CVE-2019-9930

Various Lexmark products have an Integer Overflow.

Source: CVE-2019-9930

CVE-2019-9932

Various Lexmark products have a Buffer Overflow (issue 2 of 3).

Source: CVE-2019-9932

CVE-2019-9931

Various Lexmark printers contain a denial of service vulnerability in the SNMP service that can be exploited to crash the device.

Source: CVE-2019-9931

CVE-2019-10057

Various Lexmark products have CSRF.

Source: CVE-2019-10057

CVE-2019-10059

The legacy finger service (TCP port 79) is enabled by default on various older Lexmark devices.

Source: CVE-2019-10059

CVE-2019-10054

An issue was discovered in Suricata 4.1.3. The function process_reply_record_v3 lacks a check for the length of reply.data. It causes an invalid memory access and the program crashes within the nfs/nfs3.rs file.

Source: CVE-2019-10054

CVE-2019-10056

An issue was discovered in Suricata 4.1.3. The code mishandles the case of sending a network packet with the right type, such that the function DecodeEthernet in decode-ethernet.c is executed a second time. At this point, the algorithm cuts the first part of the packet and doesn’t determine the current length. Specifically, if the packet is exactly 28 long, in the first iteration it subtracts 14 bytes. Then, it is working with a packet length of 14. At this point, the case distinction says it is a valid packet. After that it casts the packet, but this packet has no type, and the program crashes at the type case distinction.

Source: CVE-2019-10056

CVE-2019-15753

In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.

Source: CVE-2019-15753

CVE-2019-15752

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%DockerDesktopversion-bin as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run ‘docker login’ to force the command.

Source: CVE-2019-15752

CVE-2019-10055

An issue was discovered in Suricata 4.1.3. The function ftp_pasv_response lacks a check for the length of part1 and part2, leading to a crash within the ftp/mod.rs file.

Source: CVE-2019-10055