ b/2014/2xxx/CVE-2014-2723.json @@ -1,17 +1,61 @@ { - "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", - "ID": "CVE-2014-2723", - "STATE": "RESERVED" - }, - "data_format": "MITRE", "data_type": "CVE", + "data_format": "MITRE", "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2014-2723", + "ASSIGNER": "cve@mitre.org", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "CONFIRM", + "name": "https://fortiguard.com/advisory/FG-IR-14-010", + "url": "https://fortiguard.com/advisory/FG-IR-14-010" + } + ] + }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged access to affected systems using SSH. The vulnerability is caused by a configuration error, and is not the result of an underlying SSH defect." } ] } diff --git a/2019/14xxx/CVE-2019-14871.json b/2019/14xxx/CVE-2019-14871.json index 22ce606faf8..aa1e7f71b47 100644 --- a/2019/14xxx/CVE-2019-14871.json +++ b/2019/14xxx/CVE-2019-14871.json @@ -1,64 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", - "CVE_data_meta": { - "ID": "CVE-2019-14871", - "ASSIGNER": "mrehak@redhat.com" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "vendor_name": "Red Hat", - "product": { - "product_data": [ - { - "product_name": "newlib", - "version": { - "version_data": [ - { - "version_value": "all newlib versions prior to 3.3.0" + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2019-14871", + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Red Hat", + "product": { + "product_data": [ + { + "product_name": "newlib", + "version": { + "version_data": [ + { + "version_value": "all newlib versions prior to 3.3.0" + } + ] + } + } + ] } - ] } - } ] - } } - ] - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-476" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "refsource": "CONFIRM" + } + ] + }, + "description": { + "description_data": [ { "lang": "eng", - "value": "CWE-476" + "value": "The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP and other newlib macros in versions prior to 3.3.0, does not check for memory allocation problems when the DEBUG flag is unset (as is the case in production firmware builds)." } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "refsource": "CONFIRM" - } - ] - }, - "description": { - "description_data": [ - { - "lang": "eng", - "value": "The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP and other newlib macros in versions prior to 3.3.0, does not check for memory allocation problems when the DEBUG flag is unset (as is the case in production firmware builds). " - } - ] - }, - "impact": { + ] + }, + "impact": { "cvss": [ [ { @@ -67,5 +68,5 @@ } ] ] - } -} + } +} \ No newline at end of file diff --git a/2019/14xxx/CVE-2019-14872.json b/2019/14xxx/CVE-2019-14872.json index 0c941210917..85edce024bf 100644 --- a/2019/14xxx/CVE-2019-14872.json +++ b/2019/14xxx/CVE-2019-14872.json @@ -1,64 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", - "CVE_data_meta": { - "ID": "CVE-2019-14872", - "ASSIGNER": "mrehak@redhat.com" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "vendor_name": "Red Hat", - "product": { - "product_data": [ - { - "product_name": "newlib", - "version": { - "version_data": [ - { - "version_value": "all newlib versions prior to 3.3.0" + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2019-14872", + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Red Hat", + "product": { + "product_data": [ + { + "product_name": "newlib", + "version": { + "version_data": [ + { + "version_value": "all newlib versions prior to 3.3.0" + } + ] + } + } + ] } - ] } - } ] - } } - ] - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-476" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "refsource": "CONFIRM" + } + ] + }, + "description": { + "description_data": [ { "lang": "eng", - "value": "CWE-476" + "value": "The _dtoa_r function of the newlib libc library, prior to version 3.3.0, performs multiple memory allocations without checking their return value. This could result in NULL pointer dereference." } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "refsource": "CONFIRM" - } - ] - }, - "description": { - "description_data": [ - { - "lang": "eng", - "value": "The _dtoa_r function of the newlib libc library, prior to version 3.3.0, performs multiple memory allocations without checking their return value. This could result in NULL pointer dereference." - } - ] - }, - "impact": { + ] + }, + "impact": { "cvss": [ [ { @@ -67,5 +68,5 @@ } ] ] - } -} + } +} \ No newline at end of file diff --git a/2019/14xxx/CVE-2019-14873.json b/2019/14xxx/CVE-2019-14873.json index 09d3c6849b6..d6b5692fe1e 100644 --- a/2019/14xxx/CVE-2019-14873.json +++ b/2019/14xxx/CVE-2019-14873.json @@ -1,64 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", - "CVE_data_meta": { - "ID": "CVE-2019-14873", - "ASSIGNER": "mrehak@redhat.com" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "vendor_name": "Red Hat", - "product": { - "product_data": [ - { - "product_name": "newlib", - "version": { - "version_data": [ - { - "version_value": "all newlib versions prior to 3.3.0" + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2019-14873", + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Red Hat", + "product": { + "product_data": [ + { + "product_name": "newlib", + "version": { + "version_data": [ + { + "version_value": "all newlib versions prior to 3.3.0" + } + ] + } + } + ] } - ] } - } ] - } } - ] - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-476" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "refsource": "CONFIRM" + } + ] + }, + "description": { + "description_data": [ { "lang": "eng", - "value": "CWE-476" + "value": "In the __multadd function of the newlib libc library, prior to versions 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. This will trigger a null pointer dereference bug in case of a memory allocation failure." } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "refsource": "CONFIRM" - } - ] - }, - "description": { - "description_data": [ - { - "lang": "eng", - "value": " In the __multadd function of the newlib libc library, prior to versions 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. This will trigger a null pointer dereference bug in case of a memory allocation failure." - } - ] - }, - "impact": { + ] + }, + "impact": { "cvss": [ [ { @@ -67,5 +68,5 @@ } ] ] - } -} + } +} \ No newline at end of file diff --git a/2019/14xxx/CVE-2019-14874.json b/2019/14xxx/CVE-2019-14874.json index 71730e947b2..edce36246c0 100644 --- a/2019/14xxx/CVE-2019-14874.json +++ b/2019/14xxx/CVE-2019-14874.json @@ -1,64 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", - "CVE_data_meta": { - "ID": "CVE-2019-14874", - "ASSIGNER": "mrehak@redhat.com" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "vendor_name": "Red Hat", - "product": { - "product_data": [ - { - "product_name": "newlib", - "version": { - "version_data": [ - { - "version_value": "all newlib versions prior to 3.3.0" + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2019-14874", + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Red Hat", + "product": { + "product_data": [ + { + "product_name": "newlib", + "version": { + "version_data": [ + { + "version_value": "all newlib versions prior to 3.3.0" + } + ] + } + } + ] } - ] } - } ] - } } - ] - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-476" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "refsource": "CONFIRM" + } + ] + }, + "description": { + "description_data": [ { "lang": "eng", - "value": "CWE-476" + "value": "In the __i2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. The access of _ x[0] will trigger a null pointer dereference bug in case of a memory allocation failure." } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "refsource": "CONFIRM" - } - ] - }, - "description": { - "description_data": [ - { - "lang": "eng", - "value": "In the __i2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. The access of _ x[0] will trigger a null pointer dereference bug in case of a memory allocation failure." - } - ] - }, - "impact": { + ] + }, + "impact": { "cvss": [ [ { @@ -67,5 +68,5 @@ } ] ] - } -} + } +} \ No newline at end of file diff --git a/2019/14xxx/CVE-2019-14875.json b/2019/14xxx/CVE-2019-14875.json index ab928fa7846..391fcbc74a5 100644 --- a/2019/14xxx/CVE-2019-14875.json +++ b/2019/14xxx/CVE-2019-14875.json @@ -1,64 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", - "CVE_data_meta": { - "ID": "CVE-2019-14875", - "ASSIGNER": "mrehak@redhat.com" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "vendor_name": "Red Hat", - "product": { - "product_data": [ - { - "product_name": "newlib", - "version": { - "version_data": [ - { - "version_value": "all newlib versions prior to 3.3.0" + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2019-14875", + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Red Hat", + "product": { + "product_data": [ + { + "product_name": "newlib", + "version": { + "version_data": [ + { + "version_value": "all newlib versions prior to 3.3.0" + } + ] + } + } + ] } - ] } - } ] - } } - ] - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-476" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "refsource": "CONFIRM" + } + ] + }, + "description": { + "description_data": [ { "lang": "eng", - "value": "CWE-476" + "value": "In the __multiply function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. The access of _x[0] will trigger a null pointer dereference bug in case of a memory allocation failure." } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "refsource": "CONFIRM" - } - ] - }, - "description": { - "description_data": [ - { - "lang": "eng", - "value": "In the __multiply function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. The access of _x[0] will trigger a null pointer dereference bug in case of a memory allocation failure." - } - ] - }, - "impact": { + ] + }, + "impact": { "cvss": [ [ { @@ -67,5 +68,5 @@ } ] ] - } -} + } +} \ No newline at end of file diff --git a/2019/14xxx/CVE-2019-14876.json b/2019/14xxx/CVE-2019-14876.json index e2ee7d163f1..d1f29205103 100644 --- a/2019/14xxx/CVE-2019-14876.json +++ b/2019/14xxx/CVE-2019-14876.json @@ -1,64 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", - "CVE_data_meta": { - "ID": "CVE-2019-14876", - "ASSIGNER": "mrehak@redhat.com" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "vendor_name": "Red Hat", - "product": { - "product_data": [ - { - "product_name": "newlib", - "version": { - "version_data": [ - { - "version_value": "all newlib versions prior to 3.3.0" + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2019-14876", + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Red Hat", + "product": { + "product_data": [ + { + "product_name": "newlib", + "version": { + "version_data": [ + { + "version_value": "all newlib versions prior to 3.3.0" + } + ] + } + } + ] } - ] } - } ] - } } - ] - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-476" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "refsource": "CONFIRM" + } + ] + }, + "description": { + "description_data": [ { "lang": "eng", - "value": "CWE-476" + "value": "In the __lshift function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. The access to b1 will trigger a null pointer dereference bug in case of a memory allocation failure." } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "refsource": "CONFIRM" - } - ] - }, - "description": { - "description_data": [ - { - "lang": "eng", - "value": "In the __lshift function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. The access to b1 will trigger a null pointer dereference bug in case of a memory allocation failure. " - } - ] - }, - "impact": { + ] + }, + "impact": { "cvss": [ [ { @@ -67,5 +68,5 @@ } ] ] - } -} + } +} \ No newline at end of file diff --git a/2019/14xxx/CVE-2019-14877.json b/2019/14xxx/CVE-2019-14877.json index 6c305038e11..6d72ec1d456 100644 --- a/2019/14xxx/CVE-2019-14877.json +++ b/2019/14xxx/CVE-2019-14877.json @@ -1,64 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", - "CVE_data_meta": { - "ID": "CVE-2019-14877", - "ASSIGNER": "mrehak@redhat.com" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "vendor_name": "Red Hat", - "product": { - "product_data": [ - { - "product_name": "newlib", - "version": { - "version_data": [ - { - "version_value": "all newlib versions prior to 3.3.0" + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2019-14877", + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Red Hat", + "product": { + "product_data": [ + { + "product_name": "newlib", + "version": { + "version_data": [ + { + "version_value": "all newlib versions prior to 3.3.0" + } + ] + } + } + ] } - ] } - } ] - } } - ] - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-476" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "refsource": "CONFIRM" + } + ] + }, + "description": { + "description_data": [ { "lang": "eng", - "value": "CWE-476" + "value": "In the __mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate big integers, however no check is performed to verify if the allocation succeeded or not. The access to _wds and _sign will trigger a null pointer dereference bug in case of a memory allocation failure." } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "refsource": "CONFIRM" - } - ] - }, - "description": { - "description_data": [ - { - "lang": "eng", - "value": "In the __mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate big integers, however no check is performed to verify if the allocation succeeded or not. The access to _wds and _sign will trigger a null pointer dereference bug in case of a memory allocation failure." - } - ] - }, - "impact": { + ] + }, + "impact": { "cvss": [ [ { @@ -67,5 +68,5 @@ } ] ] - } -} + } +} \ No newline at end of file diff --git a/2019/14xxx/CVE-2019-14878.json b/2019/14xxx/CVE-2019-14878.json index 018cfd71741..1ccf22c4c2a 100644 --- a/2019/14xxx/CVE-2019-14878.json +++ b/2019/14xxx/CVE-2019-14878.json @@ -1,64 +1,65 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", - "CVE_data_meta": { - "ID": "CVE-2019-14878", - "ASSIGNER": "mrehak@redhat.com" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "vendor_name": "Red Hat", - "product": { - "product_data": [ - { - "product_name": "newlib", - "version": { - "version_data": [ - { - "version_value": "all newlib versions prior to 3.3.0" + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2019-14878", + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Red Hat", + "product": { + "product_data": [ + { + "product_name": "newlib", + "version": { + "version_data": [ + { + "version_value": "all newlib versions prior to 3.3.0" + } + ] + } + } + ] } - ] } - } ] - } } - ] - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-476" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", + "refsource": "CONFIRM" + } + ] + }, + "description": { + "description_data": [ { "lang": "eng", - "value": "CWE-476" + "value": "In the __d2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. Accessing _x will trigger a null pointer dereference bug in case of a memory allocation failure." } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "name": "https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/", - "refsource": "CONFIRM" - } - ] - }, - "description": { - "description_data": [ - { - "lang": "eng", - "value": "In the __d2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. Accessing _x will trigger a null pointer dereference bug in case of a memory allocation failure. " - } - ] - }, - "impact": { + ] + }, + "impact": { "cvss": [ [ { @@ -67,5 +68,5 @@ } ] ] - } -} + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16010.json b/2019/16xxx/CVE-2019-16010.json index 615764dae8b..e079ab1ca18 100644 --- a/2019/16xxx/CVE-2019-16010.json +++ b/2019/16xxx/CVE-2019-16010.json @@ -36,7 +36,7 @@ "description_data": [ { "lang": "eng", - "value": "\r A vulnerability in the web UI of the Cisco SD-WAN vManage software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the vManage software.\r The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.\r " + "value": "A vulnerability in the web UI of the Cisco SD-WAN vManage software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the vManage software. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information." } ] }, @@ -83,4 +83,4 @@ ], "discovery": "INTERNAL" } -} +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16012.json b/2019/16xxx/CVE-2019-16012.json index dce160fa944..d80a241e8f9 100644 --- a/2019/16xxx/CVE-2019-16012.json +++ b/2019/16xxx/CVE-2019-16012.json @@ -36,7 +36,7 @@ "description_data": [ { "lang": "eng", - "value": " A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web UI improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on, or return values from, the underlying database as well as the operating system. " + "value": "A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web UI improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on, or return values from, the underlying database as well as the operating system." } ] }, @@ -84,4 +84,4 @@ ], "discovery": "INTERNAL" } -} +} \ No newline at end of file diff --git a/2020/10xxx/CVE-2020-10679.json b/2020/10xxx/CVE-2020-10679.json new file mode 100644 index 00000000000..c4e99b1d6a5 --- /dev/null +++ b/2020/10xxx/CVE-2020-10679.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2020-10679", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2020/1xxx/CVE-2020-1705.json b/2020/1xxx/CVE-2020-1705.json index 6accab14037..b200154f902 100644 --- a/2020/1xxx/CVE-2020-1705.json +++ b/2020/1xxx/CVE-2020-1705.json @@ -4,7 +4,8 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-1705", - "ASSIGNER": "darunesh@redhat.com" + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" }, "affects": { "vendor": { @@ -68,4 +69,4 @@ ] ] } -} +} \ No newline at end of file diff --git a/2020/2xxx/CVE-2020-2099.json b/2020/2xxx/CVE-2020-2099.json index 4df56d197a4..0db1b7ccb76 100644 --- a/2020/2xxx/CVE-2020-2099.json +++ b/2020/2xxx/CVE-2020-2099.json @@ -72,6 +72,11 @@ "name": "RHSA-2020:0681", "url": "https://access.redhat.com/errata/RHSA-2020:0681" }, + { + "refsource": "REDHAT", + "name": "RHSA-2020:0683", + "url": "https://access.redhat.com/errata/RHSA-2020:0683" + }, { "refsource": "REDHAT", "name": "RHBA-2020:0402", diff --git a/2020/2xxx/CVE-2020-2100.json b/2020/2xxx/CVE-2020-2100.json index 02fa0a40c15..ff145f8e3c0 100644 --- a/2020/2xxx/CVE-2020-2100.json +++ b/2020/2xxx/CVE-2020-2100.json @@ -72,6 +72,11 @@ "name": "RHSA-2020:0681", "url": "https://access.redhat.com/errata/RHSA-2020:0681" }, + { + "refsource": "REDHAT", + "name": "RHSA-2020:0683", + "url": "https://access.redhat.com/errata/RHSA-2020:0683" + }, { "refsource": "REDHAT", "name": "RHBA-2020:0402", diff --git a/2020/2xxx/CVE-2020-2101.json b/2020/2xxx/CVE-2020-2101.json index 36200e22a6a..a1e9e5cf3ca 100644 --- a/2020/2xxx/CVE-2020-2101.json +++ b/2020/2xxx/CVE-2020-2101.json @@ -72,6 +72,11 @@ "name": "RHSA-2020:0681", "url": "https://access.redhat.com/errata/RHSA-2020:0681" }, + { + "refsource": "REDHAT", + "name": "RHSA-2020:0683", + "url": "https://access.redhat.com/errata/RHSA-2020:0683" + }, { "refsource": "REDHAT", "name": "RHBA-2020:0402", diff --git a/2020/2xxx/CVE-2020-2102.json b/2020/2xxx/CVE-2020-2102.json index 80cb420841a..d98fa854257 100644 --- a/2020/2xxx/CVE-2020-2102.json +++ b/2020/2xxx/CVE-2020-2102.json @@ -72,6 +72,11 @@ "name": "RHSA-2020:0681", "url": "https://access.redhat.com/errata/RHSA-2020:0681" }, + { + "refsource": "REDHAT", + "name": "RHSA-2020:0683", + "url": "https://access.redhat.com/errata/RHSA-2020:0683" + }, { "refsource": "REDHAT", "name": "RHBA-2020:0402", diff --git a/2020/2xxx/CVE-2020-2103.json b/2020/2xxx/CVE-2020-2103.json index c6410e5a294..189d4a90946 100644 --- a/2020/2xxx/CVE-2020-2103.json +++ b/2020/2xxx/CVE-2020-2103.json @@ -72,6 +72,11 @@ "name": "RHSA-2020:0681", "url": "https://access.redhat.com/errata/RHSA-2020:0681" }, + { + "refsource": "REDHAT", + "name": "RHSA-2020:0683", + "url": "https://access.redhat.com/errata/RHSA-2020:0683" + }, { "refsource": "REDHAT", "name": "RHBA-2020:0402", diff --git a/2020/2xxx/CVE-2020-2104.json b/2020/2xxx/CVE-2020-2104.json index 4ad1ec07b0d..861a6e52aa1 100644 --- a/2020/2xxx/CVE-2020-2104.json +++ b/2020/2xxx/CVE-2020-2104.json @@ -72,6 +72,11 @@ "name": "RHSA-2020:0681", "url": "https://access.redhat.com/errata/RHSA-2020:0681" }, + { + "refsource": "REDHAT", + "name": "RHSA-2020:0683", + "url": "https://access.redhat.com/errata/RHSA-2020:0683" + }, { "refsource": "REDHAT", "name": "RHBA-2020:0402", diff --git a/2020/2xxx/CVE-2020-2105.json b/2020/2xxx/CVE-2020-2105.json index b45fe4640ea..843b3bea17b 100644 --- a/2020/2xxx/CVE-2020-2105.json +++ b/2020/2xxx/CVE-2020-2105.json @@ -72,6 +72,11 @@ "name": "RHSA-2020:0681", "url": "https://access.redhat.com/errata/RHSA-2020:0681" }, + { + "refsource": "REDHAT", + "name": "RHSA-2020:0683", + "url": "https://access.redhat.com/errata/RHSA-2020:0683" + }, { "refsource": "REDHAT", "name": "RHBA-2020:0402", diff --git a/2020/3xxx/CVE-2020-3264.json b/2020/3xxx/CVE-2020-3264.json index 8c55a8d6372..cce5e40b084 100644 --- a/2020/3xxx/CVE-2020-3264.json +++ b/2020/3xxx/CVE-2020-3264.json @@ -36,7 +36,7 @@ "description_data": [ { "lang": "eng", - "value": " A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to information that they are not authorized to access and make changes to the system that they are not authorized to make. " + "value": "A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to information that they are not authorized to access and make changes to the system that they are not authorized to make." } ] }, @@ -83,4 +83,4 @@ ], "discovery": "INTERNAL" } -} +} \ No newline at end of file diff --git a/2020/3xxx/CVE-2020-3265.json b/2020/3xxx/CVE-2020-3265.json index 24c6c491cf6..8eb988aa15f 100644 --- a/2020/3xxx/CVE-2020-3265.json +++ b/2020/3xxx/CVE-2020-3265.json @@ -36,7 +36,7 @@ "description_data": [ { "lang": "eng", - "value": " A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain root-level privileges. " + "value": "A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain root-level privileges." } ] }, @@ -83,4 +83,4 @@ ], "discovery": "INTERNAL" } -} +} \ No newline at end of file diff --git a/2020/3xxx/CVE-2020-3266.json b/2020/3xxx/CVE-2020-3266.json index 249ccaf7dd6..8e85b67f8a9 100644 --- a/2020/3xxx/CVE-2020-3266.json +++ b/2020/3xxx/CVE-2020-3266.json @@ -36,7 +36,7 @@ "description_data": [ { "lang": "eng", - "value": " A vulnerability in the CLI of Cisco SD-WAN Solution software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. A successful exploit could allow the attacker to execute commands with root privileges. " + "value": "A vulnerability in the CLI of Cisco SD-WAN Solution software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. A successful exploit could allow the attacker to execute commands with root privileges." } ] }, @@ -83,4 +83,4 @@ ], "discovery": "INTERNAL" } -} +} \ No newline at end of file