CVE-2015-0374

mysql: unspecified vulnerability related to Server:Security:Privileges:Foreign Key (CPU Jan 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges : Foreign Key.

CVSS 2.0 · 3.5 Low EPSS 3.1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 16 more

CVE-2015-8000

bind: responses with a malformed class attribute can trigger an assertion failure in db.c

db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute.

CVSS 2.0 · 5.0 Medium EPSS 55.9% KEV · Not listed

Vendors

Isc Oracle Redhat

Products

Bind Linux Solaris and 4 more

CVE-2015-0275

kernel: fs: ext4: fallocate zero range page size > block size BUG()

The ext4_zero_range function in fs/ext4/extents.c in the Linux kernel before 4.1 allows local users to cause a denial of service (BUG) via a crafted fallocate zero-range request.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Oracle Redhat

Products

Linux Kernel Linux Enterprise Linux and 2 more

CVE-2015-0272

NetworkManager: remote DoS using IPv6 RA with bogus MTU

GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message, a different vulnerability than CVE-2015-8215.

CVSS 2.0 · 5.0 Medium EPSS 4.9% KEV · Not listed

Vendors

Canonical Gnome Oracle and 2 more

Products

Ubuntu Linux Networkmanager Linux and 7 more

CVE-2015-8385

pcre: buffer overflow caused by named forward reference to duplicate group number (8.38/30)

PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 2.0 · 7.5 High EPSS 5.6% KEV · Not listed

Vendors

Oracle Pcre Redhat

Products

Linux Perl Compatible Regular Expression Library Enterprise Linux and 1 more

CVE-2015-8386

pcre: Buffer overflow caused by lookbehind assertion (8.38/6)

PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 3.1 · 9.8 Critical EPSS 6.9% KEV · Not listed

Vendors

Fedoraproject Oracle Pcre and 2 more

Products

Fedora Linux Perl Compatible Regular Expression Library and 3 more

CVE-2016-1935

Mozilla: Buffer overflow in WebGL after out of memory allocation (MFSA 2016-03)

Buffer overflow in the BufferSubData function in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allows remote attackers to execute arbitrary code via crafted WebGL content.

CVSS 3.0 · 8.8 High EPSS 5.1% KEV · Not listed

Vendors

Mozilla Opensuse Oracle and 1 more

Products

Firefox Leap Opensuse and 2 more

CVE-2015-8391

pcre: inefficient posix character class syntax check (8.38/16)

The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 3.1 · 9.8 Critical EPSS 6.4% KEV · Not listed

Vendors

Fedoraproject Oracle Pcre and 2 more

Products

Fedora Linux Pcre and 9 more

CVE-2015-8629

krb5: xdr_nullstring() doesn't check for terminating null character

The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.

CVSS 3.1 · 5.3 Medium EPSS 3.7% KEV · Not listed

Vendors

Debian Mit Opensuse and 2 more

Products

Debian Linux Kerberos 5 Leap and 10 more

CVE-2015-8631

krb5: Memory leak caused by supplying a null principal name in request

Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name.

CVSS 3.1 · 6.5 Medium EPSS 4.7% KEV · Not listed

Vendors

Debian Mit Opensuse and 2 more

Products

Debian Linux Kerberos 5 Leap and 9 more

CVE-2015-8668

libtiff: OOB read in bmp2tiff

Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.

CVSS 3.1 · 9.8 Critical EPSS 13.7% KEV · Not listed

Vendors

Libtiff Oracle Redhat

Products

Libtiff Linux Vm Server and 3 more

CVE-2016-1965

Mozilla: Addressbar spoofing though history navigation and Location protocol property (MFSA 2016-28)

Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property.

CVSS 3.0 · 4.3 Medium EPSS 2.2% KEV · Not listed

Vendors

Mozilla Opensuse Oracle and 1 more

Products

Firefox Opensuse Linux and 1 more

CVE-2015-0253

httpd: NULL pointer dereference crash with ErrorDocument 400 pointing to a local URL-path

The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.

CVSS 2.0 · 5.0 Medium EPSS 12.8% KEV · Not listed

Vendors

Apache Apple Oracle and 1 more

Products

Http Server Mac Os X Mac Os X Server and 3 more

CVE-2014-4260

mysql: unspecified vulnerability related to SRCHAR (CPU July 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier, and 5.6.17 and earlier, allows remote authenticated users to affect integrity and availability via vectors related to SRCHAR.

CVSS 2.0 · 5.5 Medium EPSS 3.5% KEV · Not listed

Vendors

Debian Mariadb Oracle and 2 more

Products

Debian Linux Mariadb Mysql and 8 more

CVE-2015-0239

kernel: kvm: insufficient sysenter emulation when invoked from 16-bit code

The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 2 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 5 more

CVE-2016-0666

mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU April 2016)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to Security: Privileges.

CVSS 3.0 · 5.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Debian Ibm Mariadb and 3 more

Products

Debian Linux Powerkvm Mariadb and 5 more

CVE-2015-0235

glibc: __nss_hostname_digits_dots() heap-based buffer overflow

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

CVSS 2.0 · 10.0 Critical EPSS 94.6% KEV · Not listed

Vendors

Apple Debian Gnu and 4 more

Products

Mac Os X Debian Linux Glibc and 19 more

CVE-2014-9751

ntp: drop packets with source address ::1

The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attackers to spoof restricted packets, and read or write to the runtime state, by leveraging the ability to reach the ntpd machine's network interface with a packet from the ::1 address.

CVSS 2.0 · 6.8 Medium EPSS 4.5% KEV · Not listed

Vendors

Apple Debian Linux and 3 more

Products

Macos Debian Linux Linux Kernel and 6 more

CVE-2016-0651

mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.

CVSS 3.1 · 5.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Mariadb Opensuse Oracle and 2 more

Products

Mariadb Leap Opensuse and 14 more

CVE-2016-0668

mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU April 2016)

Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier and MariaDB 10.0.x before 10.0.24 and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to InnoDB.

CVSS 3.1 · 4.1 Medium EPSS 1.6% KEV · Not listed

Vendors

Canonical Debian Mariadb and 4 more

Products

Ubuntu Linux Debian Linux Mariadb and 8 more