Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 626

Export CSV
CVE-2016-5440

mysql: unspecified vulnerability in subcomponent: Server: RBR (CPU July 2016)

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators to affect availability via vectors related to Server: RBR.

CVSS 3.0 · 4.9 Medium EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Ibm and 3 more
Products
Ubuntu Linux Debian Linux Powerkvm and 11 more
CVE-2016-5425

tomcat: Local privilege escalation via systemd-tmpfiles service

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CVSS 3.1 · 7.8 High EPSS 3.8% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Tomcat Instantis Enterprisetrack Linux and 7 more
CVE-2015-0248

subversion: (mod_dav_svn) remote denial of service with certain requests with dynamically evaluated revision numbers

The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers.

CVSS 2.0 · 5.0 Medium EPSS 12.8% KEV · Not listed
Vendors
Apache Apple Opensuse and 2 more
Products
Subversion Xcode Opensuse and 7 more
CVE-2016-5418

libarchive: Archive Entry with type 1 (hardlink), but has a non-zero data size file overwrite

The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.

CVSS 3.0 · 7.5 High EPSS 4.7% KEV · Not listed
Vendors
Libarchive Oracle Redhat
Products
Libarchive Linux Enterprise Linux and 8 more
CVE-2016-5403

Qemu: virtio: unbounded memory allocation on host via guest leading to DoS

The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Oracle and 2 more
Products
Ubuntu Linux Debian Linux Linux and 12 more
CVE-2016-5386

Go: sets environmental variable based on user supplied Proxy request header

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

CVSS 3.1 · 8.1 High EPSS 5.2% KEV · Not listed
Vendors
Fedoraproject Golang Oracle and 1 more
Products
Fedora Go Linux and 4 more
CVE-2014-9675

freetype: information leak in _bdf_add_property()

bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.

CVSS 2.0 · 5.0 Medium EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 9 more
CVE-2016-4809

libarchive: Memory allocate error with symbolic links in cpio archives

The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink.

CVSS 3.0 · 7.5 High EPSS 4.8% KEV · Not listed
Vendors
Libarchive Oracle Redhat
Products
Libarchive Linux Enterprise Linux and 7 more
CVE-2016-4578

kernel: Information leak in events in timer.c

sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.

CVSS 3.0 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 10 more
CVE-2014-9674

freetype: multiple integer overflows Mac_Read_POST_Resource() leading to heap-based buffer overflows

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.

CVSS 2.0 · 7.5 High EPSS 5.7% KEV · Not listed
Vendors
Canonical Fedoraproject Freetype and 3 more
Products
Ubuntu Linux Fedora Freetype and 9 more
CVE-2016-4470

kernel: Uninitialized variable in request_key handling causes kernel crash in error handling path

The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Novell Oracle and 1 more
Products
Linux Kernel Suse Linux Enterprise Real Time Extension Linux and 14 more
CVE-2016-4448

libxml2: Format string vulnerability

Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.

CVSS 3.1 · 9.8 Critical EPSS 7.0% KEV · Not listed
Vendors
Apple Hp Mcafee and 6 more
Products
Icloud Iphone Os Itunes and 19 more
CVE-2014-9673

freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.

CVSS 2.0 · 6.8 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Freetype and 2 more
Products
Ubuntu Linux Debian Linux Freetype and 8 more
CVE-2016-4302

libarchive: Heap buffer overflow in the Rar decompression functionality

Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.

CVSS 3.0 · 7.8 High EPSS 4.8% KEV · Not listed
Vendors
Libarchive Redhat
Products
Libarchive Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2016-4300

libarchive: Heap buffer overflow vulnerability in the 7zip read_SubStreamsInfo

Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow.

CVSS 3.0 · 7.8 High EPSS 4.9% KEV · Not listed
Vendors
Libarchive Redhat
Products
Libarchive Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2014-9671

freetype: integer overflow in pcf_get_properties() leading to NULL pointer dereference

Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented.

CVSS 2.0 · 4.3 Medium EPSS 3.5% KEV · Not listed
Vendors
Canonical Debian Freetype and 3 more
Products
Ubuntu Linux Debian Linux Freetype and 9 more
CVE-2014-9670

freetype: integer overflow in pcf_get_encodings() leading to NULL pointer dereference

Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row.

CVSS 2.0 · 4.3 Medium EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2016-3712

qemu-kvm: Out-of-bounds read when creating weird vga screen surface

Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Citrix Debian and 3 more
Products
Ubuntu Linux Xenserver Debian Linux and 9 more