CVE-2019-15287
published 2020-09-23CVE-2019-15287: Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to…
PriorityP344high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.71%
74.8th percentile
Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_webex_wrf_player | — | — |
| cisco | webex_meetings | >= 39.5.0 < 39.5.12 | 39.5.12 |
| cisco | webex_meetings_online | < 1.3.44 | 1.3.44 |
| cisco | webex_meetings_online | — | — |
| cisco | webex_meetings_online | — | — |
| cisco | webex_meetings_online | — | — |
| cisco | webex_meetings_online | — | — |
| cisco | webex_meetings_online | — | — |
| cisco | webex_meetings_server | — | — |
| cisco | webex_meetings_server | — | — |
| cisco | webex_network_recording_player_and_cisco_webex_player | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_cisco7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cmw7-gvx2-669j: Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an att
ghsa_unreviewed·2022-05-24
CVE-2019-15287 [HIGH] GHSA-cmw7-gvx2-669j: Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an att
Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
Cisco
Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
vendor_cisco·2019-11-06·CVSS 7.8
CVE-2019-15283 [HIGH] CWE-119 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system.
The vulnerabilities exist due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affect
Cisco
Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
vendor_cisco·CVSS 3.0
CVE-2019-15287 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
CVE-2019-15287: Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary cod
No detection rules found.
No public exploits indexed.
Fortinet
Fortinet Security Researchers Discover Multiple Vulnerabilities in Adobe and Cisco Products
blogs_fortinet·2019-11-15·CVSS 9.8
[CRITICAL] Fortinet Security Researchers Discover Multiple Vulnerabilities in Adobe and Cisco Products
FORTIGUARD LABS THREAT RESEARCH
Fortinet Security Researchers Discover Multiple Vulnerabilities in Adobe and Cisco Products
By Peixue Li | November 15, 2019
This past Patch Tuesday, November 12th, Adobe announced a number of Security Updates for Adobe Illustrator CC. They included two critical vulnerabilities that were originally discovered by Fortinet Threat Researcher Kushal Arvind Shah.
The week before, on Wednesday, November 6th, a number of Security Updates were also released by Cisco Systems. They included five high risk vulnerabilities for their Cisco Webex Network Recording Player and Webex Player tools. These vulnerabilities were also discovered by Kushal Arvind Shah as well as Fortinet security researcher Yici Zhang.
All of these vulnerabilities have now been patched. More in
Bugzilla
CVE-2019-15939 opencv: division by zero in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hog.cpp
bugzilla·2019-10-23·CVSS 5.9
CVE-2019-15939 [MEDIUM] CVE-2019-15939 opencv: division by zero in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hog.cpp
CVE-2019-15939 opencv: division by zero in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hog.cpp
An issue was discovered in OpenCV 4.1.0. There is a divide-by-zero error in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hog.cpp.
References:
https://github.com/OpenCV/opencv/issues/15287
https://github.com/opencv/opencv/pull/15382
Discussion:
Created opencv tracking bugs for this issue:
Affects: fedora-all [bug 1764732]
---
Upstream fix:
https://github.com/opencv/opencv/pull/15382/commits/5a497077f109d543ab86dfdf8add1c76c0e47d29
---
This flaw affects the implementation of Histogram of Oriented Gradients (HOG) Descriptor, an algorithm used internally by OpenCV to detect objects in digital images.
More specifically, method HOGDescriptor::getDescriptorSi
2020-09-23
Published