CVE 2020 document archive · 26
Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →
1,491 documents · Identifier year 2020 · 26 / 30
- CVE-2020-7608nodejs-yargs-parser: prototype pollution vulnerability
- CVE-2020-7598nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload
- CVE-2020-7595libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations
- CVE-2020-7221mariadb: mysql_install_db allows privilege escalation due to unsafe chown and chmod operations
- CVE-2020-7212python-urllib3: inefficient algorithm allows a DoS (CPU consumption) in _encode_invalid_chars function in util/url.py
- CVE-2020-7211QEMU: Slirp: potential directory traversal using relative paths via tftp server on Windows host
- CVE-2020-7071php: FILTER_VALIDATE_URL accepts URLs with invalid userinfo
- CVE-2020-7070php: URL decoding of cookie names can lead to different interpretation of cookies between browser and server
- CVE-2020-7069php: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV
- CVE-2020-7068php: Use of freed hash key in the phar_parse_zipfile function
- CVE-2020-7067php: out-of-bounds read when using a malformed url-encoded string
- CVE-2020-7066php: Information disclosure in function get_headers
- CVE-2020-7065php: Using mb_strtolower() function with UTF-32LE encoding leads to potential code execution
- CVE-2020-7064php: Information disclosure in exif_read_data() function
- CVE-2020-7063php: Files added to tar with Phar::buildFromIterator have all-access permissions
- CVE-2020-7062php: NULL pointer dereference in PHP session upload progress
- CVE-2020-7061php: heap-based buffer overflow in phar_extract_file
- CVE-2020-7060php: Global buffer-overflow in mbfl_filt_conv_big5_wchar function
- CVE-2020-7059php: Out of bounds read in php_strip_tags_ex
- CVE-2020-7053kernel: use-after-free in i915_ppgtt_close in drivers/gpu/drm/i915/i915_gem_gtt.c
- CVE-2020-7046dovecot: Attacker can cause submission-login and lmtp processes to be exhausted leading to DoS
- CVE-2020-7045wireshark: invalid memory access in BT ATT dissector
- CVE-2020-7044wireshark: WASSP dissector crash (wnpa-sec-2020-01)
- CVE-2020-7039QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu()
- CVE-2020-6923hplip: potential memory buffer overflow
- CVE-2020-6851openjpeg: Heap-based buffer overflow in opj_t1_clbl_decode_processor()
- CVE-2020-6831usrsctp: Buffer overflow in AUTH chunk input validation
- CVE-2020-6829nss: Side channel attack on ECDSA signature generation
- CVE-2020-6828Mozilla: Preference overwrite via crafted Intent from malicious Android application
- CVE-2020-6827Mozilla: Custom Tabs in Firefox for Android could have the URI spoofed
- CVE-2020-6826Mozilla: Memory safety bugs fixed in Firefox 75
- CVE-2020-6825Mozilla: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7
- CVE-2020-6824Mozilla: Generated passwords may be identical on the same site between separate private browsing sessions
- CVE-2020-6823Mozilla: Malicious Extension could obtain auth codes from OAuth login flows
- CVE-2020-6822Mozilla: Out of bounds write in GMPDecodeData when processing large images
- CVE-2020-6821Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method
- CVE-2020-6820Mozilla: Use-after-free when handling a ReadableStream
- CVE-2020-6819Mozilla: Use-after-free while running the nsDocShell destructor
- CVE-2020-6815Mozilla: Memory and script safety bugs fixed in Firefox 74
- CVE-2020-6814Mozilla: Memory safety bugs fixed in Firefox 74 and Firefox ESR 68.6
- CVE-2020-6813Mozilla: @import statements in CSS could bypass the Content Security Policy nonce feature
- CVE-2020-6812Mozilla: The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission
- CVE-2020-6811Mozilla: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection
- CVE-2020-6810Mozilla: Focusing a popup while in fullscreen could have obscured the fullscreen notification
- CVE-2020-6809Mozilla: Web Extensions with the all-urls permission could access local files
- CVE-2020-6808Mozilla: URL Spoofing via javascript: URL
- CVE-2020-6807Mozilla: Use-after-free in cubeb during stream destruction
- CVE-2020-6806Mozilla: BodyStream:: OnInputStreamReady was missing protections against state confusion
- CVE-2020-6805Mozilla: Use-after-free when removing data about origins
- CVE-2020-6801Mozilla: Memory safety bugs fixed in Firefox 73