Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,219

Export CSV
CVE-2018-10767

libgxps: Stack-based buffer overflow in calling glib in gxps_images_guess_content_type of gcontenttype.c

There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from a g_input_stream_read call. A crafted input will lead to a remote denial of service attack.

CVSS 3.0 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Gnome Redhat
Products
Libgxps Ansible Tower Enterprise Linux and 3 more
CVE-2018-10733

libgxps: heap based buffer over read in ft_font_face_hash function of gxps-fonts.c

There is a heap-based buffer over-read in the function ft_font_face_hash of gxps-fonts.c in libgxps through 0.3.0. A crafted input will lead to a remote denial of service attack.

CVSS 3.0 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Gnome Opensuse Redhat
Products
Libgxps Leap Ansible Tower and 4 more
CVE-2018-10675

kernel: mm: use-after-free in do_get_mempolicy function allows local DoS or other unspecified impact

The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 13 more
CVE-2018-10583

libreoffice: Information disclosure via SMB connection embedded in malicious file

An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document.

CVSS 3.0 · 7.5 High EPSS 79.5% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Openoffice Ubuntu Linux Debian Linux and 5 more
CVE-2018-10535

binutils: NULL pointer dereference in elf.c

The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab entry with a "SECTION" type that has a "0" value, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy.

CVSS 3.0 · 5.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Gnu Redhat
Products
Binutils Enterprise Linux Enterprise Linux Desktop and 2 more
CVE-2018-10534

binutils: out of bounds memory write in peXXigen.c files

The _bfd_XX_bfd_copy_private_bfd_data_common function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, processes a negative Data Directory size with an unbounded loop that increases the value of (external_IMAGE_DEBUG_DIRECTORY) *edd so that the address exceeds its own memory region, resulting in an out-of-bounds memory write, as demonstrated by objcopy copying private info with _bfd_pex64_bfd_copy_private_bfd_data_common in pex64igen.c.

CVSS 3.0 · 5.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Gnu Redhat
Products
Binutils Enterprise Linux Enterprise Linux Desktop and 2 more
CVE-2018-10392

libvorbis: heap buffer overflow in mapping0_forward function

mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.

CVSS 3.1 · 8.8 High EPSS 3.2% KEV · Not listed
Vendors
Debian Redhat Xiph.org
Products
Debian Linux Enterprise Linux Enterprise Linux Eus and 3 more
CVE-2018-10373

binutils: NULL pointer dereference in dwarf2.c:concat_filename() allows for denial of service via crafted file

concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by nm-new.

CVSS 3.0 · 6.5 Medium EPSS 3.3% KEV · Not listed
Vendors
Gnu Redhat
Products
Binutils Enterprise Linux Enterprise Linux Desktop and 2 more
CVE-2018-10372

binutils: Heap-base buffer over-read in dwarf.c:process_cu_tu_index() allows for denial of service via crafted file

process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf.

CVSS 3.0 · 5.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Gnu Redhat
Products
Binutils Enterprise Linux Enterprise Linux Desktop and 2 more
CVE-2018-10322

kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when mounting crafted xfs image allowing denial of service

The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_ilock_attr_map_shared invalid pointer dereference) via a crafted xfs image.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Linux Desktop and 4 more
CVE-2018-10194

ghostscript: Stack-based out-of-bounds write in pdf_set_text_matrix function in gdevpdts.c

The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Artifex Canonical Debian and 1 more
Products
Ghostscript Ubuntu Linux Debian Linux and 7 more
CVE-2018-10120

libreoffice: Out of bounds write in filter/ww8/ww8toolbar.cxx:SwCTBWrapper class allows for denial of service with crafted document

The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Libreoffice and 1 more
Products
Ubuntu Linux Debian Linux Libreoffice and 4 more
CVE-2018-10119

libreoffice: Use-after-free in sdstor/stgstrms.cxx:StgSmallStrm class allows for denial of service with crafted document

sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format.

CVSS 3.0 · 7.8 High EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Libreoffice and 1 more
Products
Ubuntu Linux Debian Linux Libreoffice and 4 more
CVE-2018-1000878

libarchive: Use after free in RAR decoder resulting in a denial of service

libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c that can result in Crash/DoS - it is unknown if RCE is possible. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.

CVSS 3.1 · 8.8 High EPSS 4.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 6 more
CVE-2018-1000877

libarchive: Double free in RAR decoder resulting in a denial of service

libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar->lzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.

CVSS 3.1 · 8.8 High EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2018-1000876

binutils: integer overflow leads to heap-based buffer overflow in objdump

binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Gnu Redhat
Products
Ubuntu Linux Binutils Ansible Tower and 4 more
CVE-2018-1000808

pyOpenSSL: Failure to release memory before removing last reference in PKCS #12 Store

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.

CVSS 3.0 · 5.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Pyopenssl Project Redhat
Products
Ubuntu Linux Pyopenssl Enterprise Linux Desktop and 4 more
CVE-2018-1000807

pyOpenSSL: Use-after-free in X509 object handling

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.

CVSS 3.1 · 8.1 High EPSS 4.1% KEV · Not listed
Vendors
Canonical Pyopenssl Redhat
Products
Ubuntu Linux Pyopenssl Enterprise Linux Desktop and 3 more
CVE-2018-1000805

python-paramiko: Authentication bypass in auth_handler.py

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.

CVSS 3.1 · 8.8 High EPSS 4.4% KEV · Not listed
Vendors
Canonical Debian Paramiko and 1 more
Products
Ubuntu Linux Debian Linux Paramiko and 12 more