CVE-2011-2901

kernel: xen: off-by-one shift in x86_64 __addr_ok()

Off-by-one error in the __addr_ok macro in Xen 3.3 and earlier allows local 64 bit PV guest administrators to cause a denial of service (host crash) via unspecified hypercalls that ignore virtual-address bits.

CVSS 2.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Xen

Products

Enterprise Linux Rhel Eus Xen

CVE-2011-3188

kernel: net: improve sequence number generation

The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service (disrupted networking) or hijack network sessions by predicting these values and sending crafted packets.

CVSS 3.1 · 9.1 Critical EPSS 5.0% KEV · Not listed

Vendors

F5 Linux Redhat

Products

Arx Big-ip Access Policy Manager Big-ip Analytics and 14 more

CVE-2013-1797

kernel: kvm: after free issue with the handling of MSR_KVM_SYSTEM_TIME

Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation.

CVSS 2.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2013-1798

kernel: kvm: out-of-bounds access in ioapic indirect register reads

The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application.

CVSS 2.0 · 6.2 Medium EPSS 1.4% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2013-1848

kernel: ext3: format string issues

fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application.

CVSS 2.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 2 more

CVE-2013-2224

kernel: net: IP_REPOPTS invalid free

A certain Red Hat patch for the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 allows local users to cause a denial of service (invalid free operation and system crash) or possibly gain privileges via a sendmsg system call with the IP_RETOPTS option, as demonstrated by hemlock.c. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-3552.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openstack Rhel Eus

CVE-2013-2851

kernel: block: passing disk names as format strings

Format string vulnerability in the register_disk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/md_mod/parameters/new_array in order to create a crafted /dev/md device name.

CVSS 2.0 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2013-2852

kernel: b43: format string leaking into error msgs

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message.

CVSS 2.0 · 6.9 Medium EPSS 1.0% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 4 more

CVE-2013-4113

php: xml_parse_into_struct buffer overflow when parsing deeply nested XML

ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function.

CVSS 2.0 · 6.8 Medium EPSS 5.2% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Rhel Els and 2 more

CVE-2013-4164

ruby: heap overflow in floating point parsing

Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.

CVSS 2.0 · 6.8 Medium EPSS 35.0% KEV · Not listed

Vendors

Redhat Ruby-lang

Products

Cloudforms Managementengine Enterprise Linux Openstack and 3 more

CVE-2013-4299

kernel: dm: dm-snapshot data leak

Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device.

CVSS 2.0 · 6.0 Medium EPSS 3.8% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 2 more

CVE-2013-4387

Kernel: net: IPv6: panic when UFO=On for an interface

net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via network traffic that triggers a large response packet.

CVSS 2.0 · 6.1 Medium EPSS 2.6% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2013-4470

Kernel: net: memory corruption with UDP_CORK and UFO

The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2013-4483

kernel: ipc: ipc_rcu_putref refcount races

The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count, which allows local users to cause a denial of service (memory consumption or system crash) via a crafted application.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2013-4591

kernel: nfs: missing check for buffer length in __nfs4_get_acl_uncached

Buffer overflow in the __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a getxattr system call for the system.nfs4_acl extended attribute of a pathname on an NFSv4 filesystem.

CVSS 2.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus

CVE-2013-5605

nss: Null_Cipher() does not respect maxOutputLen (MFSA 2013-103)

Mozilla Network Security Services (NSS) 3.14 before 3.14.5 and 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets.

CVSS 2.0 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Mozilla Redhat

Products

Network Security Services Enterprise Linux Rhel Eus and 1 more

CVE-2013-6367

kvm: division by zero in apic_get_tmcct()

The apic_get_tmcct function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via crafted modifications of the TMICT value.

CVSS 2.0 · 5.7 Medium EPSS 1.4% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2013-6368

kvm: cross page vapic_addr access

The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address.

CVSS 2.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2013-6381

Kernel: qeth: buffer overflow in snmp ioctl

Buffer overflow in the qeth_snmp_command function in drivers/s390/net/qeth_core_main.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service or possibly have unspecified other impact via an SNMP ioctl call with a length value that is incompatible with the command-buffer size.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus

CVE-2013-6383

Kernel: AACRAID Driver compat IOCTL missing capability check

The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more