Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-10-21 18:32:43 +00:00
parent 32c2ecad20
commit 9d378ea80d
168 changed files with 7159 additions and 48 deletions
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2gxx-vxp2-c52q",
-  "modified": "2022-05-02T03:16:35Z",
+  "modified": "2024-10-21T18:30:41Z",
  "published": "2022-05-02T03:16:35Z",
  "aliases": [
    "CVE-2009-0551"
  ],
  "details": "Microsoft Internet Explorer 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008 does not properly handle transition errors in a request for one HTTP document followed by a request for a second HTTP document, which allows remote attackers to execute arbitrary code via vectors involving (1) multiple crafted pages on a web site or (2) a web page with crafted inline content such as banner advertisements, aka \"Page Transition Memory Corruption Vulnerability.\"",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-533f-24pj-cvj8",
-  "modified": "2022-05-02T03:47:36Z",
+  "modified": "2024-10-21T18:30:42Z",
  "published": "2022-05-02T03:47:36Z",
  "aliases": [
    "CVE-2009-3671"
  ],
  "details": "Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka \"Uninitialized Memory Corruption Vulnerability,\" a different vulnerability than CVE-2009-3674.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -37,7 +40,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-416"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5pwp-v5cx-v53w",
-  "modified": "2022-05-02T03:26:06Z",
+  "modified": "2024-10-21T18:30:41Z",
  "published": "2022-05-02T03:26:06Z",
  "aliases": [
    "CVE-2009-1529"
  ],
  "details": "Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by calling the setCapture method on a collection of crafted objects, aka \"Uninitialized Memory Corruption Vulnerability.\"",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -57,7 +60,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-908"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-74r2-qf2j-vm8r",
-  "modified": "2022-05-17T01:01:53Z",
+  "modified": "2024-10-21T18:30:42Z",
  "published": "2022-05-17T01:01:53Z",
  "aliases": [
    "CVE-2011-1142"
  ],
  "details": "Stack consumption vulnerability in the dissect_ber_choice function in the BER dissector in Wireshark 1.2.x through 1.2.15 and 1.4.x through 1.4.4 might allow remote attackers to cause a denial of service (infinite loop) via vectors involving self-referential ASN.1 CHOICE values.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8h3g-5w8f-55gv",
-  "modified": "2022-05-13T01:15:38Z",
+  "modified": "2024-10-21T18:30:43Z",
  "published": "2022-05-13T01:15:38Z",
  "aliases": [
    "CVE-2012-1539"
  ],
  "details": "Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka \"CTreePos Use After Free Vulnerability.\"",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -45,7 +48,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-416"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-f74f-9cfw-p3xj",
-  "modified": "2022-05-02T03:26:11Z",
+  "modified": "2024-10-21T18:30:41Z",
  "published": "2022-05-02T03:26:11Z",
  "aliases": [
    "CVE-2009-1544"
  ],
  "details": "Double free vulnerability in the Workstation service in Microsoft Windows allows remote authenticated users to gain privileges via a crafted RPC message to a Windows XP SP2 or SP3 or Server 2003 SP2 system, or cause a denial of service via a crafted RPC message to a Vista Gold, SP1, or SP2 or Server 2008 Gold or SP2 system, aka \"Workstation Service Memory Corruption Vulnerability.\"",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -33,7 +36,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-415"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-f9vw-75cc-w892",
-  "modified": "2022-05-02T06:20:45Z",
+  "modified": "2024-10-21T18:30:42Z",
  "published": "2022-05-02T06:20:45Z",
  "aliases": [
    "CVE-2010-1260"
  ],
  "details": "The IE8 Developer Toolbar in Microsoft Internet Explorer 8 SP1, SP2, and SP3 allows user-assisted remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka \"HTML Element Memory Corruption Vulnerability.\"",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-h99v-p65j-fpx4",
-  "modified": "2022-05-02T03:35:50Z",
+  "modified": "2024-10-21T18:30:41Z",
  "published": "2022-05-02T03:35:50Z",
  "aliases": [
    "CVE-2009-2502"
  ],
  "details": "Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted TIFF image file, aka \"GDI+ TIFF Buffer Overflow Vulnerability.\"",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -33,7 +36,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-119"
+      "CWE-119",
+      "CWE-120"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hrmj-vxfx-2vq3",
-  "modified": "2022-05-14T01:32:15Z",
+  "modified": "2024-10-21T18:30:43Z",
  "published": "2022-05-14T01:32:15Z",
  "aliases": [
    "CVE-2013-0810"
  ],
  "details": "Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute arbitrary code via a crafted screensaver in a theme file, aka \"Windows Theme File Remote Code Execution Vulnerability.\"",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-jjvg-65v4-v3cq",
-  "modified": "2022-05-14T02:47:10Z",
+  "modified": "2024-10-21T18:30:44Z",
  "published": "2022-05-14T02:47:10Z",
  "aliases": [
    "CVE-2015-8370"
  ],
  "details": "Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an \"Off-by-two\" or \"Out of bounds overwrite\" memory error.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -113,7 +116,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-191"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-p9r7-8rjp-gmw3",
-  "modified": "2022-05-13T01:07:45Z",
+  "modified": "2024-10-21T18:30:43Z",
  "published": "2022-05-13T01:07:45Z",
  "aliases": [
    "CVE-2011-0346"
  ],
  "details": "Use-after-free vulnerability in the ReleaseInterface function in MSHTML.DLL in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the DOM implementation and the BreakAASpecial and BreakCircularMemoryReferences functions, as demonstrated by cross_fuzz, aka \"MSHTML Memory Corruption Vulnerability.\"",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -81,7 +84,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-416"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-r97j-8742-f767",
-  "modified": "2022-05-02T06:13:05Z",
+  "modified": "2024-10-21T18:30:42Z",
  "published": "2022-05-02T06:13:05Z",
  "aliases": [
    "CVE-2010-0492"
  ],
  "details": "Use-after-free vulnerability in mstime.dll in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via vectors related to the TIME2 behavior, the CTimeAction object, and destruction of markup, leading to memory corruption, aka \"HTML Object Memory Corruption Vulnerability.\"",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-vqxq-fjhv-69jf",
-  "modified": "2022-05-02T06:11:14Z",
+  "modified": "2024-10-21T18:30:42Z",
  "published": "2022-05-02T06:11:14Z",
  "aliases": [
    "CVE-2010-0248"
  ],
  "details": "Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka \"HTML Object Memory Corruption Vulnerability.\"",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -33,6 +36,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-416",
      "CWE-94"
    ],
    "severity": "HIGH",
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-wm54-3xjp-vjmc",
-  "modified": "2022-05-02T03:36:08Z",
+  "modified": "2024-10-21T18:30:41Z",
  "published": "2022-05-02T03:36:08Z",
  "aliases": [
    "CVE-2009-2529"
  ],
  "details": "Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not properly handle argument validation for unspecified variables, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka \"HTML Component Handling Vulnerability.\"",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-q56j-8x89-gvgg",
-  "modified": "2023-04-05T18:30:16Z",
+  "modified": "2024-10-21T18:30:45Z",
  "published": "2023-03-29T18:30:29Z",
  "aliases": [
    "CVE-2022-48434"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-rwg2-cqg5-rjm4",
-  "modified": "2023-11-29T15:30:20Z",
+  "modified": "2024-10-21T18:30:45Z",
  "published": "2023-04-28T03:30:16Z",
  "aliases": [
    "CVE-2023-31436"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4f5g-h3x2-8v9x",
-  "modified": "2023-12-04T15:31:54Z",
+  "modified": "2024-10-21T18:30:45Z",
  "published": "2023-06-19T00:30:19Z",
  "aliases": [
    "CVE-2023-35828"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3v76-qg7g-rx9c",
-  "modified": "2023-11-30T15:30:22Z",
+  "modified": "2024-10-21T18:30:45Z",
  "published": "2023-11-20T21:31:02Z",
  "aliases": [
    "CVE-2023-38885"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hchc-m7jw-6mhm",
-  "modified": "2023-12-05T21:31:00Z",
+  "modified": "2024-10-21T18:30:45Z",
  "published": "2023-11-16T09:30:24Z",
  "aliases": [
    "CVE-2023-47213"
@@ -0,0 +1,43 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-22wr-xr3p-42c4",
+  "modified": "2024-10-21T18:30:57Z",
+  "published": "2024-10-21T18:30:57Z",
+  "aliases": [
+    "CVE-2024-49897"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check phantom_stream before it is used\n\ndcn32_enable_phantom_stream can return null, so returned value\nmust be checked before used.\n\nThis fixes 1 NULL_RETURNS issue reported by Coverity.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49897"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/1decf695ce08e23d9ded6ce83d121b2282ce9899"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/3718a619a8c0a53152e76bb6769b6c414e1e83f4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/3ba1219e299ab5462b5cb374c2fa2a67af0ea190"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-21T18:15:12Z"
+  }
+}
--- a/Show More
+++ b/Show More