Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2018-12366

Mozilla: Invalid data handling during QCMS transformations

An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

CVSS 3.0 · 6.5 Medium EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more
CVE-2018-12365

Mozilla: Compromised IPC child process can list local filenames

A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

CVSS 3.0 · 6.5 Medium EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more
CVE-2018-12364

Mozilla: CSRF attacks through 307 redirects and NPAPI plugins

NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site. This allows for a malicious site to engage in cross-site request forgery (CSRF) attacks. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

CVSS 3.0 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more
CVE-2018-12363

Mozilla: Use-after-free when appending DOM nodes

A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the node still having a pointer referencing it. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

CVSS 3.0 · 8.8 High EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more
CVE-2018-12362

Mozilla: Integer overflow in SSSE3 scaler

An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

CVSS 3.0 · 8.8 High EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more
CVE-2018-12360

Mozilla: Use-after-free using focus()

A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

CVSS 3.0 · 8.8 High EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more
CVE-2018-12359

Mozilla: Buffer overflow using computed size of canvas element

A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing data to be written outside of the currently computed boundaries. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

CVSS 3.0 · 8.8 High EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more
CVE-2018-12327

ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution

Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source.

CVSS 3.0 · 9.8 Critical EPSS 27.5% KEV · Not listed
Vendors
Ntp Redhat
Products
Ntp Enterprise Linux Rhel Eus
CVE-2018-12326

redis: Code execution in redis-cli via crafted command line arguments

Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source.

CVSS 3.0 · 8.4 High EPSS 2.6% KEV · Not listed
Vendors
Redhat Redislabs
Products
Openstack Rhel Software Collections Redis
CVE-2018-12265

exiv2: integer overflow in the LoaderExifJpeg class in preview.cpp

Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp.

CVSS 3.0 · 8.8 High EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Exiv2 and 1 more
Products
Ubuntu Linux Debian Linux Exiv2 and 1 more
CVE-2018-12264

exiv2: integer overflow in getData function in preview.cpp

Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp.

CVSS 3.0 · 8.8 High EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Exiv2 and 1 more
Products
Ubuntu Linux Debian Linux Exiv2 and 1 more
CVE-2018-12232

kernel: NULL pointer dereference if close and fchownat system calls share a socket file descriptor

In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions. fchownat does not increment the file descriptor reference count, which allows close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash.

CVSS 3.0 · 5.9 Medium EPSS 6.3% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2018-12207

hw: Machine Check Error on Page Size Change (IFU)

Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian F5 and 5 more
Products
Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 1538 more
CVE-2018-12181

edk2: Stack buffer overflow with corrupted BMP

Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege via local access.

CVSS 3.0 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Tianocore
Products
Enterprise Linux Edk Ii
CVE-2018-12180

edk2: Buffer Overflow in BlockIo service for RAM disk

Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via network access.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Opensuse Redhat Tianocore
Products
Leap Enterprise Linux Edk Ii
CVE-2018-12085

liblouis: Stack-based buffer overflow in compileTranslationTable.c

Liblouis 3.6.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.

CVSS 3.0 · 8.8 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Liblouis Opensuse and 1 more
Products
Ubuntu Linux Liblouis Leap and 1 more
CVE-2018-12020

gnupg2: Improper sanitization of filenames allows for the display of fake status messages and the bypass of signature verification

mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.

CVSS 3.1 · 7.5 High EPSS 8.2% KEV · Not listed
Vendors
Canonical Debian Gnupg and 1 more
Products
Ubuntu Linux Debian Linux Gnupg and 7 more
CVE-2018-12015

perl: Directory traversal in Archive::Tar

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.

CVSS 3.0 · 7.5 High EPSS 7.3% KEV · Not listed
Vendors
Apple Archive\ Canonical and 4 more
Products
Mac Os X \ Ubuntu Linux and 7 more
CVE-2018-11813

libjpeg: "cjpeg" utility large loop because read_pixel in rdtarga.c mishandles EOF

libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.

CVSS 3.0 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Ijg Redhat
Products
Libjpeg Enterprise Linux