Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 626

Export CSV
CVE-2017-9788

httpd: Uninitialized memory reflection in mod_auth_digest

In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.

CVSS 3.0 · 9.1 Critical EPSS 56.8% KEV · Not listed
Vendors
Apache Apple Debian and 3 more
Products
Http Server Mac Os X Debian Linux and 15 more
CVE-2017-3302

mysql: prepared statement handle use-after-free after disconnect

Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.

CVSS 3.0 · 7.5 High EPSS 4.9% KEV · Not listed
Vendors
Debian Mariadb Oracle and 1 more
Products
Debian Linux Mariadb Mysql and 7 more
CVE-2017-7980

Qemu: display: cirrus: OOB r/w access issues in bitblt routines

Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 9 more
CVE-2017-9461

samba: fd_open_atomic infinite loop due to wrong handling of dangling symlinks

smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.

CVSS 3.0 · 6.5 Medium EPSS 4.2% KEV · Not listed
Vendors
Debian Redhat Samba
Products
Debian Linux Enterprise Linux Enterprise Linux Desktop and 7 more
CVE-2017-3636

mysql: Client programs unspecified vulnerability (CPU Jul 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.56 and earlier and 5.6.36 and earlier. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Mariadb Oracle and 1 more
Products
Debian Linux Mariadb Mysql and 9 more
CVE-2017-17405

ruby: Command injection vulnerability in Net::FTP

Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.

CVSS 3.0 · 8.8 High EPSS 73.8% KEV · Not listed
Vendors
Debian Redhat Ruby-lang
Products
Debian Linux Enterprise Linux Enterprise Linux Desktop and 10 more
CVE-2017-3464

mysql: Server: DDL unspecified vulnerability (CPU Apr 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).

CVSS 3.1 · 4.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Debian Mariadb Oracle and 1 more
Products
Debian Linux Mariadb Mysql and 8 more
CVE-2017-9462

mercurial: Python debugger accessible to authorized users

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

CVSS 3.1 · 8.8 High EPSS 21.7% KEV · Not listed
Vendors
Debian Mercurial Redhat
Products
Debian Linux Mercurial Enterprise Linux and 6 more
CVE-2017-1000410

kernel: Stack information leak in the EFS element

The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state. By manipulating the code flows that precede the handling of these configuration messages, an attacker can also gain some control over which data will be held in the uninitialized stack variables. This can allow him to bypass KASLR, and stack canaries protection - as both pointers and stack canaries may be leaked in this manner. Combining this vulnerability (for example) with the previously disclosed RCE vulnerability in L2CAP configuration parsing (CVE-2017-1000251) may allow an attacker to exploit the RCE against kernels which were built with the above mitigations. These are the specifics of this vulnerability: In the function l2cap_parse_conf_rsp and in the function l2cap_parse_conf_req the following variable is declared without initialization: struct l2cap_conf_efs efs; In addition, when parsing input configuration parameters in both of these functions, the switch case for handling EFS elements may skip the memcpy call that will write to the efs variable: ... case L2CAP_CONF_EFS: if (olen == sizeof(efs)) memcpy(&efs, (void *)val, olen); ... The olen in the above if is attacker controlled, and regardless of that if, in both of these functions the efs variable would eventually be added to the outgoing configuration request that is being built: l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), (unsigned long) &efs); So by sending a configuration request, or response, that contains an L2CAP_CONF_EFS element, but with an element length that is not sizeof(efs) - the memcpy to the uninitialized efs variable can be avoided, and the uninitialized variable would be returned to the attacker (16 bytes).

CVSS 3.0 · 7.5 High EPSS 4.3% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 10 more
CVE-2017-10661

kernel: Handling of might_cancel queueing is not properly pretected against race

Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing.

CVSS 3.1 · 7.0 High EPSS 13.5% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 9 more
CVE-2017-1000407

Kernel: KVM: DoS via write flood to I/O port 0x80

The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel panic.

CVSS 3.0 · 7.4 High EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 10 more
CVE-2017-1000251

kernel: stack buffer overflow in the native Bluetooth stack

The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.

CVSS 3.1 · 8.0 High EPSS 16.2% KEV · Not listed
Vendors
Debian Linux Nvidia and 1 more
Products
Debian Linux Linux Kernel Jetson Tk1 and 14 more
CVE-2017-6011

icoutils: Buffer overflow in the simple_vec function

An issue was discovered in icoutils 0.31.1. An out-of-bounds read leading to a buffer overflow was observed in the "simple_vec" function in the "extract.c" source file. This affects icotool.

CVSS 3.0 · 5.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Icoutils Project Redhat
Products
Debian Linux Icoutils Enterprise Linux and 6 more
CVE-2017-1000366

glibc: heap/stack gap jumping via unbounded stack allocations

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.

CVSS 3.0 · 7.8 High EPSS 2.7% KEV · Not listed
Vendors
Debian Gnu Mcafee and 5 more
Products
Debian Linux Glibc Web Gateway and 23 more
CVE-2017-10978

freeradius: Out-of-bounds read/write due to improper output buffer size check in make_secret()

An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of service.

CVSS 3.0 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Debian Freeradius Redhat
Products
Debian Linux Freeradius Enterprise Linux and 6 more
CVE-2017-0903

rubygems: Unsafe object deserialization through YAML formatted gem specifications

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

CVSS 3.0 · 9.8 Critical EPSS 15.9% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 8 more
CVE-2017-1000083

evince: command injection via filename in tar-compressed comics archive

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.

CVSS 3.0 · 7.8 High EPSS 51.1% KEV · Not listed
Vendors
Debian Gnome Redhat
Products
Debian Linux Evince Enterprise Linux and 6 more
CVE-2017-0902

rubygems: DNS hijacking vulnerability

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

CVSS 3.0 · 8.1 High EPSS 4.8% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 8 more