Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,250

Export CSV
CVE-2014-4699

kernel: x86_64: ptrace: sysret to non-canonical address

The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.

CVSS 2.0 · 6.9 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 4 more
CVE-2014-4877

wget: FTP symlink arbitrary filesystem access

Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.

CVSS 2.0 · 9.3 Critical EPSS 39.9% KEV · Not listed
Vendors
Gnu Redhat
Products
Wget Enterprise Linux Rhel Eus
CVE-2014-4943

kernel: net: pppol2tp: level handling in pppol2tp_[s,g]etsockopt()

The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.

CVSS 2.0 · 6.9 Medium EPSS 2.1% KEV · Not listed
Vendors
Debian Linux Opensuse and 2 more
Products
Debian Linux Linux Kernel Opensuse and 6 more
CVE-2014-5045

kernel: vfs: refcount issues during unmount on symlink

The mountpoint_last function in fs/namei.c in the Linux kernel before 3.15.8 does not properly maintain a certain reference count during attempts to use the umount system call in conjunction with a symlink, which allows local users to cause a denial of service (memory consumption or use-after-free) or possibly have unspecified other impact via the umount program.

CVSS 2.0 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Linux Eus and 3 more
CVE-2014-5077

Kernel: net: SCTP: fix a NULL pointer dereference during INIT collisions

The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.

CVSS 2.0 · 7.1 High EPSS 5.8% KEV · Not listed
Vendors
Canonical Linux Redhat and 1 more
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 9 more
CVE-2014-5119

glibc: off-by-one error leading to a heap-based buffer overflow flaw in __gconv_translit_find()

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.

CVSS 2.0 · 7.5 High EPSS 17.0% KEV · Not listed
Vendors
Debian Gnu Redhat
Products
Debian Linux Glibc Enterprise Linux and 2 more
CVE-2014-5471

kernel: isofs: unbound recursion when processing relocated directories

Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry.

CVSS 2.0 · 4.0 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 3 more
CVE-2014-5472

kernel: isofs: unbound recursion when processing relocated directories

The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry.

CVSS 2.0 · 4.0 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 3 more
CVE-2014-6051

libvncserver: integer overflow flaw, leading to a heap-based buffer overflow in screen size handling

Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.

CVSS 2.0 · 7.5 High EPSS 8.3% KEV · Not listed
Vendors
Debian Fedoraproject Libvncserver and 2 more
Products
Debian Linux Fedora Libvncserver and 5 more
CVE-2014-6055

libvncserver: server stacked-based buffer overflow flaws in file transfer handling

Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3) FileTime attribute in a rfbFileTransferOffer message.

CVSS 2.0 · 6.5 Medium EPSS 7.8% KEV · Not listed
Vendors
Debian Fedoraproject Libvncserver and 1 more
Products
Debian Linux Fedora Libvncserver and 4 more
CVE-2014-7186

bash: parser can allow out-of-bounds memory access while handling redir_stack

The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.

CVSS 2.0 · 10.0 Critical EPSS 64.3% KEV · Not listed
Vendors
Gnu Redhat
Products
Bash Enterprise Linux Rhel Els and 4 more
CVE-2014-7187

bash: off-by-one error in deeply nested flow control constructs

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

CVSS 2.0 · 10.0 Critical EPSS 58.5% KEV · Not listed
Vendors
Gnu Redhat
Products
Bash Enterprise Linux Rhel Els and 4 more
CVE-2014-7841

kernel: net: sctp: NULL pointer dereference in af->from_addr_param on malformed packet

The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel before 3.17.4, when ASCONF is used, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk.

CVSS 2.0 · 5.0 Medium EPSS 5.2% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Eus and 1 more
CVE-2014-8159

kernel: infiniband: uverbs: unprotected physical memory access

The InfiniBand (IB) implementation in the Linux kernel package before 2.6.32-504.12.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly restrict use of User Verbs for registration of memory regions, which allows local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 6 more
CVE-2014-8160

kernel: iptables restriction bypass if a protocol handler kernel module not loaded

net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disallowed port numbers.

CVSS 2.0 · 5.0 Medium EPSS 5.5% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 14 more
CVE-2014-8884

kernel: usb: buffer overflow in ttusb-dec

Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call.

CVSS 2.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Eus
CVE-2014-9293

ntp: automatic generation of weak default key in config_auth()

The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.

CVSS 2.0 · 7.5 High EPSS 13.0% KEV · Not listed
Vendors
Ntp Redhat
Products
Ntp Enterprise Linux Rhel Eus
CVE-2014-9294

ntp: ntp-keygen uses weak random number generator and seed when generating MD5 keys

util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.

CVSS 2.0 · 7.5 High EPSS 13.0% KEV · Not listed
Vendors
Ntp Redhat
Products
Ntp Enterprise Linux Rhel Eus
CVE-2014-9295

ntp: Multiple buffer overflows via specially-crafted packets

Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.

CVSS 2.0 · 7.5 High EPSS 79.1% KEV · Not listed
Vendors
Ntp Redhat
Products
Ntp Enterprise Linux Rhel Eus
CVE-2014-9296

ntp: receive() missing return on error

The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets.

CVSS 2.0 · 5.0 Medium EPSS 16.2% KEV · Not listed
Vendors
Ntp Redhat
Products
Ntp Enterprise Linux Rhel Eus