1280 lines
45 KiB
JSON
1280 lines
45 KiB
JSON
{
|
|
"CVE_data_type" : "CVE",
|
|
"CVE_data_format" : "MITRE",
|
|
"CVE_data_version" : "4.0",
|
|
"CVE_data_numberOfCVEs" : "9826",
|
|
"CVE_data_timestamp" : "2019-10-17T07:00Z",
|
|
"CVE_Items" : [ {
|
|
"cve" : {
|
|
"data_type" : "CVE",
|
|
"data_format" : "MITRE",
|
|
"data_version" : "4.0",
|
|
"CVE_data_meta" : {
|
|
"ID" : "CVE-2019-0001",
|
|
"ASSIGNER" : "cve@mitre.org"
|
|
},
|
|
"problemtype" : {
|
|
"problemtype_data" : [ {
|
|
"description" : [ {
|
|
"lang" : "en",
|
|
"value" : "CWE-400"
|
|
} ]
|
|
} ]
|
|
},
|
|
"references" : {
|
|
"reference_data" : [ {
|
|
"url" : "http://www.securityfocus.com/bid/106541",
|
|
"name" : "106541",
|
|
"refsource" : "BID",
|
|
"tags" : [ "Third Party Advisory", "VDB Entry" ]
|
|
}, {
|
|
"url" : "https://kb.juniper.net/JSA10900",
|
|
"name" : "https://kb.juniper.net/JSA10900",
|
|
"refsource" : "CONFIRM",
|
|
"tags" : [ "Vendor Advisory" ]
|
|
} ]
|
|
},
|
|
"description" : {
|
|
"description_data" : [ {
|
|
"lang" : "en",
|
|
"value" : "Receipt of a malformed packet on MX Series devices with dynamic vlan configuration can trigger an uncontrolled recursion loop in the Broadband Edge subscriber management daemon (bbe-smgd), and lead to high CPU usage and a crash of the bbe-smgd service. Repeated receipt of the same packet can result in an extended denial of service condition for the device. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S1; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S1; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2."
|
|
} ]
|
|
}
|
|
},
|
|
"configurations" : {
|
|
"CVE_data_version" : "4.0",
|
|
"nodes" : [ {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:*:*:*:*:*:*:*"
|
|
} ]
|
|
}, {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:16.2:*:*:*:*:*:*:*"
|
|
} ]
|
|
}, {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:17.1:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:17.1:r1:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:17.1:r2:*:*:*:*:*:*"
|
|
} ]
|
|
}, {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:a:juniper:junos:18.2:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:a:juniper:junos:18.2:r1-s3:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:a:juniper:junos:18.2:r1-s4:*:*:*:*:*:*"
|
|
} ]
|
|
} ]
|
|
},
|
|
"impact" : {
|
|
"baseMetricV3" : {
|
|
"cvssV3" : {
|
|
"version" : "3.0",
|
|
"vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"attackVector" : "NETWORK",
|
|
"attackComplexity" : "HIGH",
|
|
"privilegesRequired" : "NONE",
|
|
"userInteraction" : "NONE",
|
|
"scope" : "UNCHANGED",
|
|
"confidentialityImpact" : "NONE",
|
|
"integrityImpact" : "NONE",
|
|
"availabilityImpact" : "HIGH",
|
|
"baseScore" : 5.9,
|
|
"baseSeverity" : "MEDIUM"
|
|
},
|
|
"exploitabilityScore" : 2.2,
|
|
"impactScore" : 3.6
|
|
},
|
|
"baseMetricV2" : {
|
|
"cvssV2" : {
|
|
"version" : "2.0",
|
|
"vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C",
|
|
"accessVector" : "NETWORK",
|
|
"accessComplexity" : "MEDIUM",
|
|
"authentication" : "NONE",
|
|
"confidentialityImpact" : "NONE",
|
|
"integrityImpact" : "NONE",
|
|
"availabilityImpact" : "COMPLETE",
|
|
"baseScore" : 7.1
|
|
},
|
|
"severity" : "HIGH",
|
|
"exploitabilityScore" : 8.6,
|
|
"impactScore" : 6.9,
|
|
"acInsufInfo" : false,
|
|
"obtainAllPrivilege" : false,
|
|
"obtainUserPrivilege" : false,
|
|
"obtainOtherPrivilege" : false,
|
|
"userInteractionRequired" : false
|
|
}
|
|
},
|
|
"publishedDate" : "2019-01-15T21:29Z",
|
|
"lastModifiedDate" : "2019-10-09T23:43Z"
|
|
}, {
|
|
"cve" : {
|
|
"data_type" : "CVE",
|
|
"data_format" : "MITRE",
|
|
"data_version" : "4.0",
|
|
"CVE_data_meta" : {
|
|
"ID" : "CVE-2019-0005",
|
|
"ASSIGNER" : "cve@mitre.org"
|
|
},
|
|
"problemtype" : {
|
|
"problemtype_data" : [ {
|
|
"description" : [ {
|
|
"lang" : "en",
|
|
"value" : "CWE-400"
|
|
} ]
|
|
} ]
|
|
},
|
|
"references" : {
|
|
"reference_data" : [ {
|
|
"url" : "http://www.securityfocus.com/bid/106665",
|
|
"name" : "106665",
|
|
"refsource" : "BID",
|
|
"tags" : [ "Third Party Advisory" ]
|
|
}, {
|
|
"url" : "https://kb.juniper.net/JSA10905",
|
|
"name" : "https://kb.juniper.net/JSA10905",
|
|
"refsource" : "CONFIRM",
|
|
"tags" : [ "Vendor Advisory" ]
|
|
} ]
|
|
},
|
|
"description" : {
|
|
"description_data" : [ {
|
|
"lang" : "en",
|
|
"value" : "On EX2300, EX3400, EX4600, QFX3K and QFX5K series, firewall filter configuration cannot perform packet matching on any IPv6 extension headers. This issue may allow IPv6 packets that should have been blocked to be forwarded. IPv4 packet filtering is unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS on EX and QFX series;: 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1R7; 15.1X53 versions prior to 15.1X53-D234 on QFX5200/QFX5110 series; 15.1X53 versions prior to 15.1X53-D591 on EX2300/EX3400 series; 16.1 versions prior to 16.1R7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R2."
|
|
} ]
|
|
}
|
|
},
|
|
"configurations" : {
|
|
"CVE_data_version" : "4.0",
|
|
"nodes" : [ {
|
|
"operator" : "AND",
|
|
"children" : [ {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d10:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d15:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d16:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d25:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d26:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d27:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d30:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d35:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d40:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d42:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d43:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d44:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d45:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:14.1x53:d46:*:*:*:*:*:*"
|
|
} ]
|
|
}, {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
|
|
} ]
|
|
} ]
|
|
}, {
|
|
"operator" : "AND",
|
|
"children" : [ {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1:r1:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1:r2:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1:r3:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1:r4:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1:r5:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1:r6:*:*:*:*:*:*"
|
|
} ]
|
|
}, {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
|
|
} ]
|
|
} ]
|
|
}, {
|
|
"operator" : "AND",
|
|
"children" : [ {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d20:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d21:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d30:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d32:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d33:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d34:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d50:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d51:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d52:*:*:*:*:*:*"
|
|
} ]
|
|
}, {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
|
|
} ]
|
|
} ]
|
|
}, {
|
|
"operator" : "AND",
|
|
"children" : [ {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d20:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d21:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d210:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d230:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d234:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d30:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d32:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d33:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d34:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d50:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d51:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d52:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d55:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d57:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d58:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d59:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:15.1x53:d590:*:*:*:*:*:*"
|
|
} ]
|
|
}, {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
|
|
} ]
|
|
} ]
|
|
}, {
|
|
"operator" : "AND",
|
|
"children" : [ {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r1:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r2:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r3:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r3-s10:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r4:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r5:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r6:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r6-s6:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:16.1:r7:*:*:*:*:*:*"
|
|
} ]
|
|
}, {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
|
|
} ]
|
|
} ]
|
|
}, {
|
|
"operator" : "AND",
|
|
"children" : [ {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:17.1:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:17.1:r1:*:*:*:*:*:*"
|
|
} ]
|
|
}, {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
|
|
} ]
|
|
} ]
|
|
}, {
|
|
"operator" : "AND",
|
|
"children" : [ {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:17.2:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:17.2:r1:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:17.2:r1-s7:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:17.2:r2:*:*:*:*:*:*"
|
|
} ]
|
|
}, {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
|
|
} ]
|
|
} ]
|
|
}, {
|
|
"operator" : "AND",
|
|
"children" : [ {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:17.3:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:17.3:r1:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:17.3:r2:*:*:*:*:*:*"
|
|
} ]
|
|
}, {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:gfx3600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
|
|
} ]
|
|
} ]
|
|
}, {
|
|
"operator" : "AND",
|
|
"children" : [ {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:17.4:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:o:juniper:junos:17.4:r1:*:*:*:*:*:*"
|
|
} ]
|
|
}, {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
|
|
} ]
|
|
} ]
|
|
}, {
|
|
"operator" : "AND",
|
|
"children" : [ {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:a:juniper:junos:18.1:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:a:juniper:junos:18.1:r1:*:*:*:*:*:*"
|
|
} ]
|
|
}, {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*"
|
|
}, {
|
|
"vulnerable" : false,
|
|
"cpe23Uri" : "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*"
|
|
} ]
|
|
} ]
|
|
} ]
|
|
},
|
|
"impact" : {
|
|
"baseMetricV3" : {
|
|
"cvssV3" : {
|
|
"version" : "3.0",
|
|
"vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"attackVector" : "NETWORK",
|
|
"attackComplexity" : "LOW",
|
|
"privilegesRequired" : "NONE",
|
|
"userInteraction" : "NONE",
|
|
"scope" : "UNCHANGED",
|
|
"confidentialityImpact" : "NONE",
|
|
"integrityImpact" : "LOW",
|
|
"availabilityImpact" : "NONE",
|
|
"baseScore" : 5.3,
|
|
"baseSeverity" : "MEDIUM"
|
|
},
|
|
"exploitabilityScore" : 3.9,
|
|
"impactScore" : 1.4
|
|
},
|
|
"baseMetricV2" : {
|
|
"cvssV2" : {
|
|
"version" : "2.0",
|
|
"vectorString" : "AV:N/AC:L/Au:N/C:N/I:P/A:N",
|
|
"accessVector" : "NETWORK",
|
|
"accessComplexity" : "LOW",
|
|
"authentication" : "NONE",
|
|
"confidentialityImpact" : "NONE",
|
|
"integrityImpact" : "PARTIAL",
|
|
"availabilityImpact" : "NONE",
|
|
"baseScore" : 5.0
|
|
},
|
|
"severity" : "MEDIUM",
|
|
"exploitabilityScore" : 10.0,
|
|
"impactScore" : 2.9,
|
|
"acInsufInfo" : false,
|
|
"obtainAllPrivilege" : false,
|
|
"obtainUserPrivilege" : false,
|
|
"obtainOtherPrivilege" : false,
|
|
"userInteractionRequired" : false
|
|
}
|
|
},
|
|
"publishedDate" : "2019-01-15T21:29Z",
|
|
"lastModifiedDate" : "2019-02-14T18:40Z"
|
|
}, {
|
|
"cve" : {
|
|
"data_type" : "CVE",
|
|
"data_format" : "MITRE",
|
|
"data_version" : "4.0",
|
|
"CVE_data_meta" : {
|
|
"ID" : "CVE-2019-14811",
|
|
"ASSIGNER" : "cve@mitre.org"
|
|
},
|
|
"problemtype" : {
|
|
"problemtype_data" : [ {
|
|
"description" : [ {
|
|
"lang" : "en",
|
|
"value" : "CWE-264"
|
|
} ]
|
|
} ]
|
|
},
|
|
"references" : {
|
|
"reference_data" : [ {
|
|
"url" : "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html",
|
|
"name" : "openSUSE-SU-2019:2223",
|
|
"refsource" : "SUSE",
|
|
"tags" : [ ]
|
|
}, {
|
|
"url" : "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html",
|
|
"name" : "openSUSE-SU-2019:2222",
|
|
"refsource" : "SUSE",
|
|
"tags" : [ ]
|
|
}, {
|
|
"url" : "https://access.redhat.com/errata/RHBA-2019:2824",
|
|
"name" : "RHBA-2019:2824",
|
|
"refsource" : "REDHAT",
|
|
"tags" : [ ]
|
|
}, {
|
|
"url" : "https://access.redhat.com/errata/RHSA-2019:2594",
|
|
"name" : "RHSA-2019:2594",
|
|
"refsource" : "REDHAT",
|
|
"tags" : [ ]
|
|
}, {
|
|
"url" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14811",
|
|
"name" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14811",
|
|
"refsource" : "CONFIRM",
|
|
"tags" : [ "Exploit", "Issue Tracking", "Mitigation", "Patch", "Third Party Advisory" ]
|
|
}, {
|
|
"url" : "https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html",
|
|
"name" : "[debian-lts-announce] 20190909 [SECURITY] [DLA 1915-1] ghostscript security update",
|
|
"refsource" : "MLIST",
|
|
"tags" : [ ]
|
|
}, {
|
|
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/",
|
|
"name" : "FEDORA-2019-ebd6c4f15a",
|
|
"refsource" : "FEDORA",
|
|
"tags" : [ ]
|
|
}, {
|
|
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/",
|
|
"name" : "FEDORA-2019-0a9d525d71",
|
|
"refsource" : "FEDORA",
|
|
"tags" : [ ]
|
|
}, {
|
|
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/",
|
|
"name" : "FEDORA-2019-953fc0f16d",
|
|
"refsource" : "FEDORA",
|
|
"tags" : [ ]
|
|
}, {
|
|
"url" : "https://seclists.org/bugtraq/2019/Sep/15",
|
|
"name" : "20190910 [SECURITY] [DSA 4518-1] ghostscript security update",
|
|
"refsource" : "BUGTRAQ",
|
|
"tags" : [ ]
|
|
}, {
|
|
"url" : "https://www.debian.org/security/2019/dsa-4518",
|
|
"name" : "DSA-4518",
|
|
"refsource" : "DEBIAN",
|
|
"tags" : [ ]
|
|
} ]
|
|
},
|
|
"description" : {
|
|
"description_data" : [ {
|
|
"lang" : "en",
|
|
"value" : "A flaw was found in, ghostscript versions prior to 9.28, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands."
|
|
} ]
|
|
}
|
|
},
|
|
"configurations" : {
|
|
"CVE_data_version" : "4.0",
|
|
"nodes" : [ {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding" : "9.28"
|
|
} ]
|
|
} ]
|
|
},
|
|
"impact" : {
|
|
"baseMetricV3" : {
|
|
"cvssV3" : {
|
|
"version" : "3.0",
|
|
"vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"attackVector" : "LOCAL",
|
|
"attackComplexity" : "LOW",
|
|
"privilegesRequired" : "NONE",
|
|
"userInteraction" : "REQUIRED",
|
|
"scope" : "UNCHANGED",
|
|
"confidentialityImpact" : "HIGH",
|
|
"integrityImpact" : "HIGH",
|
|
"availabilityImpact" : "HIGH",
|
|
"baseScore" : 7.8,
|
|
"baseSeverity" : "HIGH"
|
|
},
|
|
"exploitabilityScore" : 1.8,
|
|
"impactScore" : 5.9
|
|
},
|
|
"baseMetricV2" : {
|
|
"cvssV2" : {
|
|
"version" : "2.0",
|
|
"vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"accessVector" : "NETWORK",
|
|
"accessComplexity" : "MEDIUM",
|
|
"authentication" : "NONE",
|
|
"confidentialityImpact" : "PARTIAL",
|
|
"integrityImpact" : "PARTIAL",
|
|
"availabilityImpact" : "PARTIAL",
|
|
"baseScore" : 6.8
|
|
},
|
|
"severity" : "MEDIUM",
|
|
"exploitabilityScore" : 8.6,
|
|
"impactScore" : 6.4,
|
|
"acInsufInfo" : false,
|
|
"obtainAllPrivilege" : false,
|
|
"obtainUserPrivilege" : false,
|
|
"obtainOtherPrivilege" : false,
|
|
"userInteractionRequired" : true
|
|
}
|
|
},
|
|
"publishedDate" : "2019-09-03T16:15Z",
|
|
"lastModifiedDate" : "2019-09-10T03:15Z"
|
|
}, {
|
|
"cve" : {
|
|
"data_type" : "CVE",
|
|
"data_format" : "MITRE",
|
|
"data_version" : "4.0",
|
|
"CVE_data_meta" : {
|
|
"ID" : "CVE-2019-17365",
|
|
"ASSIGNER" : "cve@mitre.org"
|
|
},
|
|
"problemtype" : {
|
|
"problemtype_data" : [ {
|
|
"description" : [ {
|
|
"lang" : "en",
|
|
"value" : "CWE-276"
|
|
} ]
|
|
} ]
|
|
},
|
|
"references" : {
|
|
"reference_data" : [ {
|
|
"url" : "http://www.openwall.com/lists/oss-security/2019/10/09/4",
|
|
"name" : "http://www.openwall.com/lists/oss-security/2019/10/09/4",
|
|
"refsource" : "MISC",
|
|
"tags" : [ "Exploit", "Mailing List", "Third Party Advisory" ]
|
|
}, {
|
|
"url" : "http://www.openwall.com/lists/oss-security/2019/10/10/1",
|
|
"name" : "[oss-security] 20191010 Re: CVE-2019-17365: Nix per-user profile directory hijack",
|
|
"refsource" : "MLIST",
|
|
"tags" : [ "Third Party Advisory" ]
|
|
} ]
|
|
},
|
|
"description" : {
|
|
"description_data" : [ {
|
|
"lang" : "en",
|
|
"value" : "Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable."
|
|
} ]
|
|
}
|
|
},
|
|
"configurations" : {
|
|
"CVE_data_version" : "4.0",
|
|
"nodes" : [ {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
|
|
"versionEndIncluding" : "2.3"
|
|
} ]
|
|
} ]
|
|
},
|
|
"impact" : {
|
|
"baseMetricV3" : {
|
|
"cvssV3" : {
|
|
"version" : "3.1",
|
|
"vectorString" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"attackVector" : "LOCAL",
|
|
"attackComplexity" : "LOW",
|
|
"privilegesRequired" : "LOW",
|
|
"userInteraction" : "NONE",
|
|
"scope" : "UNCHANGED",
|
|
"confidentialityImpact" : "HIGH",
|
|
"integrityImpact" : "HIGH",
|
|
"availabilityImpact" : "HIGH",
|
|
"baseScore" : 7.8,
|
|
"baseSeverity" : "HIGH"
|
|
},
|
|
"exploitabilityScore" : 1.8,
|
|
"impactScore" : 5.9
|
|
},
|
|
"baseMetricV2" : {
|
|
"cvssV2" : {
|
|
"version" : "2.0",
|
|
"vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P",
|
|
"accessVector" : "LOCAL",
|
|
"accessComplexity" : "LOW",
|
|
"authentication" : "NONE",
|
|
"confidentialityImpact" : "PARTIAL",
|
|
"integrityImpact" : "PARTIAL",
|
|
"availabilityImpact" : "PARTIAL",
|
|
"baseScore" : 4.6
|
|
},
|
|
"severity" : "MEDIUM",
|
|
"exploitabilityScore" : 3.9,
|
|
"impactScore" : 6.4,
|
|
"acInsufInfo" : false,
|
|
"obtainAllPrivilege" : false,
|
|
"obtainUserPrivilege" : false,
|
|
"obtainOtherPrivilege" : false,
|
|
"userInteractionRequired" : false
|
|
}
|
|
},
|
|
"publishedDate" : "2019-10-09T22:15Z",
|
|
"lastModifiedDate" : "2019-10-11T13:19Z"
|
|
}, {
|
|
"cve" : {
|
|
"data_type" : "CVE",
|
|
"data_format" : "MITRE",
|
|
"data_version" : "4.0",
|
|
"CVE_data_meta" : {
|
|
"ID" : "CVE-2019-1010180",
|
|
"ASSIGNER" : "cve@mitre.org"
|
|
},
|
|
"problemtype" : {
|
|
"problemtype_data" : [ {
|
|
"description" : [ {
|
|
"lang" : "en",
|
|
"value" : "CWE-119"
|
|
} ]
|
|
} ]
|
|
},
|
|
"references" : {
|
|
"reference_data" : [ {
|
|
"url" : "http://www.securityfocus.com/bid/109367",
|
|
"name" : "109367",
|
|
"refsource" : "BID",
|
|
"tags" : [ "Third Party Advisory", "VDB Entry" ]
|
|
}, {
|
|
"url" : "https://sourceware.org/bugzilla/show_bug.cgi?id=23657",
|
|
"name" : "https://sourceware.org/bugzilla/show_bug.cgi?id=23657",
|
|
"refsource" : "MISC",
|
|
"tags" : [ "Exploit", "Issue Tracking", "Third Party Advisory" ]
|
|
} ]
|
|
},
|
|
"description" : {
|
|
"description_data" : [ {
|
|
"lang" : "en",
|
|
"value" : "GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet."
|
|
} ]
|
|
}
|
|
},
|
|
"configurations" : {
|
|
"CVE_data_version" : "4.0",
|
|
"nodes" : [ {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:a:gnu:gdb:*:*:*:*:*:*:*:*"
|
|
} ]
|
|
} ]
|
|
},
|
|
"impact" : {
|
|
"baseMetricV3" : {
|
|
"cvssV3" : {
|
|
"version" : "3.0",
|
|
"vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"attackVector" : "LOCAL",
|
|
"attackComplexity" : "LOW",
|
|
"privilegesRequired" : "NONE",
|
|
"userInteraction" : "REQUIRED",
|
|
"scope" : "UNCHANGED",
|
|
"confidentialityImpact" : "HIGH",
|
|
"integrityImpact" : "HIGH",
|
|
"availabilityImpact" : "HIGH",
|
|
"baseScore" : 7.8,
|
|
"baseSeverity" : "HIGH"
|
|
},
|
|
"exploitabilityScore" : 1.8,
|
|
"impactScore" : 5.9
|
|
},
|
|
"baseMetricV2" : {
|
|
"cvssV2" : {
|
|
"version" : "2.0",
|
|
"vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"accessVector" : "NETWORK",
|
|
"accessComplexity" : "MEDIUM",
|
|
"authentication" : "NONE",
|
|
"confidentialityImpact" : "PARTIAL",
|
|
"integrityImpact" : "PARTIAL",
|
|
"availabilityImpact" : "PARTIAL",
|
|
"baseScore" : 6.8
|
|
},
|
|
"severity" : "MEDIUM",
|
|
"exploitabilityScore" : 8.6,
|
|
"impactScore" : 6.4,
|
|
"acInsufInfo" : false,
|
|
"obtainAllPrivilege" : false,
|
|
"obtainUserPrivilege" : false,
|
|
"obtainOtherPrivilege" : false,
|
|
"userInteractionRequired" : true
|
|
}
|
|
},
|
|
"publishedDate" : "2019-07-24T13:15Z",
|
|
"lastModifiedDate" : "2019-08-01T15:39Z"
|
|
}, {
|
|
"cve" : {
|
|
"data_type" : "CVE",
|
|
"data_format" : "MITRE",
|
|
"data_version" : "4.0",
|
|
"CVE_data_meta" : {
|
|
"ID" : "CVE-2019-1010204",
|
|
"ASSIGNER" : "cve@mitre.org"
|
|
},
|
|
"problemtype" : {
|
|
"problemtype_data" : [ {
|
|
"description" : [ {
|
|
"lang" : "en",
|
|
"value" : "CWE-125"
|
|
}, {
|
|
"lang" : "en",
|
|
"value" : "CWE-20"
|
|
} ]
|
|
} ]
|
|
},
|
|
"references" : {
|
|
"reference_data" : [ {
|
|
"url" : "https://security.netapp.com/advisory/ntap-20190822-0001/",
|
|
"name" : "https://security.netapp.com/advisory/ntap-20190822-0001/",
|
|
"refsource" : "CONFIRM",
|
|
"tags" : [ ]
|
|
}, {
|
|
"url" : "https://sourceware.org/bugzilla/show_bug.cgi?id=23765",
|
|
"name" : "https://sourceware.org/bugzilla/show_bug.cgi?id=23765",
|
|
"refsource" : "MISC",
|
|
"tags" : [ "Issue Tracking", "Third Party Advisory" ]
|
|
} ]
|
|
},
|
|
"description" : {
|
|
"description_data" : [ {
|
|
"lang" : "en",
|
|
"value" : "GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened."
|
|
} ]
|
|
}
|
|
},
|
|
"configurations" : {
|
|
"CVE_data_version" : "4.0",
|
|
"nodes" : [ {
|
|
"operator" : "OR",
|
|
"cpe_match" : [ {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding" : "2.21",
|
|
"versionEndIncluding" : "2.31.1"
|
|
}, {
|
|
"vulnerable" : true,
|
|
"cpe23Uri" : "cpe:2.3:a:gnu:binutils_gold:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding" : "1.11",
|
|
"versionEndIncluding" : "1.16"
|
|
} ]
|
|
} ]
|
|
},
|
|
"impact" : {
|
|
"baseMetricV3" : {
|
|
"cvssV3" : {
|
|
"version" : "3.0",
|
|
"vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
|
|
"attackVector" : "LOCAL",
|
|
"attackComplexity" : "LOW",
|
|
"privilegesRequired" : "NONE",
|
|
"userInteraction" : "REQUIRED",
|
|
"scope" : "UNCHANGED",
|
|
"confidentialityImpact" : "NONE",
|
|
"integrityImpact" : "NONE",
|
|
"availabilityImpact" : "HIGH",
|
|
"baseScore" : 5.5,
|
|
"baseSeverity" : "MEDIUM"
|
|
},
|
|
"exploitabilityScore" : 1.8,
|
|
"impactScore" : 3.6
|
|
},
|
|
"baseMetricV2" : {
|
|
"cvssV2" : {
|
|
"version" : "2.0",
|
|
"vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P",
|
|
"accessVector" : "NETWORK",
|
|
"accessComplexity" : "MEDIUM",
|
|
"authentication" : "NONE",
|
|
"confidentialityImpact" : "NONE",
|
|
"integrityImpact" : "NONE",
|
|
"availabilityImpact" : "PARTIAL",
|
|
"baseScore" : 4.3
|
|
},
|
|
"severity" : "MEDIUM",
|
|
"exploitabilityScore" : 8.6,
|
|
"impactScore" : 2.9,
|
|
"acInsufInfo" : false,
|
|
"obtainAllPrivilege" : false,
|
|
"obtainUserPrivilege" : false,
|
|
"obtainOtherPrivilege" : false,
|
|
"userInteractionRequired" : true
|
|
}
|
|
},
|
|
"publishedDate" : "2019-07-23T14:15Z",
|
|
"lastModifiedDate" : "2019-08-22T07:15Z"
|
|
}, {
|
|
"cve" : {
|
|
"data_type" : "CVE",
|
|
"data_format" : "MITRE",
|
|
"data_version" : "4.0",
|
|
"CVE_data_meta" : {
|
|
"ID" : "CVE-2019-18192",
|
|
"ASSIGNER" : "cve@mitre.org"
|
|
},
|
|
"problemtype" : {
|
|
"problemtype_data" : [ {
|
|
"description" : [ ]
|
|
} ]
|
|
},
|
|
"references" : {
|
|
"reference_data" : [ {
|
|
"url" : "http://www.openwall.com/lists/oss-security/2019/10/17/3",
|
|
"name" : "[oss-security] 20191017 CVE-2019-18192: Insecure permissions on Guix profile directory",
|
|
"refsource" : "MLIST",
|
|
"tags" : [ ]
|
|
}, {
|
|
"url" : "https://issues.guix.gnu.org/issue/37744",
|
|
"name" : "https://issues.guix.gnu.org/issue/37744",
|
|
"refsource" : "MISC",
|
|
"tags" : [ ]
|
|
} ]
|
|
},
|
|
"description" : {
|
|
"description_data" : [ {
|
|
"lang" : "en",
|
|
"value" : "GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365."
|
|
} ]
|
|
}
|
|
},
|
|
"configurations" : {
|
|
"CVE_data_version" : "4.0",
|
|
"nodes" : [ ]
|
|
},
|
|
"impact" : { },
|
|
"publishedDate" : "2019-10-17T20:15Z",
|
|
"lastModifiedDate" : "2019-10-17T20:29Z"
|
|
} ]
|
|
}
|