Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,273

Export CSV
CVE-2018-18337

chromium-browser: Use after free in Blink

Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.7% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-18336

chromium-browser: Use after free in PDFium

Incorrect object lifecycle in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-18281

kernel: TLB flush happens too late on mremap

Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19.

CVSS 3.0 · 7.8 High EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 7 more
CVE-2018-18021

kernel: Privilege escalation on arm64 via KVM hypervisor

arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the KVM_SET_ON_REG ioctl. This is exploitable by attackers who can create virtual machines. An attacker can arbitrarily redirect the hypervisor flow of control (with full register control). An attacker can also cause a denial of service (hypervisor panic) via an illegal exception return. This occurs because of insufficient restrictions on userspace access to the core register file, and because PSTATE.M validation does not prevent unintended execution modes.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 1 more
CVE-2018-17972

kernel: Unprivileged users able to inspect kernel stacks of arbitrary tasks

An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 8 more
CVE-2018-17481

chromium-browser: Use after frees in PDFium

Incorrect object lifecycle handling in PDFium in Google Chrome prior to 71.0.3578.98 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-17473

chromium-browser: URL spoof in Omnibox

Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.

CVSS 3.0 · 4.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-17469

chromium-browser: Heap buffer overflow in PDFium

Incorrect handling of PDF filter chains in PDFium in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-17464

chromium-browser: URL spoof in Omnibox

Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS 3.0 · 4.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-17462

chromium-browser: Sandbox escape in AppCache

Incorrect refcounting in AppCache in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform a sandbox escape via a crafted HTML page.

CVSS 3.0 · 9.6 Critical EPSS 1.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-17182

kernel: Use-after-free in the vmacache_flush_all function resulting in a possible privilege escalation

An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations.

CVSS 3.1 · 7.8 High EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 3 more
CVE-2018-16884

kernel: nfs: use-after-free in svc_process_common()

A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.

CVSS 3.1 · 8.0 High EPSS 1.5% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 5 more
CVE-2018-16876

ansible: Information disclosure in vvv+ mode with no_log on

ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.

CVSS 3.1 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Ansible and 7 more
CVE-2018-16874

golang: "go get" vulnerable to directory traversal via malicious package

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

CVSS 3.1 · 8.1 High EPSS 5.0% KEV · Not listed
Vendors
Debian Golang Opensuse and 1 more
Products
Debian Linux Go Backports Sle and 2 more
CVE-2018-16873

golang: "go get" command vulnerable to RCE via import of malicious package

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".

CVSS 3.1 · 8.1 High EPSS 66.3% KEV · Not listed
Vendors
Debian Golang Opensuse and 1 more
Products
Debian Linux Go Backports Sle and 2 more
CVE-2018-16862

kernel: cleancache: Infoleak of deleted files after reuse of old inodes

A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one.

CVSS 3.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 1 more
CVE-2018-16837

Ansible: Information leak in "user" module

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Redhat Suse
Products
Debian Linux Ansible Engine Ansible Tower and 3 more
CVE-2018-16658

kernel: Information leak in cdrom_ioctl_drive_status

An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 2 more
CVE-2018-16276

kernel: incorrect bounds checking in yurex_read in drivers/usb/misc/yurex.c

An issue was discovered in yurex_read in drivers/usb/misc/yurex.c in the Linux kernel before 4.17.7. Local attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to crash the kernel or potentially escalate privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux
Products
Ubuntu Linux Debian Linux Linux Kernel