CVE-2019-15900

CRITICAL Year: 2019
CVSS v3 Score
9.8
Critical
CVSS v2 Score
10.0
Critical
Weakness Type
CWE-252
View all →

Vulnerability Description

An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The result was that, instead of reporting that the supplied username or group name did not exist, it would execute the command as root.

Related Vulnerabilities

CVE-1999-0199

CRITICAL
CVSS:9.8(Critical)

manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dang...

CWE-2521999

CVE-2007-3798

CRITICAL
CVSS:9.8(Critical)

Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return val...

CWE-2522007

CVE-2010-0211

CRITICAL
CVSS:9.8(Critical)

The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmen...

CWE-2522010

CVE-2020-6152

CRITICAL
CVSS:9.8(Critical)

A code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7. A specially crafted malformed file can cause an out-of-bounds write. An attacker can ...

CWE-2522020

CVE-2021-26955

CRITICAL
CVSS:9.8(Critical)

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated by...

CWE-2522021

CVE-2021-38171

CRITICAL
CVSS:9.8(Critical)

adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step because the second argument to init_get_bits can be crafted.

CWE-2522021