CVE-2020-4483
published 2020-11-06CVE-2020-4483: IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error…
PriorityP417medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.98%
58.1th percentile
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 181857.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | urbancode_deploy | — | — |
| ibm | urbancode_deploy | — | — |
| ibm | urbancode_deploy | — | — |
| ibm | urbancode_deploy | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv3.04.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-19481 opensc: Improper handling of buffer limits for CAC certificates
bugzilla·2019-12-12·CVSS 4.6
CVE-2019-19481 [MEDIUM] CVE-2019-19481 opensc: Improper handling of buffer limits for CAC certificates
CVE-2019-19481 opensc: Improper handling of buffer limits for CAC certificates
An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-cac1.c mishandles buffer limits for CAC certificates.
Reference:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18618
Upstream commit:
https://github.com/OpenSC/OpenSC/commit/b75c002cfb1fd61cd20ec938ff4937d7b1a94278
Discussion:
Created opensc tracking bugs for this issue:
Affects: epel-6 [bug 1782957]
Affects: fedora-all [bug 1782956]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2020:4483 https://access.redhat.com/errata/RHSA-2020:4483
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://
Bugzilla
CVE-2019-19479 opensc: Incorrect read operation during parsing of a SETCOS file attribute
bugzilla·2019-12-11·CVSS 5.5
CVE-2019-19479 [MEDIUM] CVE-2019-19479 opensc: Incorrect read operation during parsing of a SETCOS file attribute
CVE-2019-19479 opensc: Incorrect read operation during parsing of a SETCOS file attribute
An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SETCOS file attribute.
Reference:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18693
Upstream commit:
https://github.com/OpenSC/OpenSC/commit/c3f23b836e5a1766c36617fe1da30d22f7b63de2
Discussion:
Created opensc tracking bugs for this issue:
Affects: epel-6 [bug 1782521]
Affects: fedora-all [bug 1782520]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2020:4483 https://access.redhat.com/errata/RHSA-2020:4483
---
This bug is now closed. Further updates for individual products will b
Bugzilla
CVE-2019-15945 opensc: Out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c
bugzilla·2019-10-24·CVSS 6.4
CVE-2019-15945 [MEDIUM] CVE-2019-15945 opensc: Out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c
CVE-2019-15945 opensc: Out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c
OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.
Upstream commit:
https://github.com/OpenSC/OpenSC/commit/412a6142c27a5973c61ba540e33cdc22d5608e68
Discussion:
Created opensc tracking bugs for this issue:
Affects: epel-6 [bug 1765224]
Affects: fedora-all [bug 1765223]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2020:4483 https://access.redhat.com/errata/RHSA-2020:4483
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2019-15945
Bugzilla
CVE-2019-15946 opensc: Out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c
bugzilla·2019-10-24·CVSS 6.4
CVE-2019-15946 [MEDIUM] CVE-2019-15946 opensc: Out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c
CVE-2019-15946 opensc: Out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c
OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.
Upstream commit:
https://github.com/OpenSC/OpenSC/commit/a3fc7693f3a035a8a7921cffb98432944bb42740
Discussion:
Created opensc tracking bugs for this issue:
Affects: epel-6 [bug 1765232]
Affects: fedora-all [bug 1765231]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2020:4483 https://access.redhat.com/errata/RHSA-2020:4483
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2019-15946
2020-11-06
Published