Platinum Upnp SDK through 1.2.0 has a directory traversal vulnerability. The attack could remote attack victim by sending http://ip:port/../privacy.avi URL to compromise a victim's privacy.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Platinum Upnp SDK through 1.2.0 has a directory traversal vulnerability. The attack could remote attack     victim by sending http://ip:port/../privacy.avi URL to compromise a victim's privacy. (CVE-2020-19858)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7266-1 advisory.

    Zinuo Han and Ao Wang discovered that the Android DNG SDK, vendored in digiKam, did not correctly parse     certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only     affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2017-0691)

    It was discovered that Platinum Upnp SDK, vendored in digiKam, was vulnerable to a path traversal attack.
    An attacker could possibly use this issue to leak sensitive information. This issue only affected

    Ubuntu 20.04 LTS. (CVE-2020-19858)

    It was discovered that LibRaw, vendored in digiKam, did not correctly handle certain memory operations. If     a user or automated system were tricked into opening a specially crafted file, an attacker could possibly     use this issue to leak sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-22628)

    It was discovered that LibRaw, vendored in digiKam, did not correctly handle certain memory operations. If     a user or automated system were tricked into opening a specially crafted file, an attacker could possibly     use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu     18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-35530, CVE-2020-35531, CVE-2020-35532, CVE-2020-35533)

    It was discovered that LibRaw, vendored in digiKam, did not correctly handle certain memory operations. If     a user or automated system were tricked into opening a specially crafted file, an attacker could possibly     use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu     20.04 LTS. (CVE-2021-32142)

    It was discovered that LibRaw, vendored in digiKam, did not correctly handle certain memory operations. If     a user or automated system were tricked into opening a specially crafted file, an attacker could possibly     use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu     18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-1729)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
262604	Linux Distros Unpatched Vulnerability : CVE-2020-19858	Nessus	Misc.	high
216235	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : digiKam vulnerabilities (USN-7266-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2020-19858

high

Tenable Plugins

high

high