Ubuntu_linux - Vulncode-DB

Date	Id	Summary	Products	Score
2020-05-26	CVE-2020-6831	A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.	Ubuntu_linux, Debian_linux, Firefox, Firefox_esr, Thunderbird, Leap	9.8
2020-05-27	CVE-2020-13253	sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.	Ubuntu_linux, Debian_linux, Qemu	5.5
2020-05-27	CVE-2020-13630	ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.	Icloud, Ipados, Iphone_os, Itunes, Macos, Tvos, Watchos, Fabric_operating_system, Ubuntu_linux, Debian_linux, Fedora, Cloud_backup, Hci_compute_node_firmware, Solidfire\,_enterprise_sds_\&_hci_storage_node, Communications_network_charging_and_control, Outside_in_technology, Zfs_storage_appliance_kit, Sinec_infrastructure_network_services, Sqlite	7.0
2020-05-27	CVE-2020-13631	SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.	Icloud, Ipados, Iphone_os, Itunes, Macos, Tvos, Watchos, Fabric_operating_system, Ubuntu_linux, Fedora, Cloud_backup, Hci_compute_node_firmware, Solidfire\,_enterprise_sds_\&_hci_storage_node, Communications_network_charging_and_control, Outside_in_technology, Zfs_storage_appliance_kit, Sinec_infrastructure_network_services, Sqlite	5.5
2020-05-27	CVE-2020-13632	ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.	Fabric_operating_system, Ubuntu_linux, Debian_linux, Fedora, Cloud_backup, Hci_compute_node_firmware, Solidfire\,_enterprise_sds_\&_hci_storage_node, Communications_network_charging_and_control, Outside_in_technology, Zfs_storage_appliance_kit, Sinec_infrastructure_network_services, Sqlite	5.5
2020-05-28	CVE-2020-13645	In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.	Fabric_operating_system, Ubuntu_linux, Fedora, Balsa, Glib\-Networking, Cloud_backup	6.5
2020-05-28	CVE-2020-13361	In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.	Ubuntu_linux, Debian_linux, Leap, Qemu	3.9
2020-05-28	CVE-2020-13362	In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.	Ubuntu_linux, Debian_linux, Leap, Qemu	3.2
2020-06-01	CVE-2020-12867	A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.	Ubuntu_linux, Debian_linux, Fedora, Leap, Sane_backends	5.5
2020-06-01	CVE-2020-13757	Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).	Ubuntu_linux, Fedora, Python\-Rsa	7.5

Product: Ubuntu_linux (Canonical)

Product:
Ubuntu_linux
(Canonical)