CVE-2019-3967
published 2019-08-20CVE-2019-3967: In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary…
PriorityP350medium6.5CVSS 3.0
AVNACLPRLUINSUCHINAN
EPSS
30.25%
98.0th percentile
In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ffmpeg | ffmpeg | >= 0 < 7:2.8.17-0ubuntu0.1 | 7:2.8.17-0ubuntu0.1 |
| ffmpeg | ffmpeg | >= 0 < 7:3.4.8-0ubuntu0.2 | 7:3.4.8-0ubuntu0.2 |
| ffmpeg | ffmpeg | >= 0 < 7:4.2.4-1ubuntu0.1 | 7:4.2.4-1ubuntu0.1 |
| open-emr | openemr | <= 5.0.1 | — |
| open-emr | openemr | — | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-27wf-58x2-9c98: In OpenEMR 5
ghsa_unreviewed·2022-05-24
CVE-2019-3967 [MEDIUM] CWE-22 GHSA-27wf-58x2-9c98: In OpenEMR 5
In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system.
OSV
ffmpeg vulnerabilities
osv·2020-07-22·CVSS 7.5
CVE-2018-15822 ffmpeg vulnerabilities
ffmpeg vulnerabilities
It was discovered that FFmpeg incorrectly verified empty audio packets or
HEVC data. An attacker could possibly use this issue to cause a denial of
service via a crafted file. This issue only affected Ubuntu 16.04 LTS, as
it was already fixed in Ubuntu 18.04 LTS. For more information see:
https://usn.ubuntu.com/usn/usn-3967-1
(CVE-2018-15822, CVE-2019-11338)
It was discovered that FFmpeg incorrectly handled sscanf failures. An
attacker could possibly use this issue to cause a denial of service or
other unspecified impact. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2019-12730)
It was discovered that FFmpeg incorrectly handled certain WEBM files. An
attacker could possibly use this issue to obtain sensitive data or other
unspecified impact.
No detection rules found.
No public exploits indexed.
2019-08-20
Published