Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 615

Export CSV
CVE-2016-1973

Mozilla: Use-after-free in GetStaticInstance in WebRTC (MFSA 2016-33)

Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 3.0% KEV · Not listed
Vendors
Mozilla Oracle Redhat
Products
Firefox Linux Enterprise Linux
CVE-2014-9750

ntp: vallen in extension fields are not validated

ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field.

CVSS 2.0 · 5.8 Medium EPSS 6.1% KEV · Not listed
Vendors
Debian Ntp Oracle and 1 more
Products
Debian Linux Ntp Linux and 4 more
CVE-2014-9644

kernel: crypto api unprivileged arbitrary module load via request_module()

The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 4 more
CVE-2013-4312

kernel: File descriptors passed over unix sockets are not properly accounted

The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c.

CVSS 3.0 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Oracle Redhat
Products
Linux Kernel Linux Enterprise Linux and 1 more
CVE-2014-9584

kernel: isofs: unchecked printing of ER records

The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 4 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 19 more
CVE-2014-8566

mod_auth_mellon: remote memory disclosure flaw

The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a "session overflow" involving "sessions overlapping in memory."

CVSS 2.0 · 6.4 Medium EPSS 2.7% KEV · Not listed
Vendors
Oracle Redhat Uninett
Products
Linux Enterprise Linux Mod Auth Mellon
CVE-2016-1964

Mozilla: Use-after-free during XML transformations (MFSA 2016-27)

Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations.

CVSS 3.0 · 8.8 High EPSS 2.8% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 2 more
Products
Firefox Thunderbird Leap and 4 more
CVE-2016-1974

Mozilla: Out-of-bounds read in HTML parser following a failed allocation (MFSA 2016-34)

The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML, XML, or SVG document.

CVSS 3.0 · 8.8 High EPSS 3.0% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 2 more
Products
Firefox Thunderbird Leap and 4 more
CVE-2014-8559

kernel: fs: deadlock due to incorrect usage of rename_lock

The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of rename_lock, which allows local users to cause a denial of service (deadlock and system hang) via a crafted application.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Novell and 4 more
Products
Ubuntu Linux Linux Kernel Suse Linux Enterprise Desktop and 11 more
CVE-2014-8134

kernel: x86: espfix not working for 32-bit KVM paravirt guests

The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Opensuse and 3 more
Products
Ubuntu Linux Linux Kernel Evergreen and 4 more
CVE-2016-1960

Mozilla: Use-after-free in HTML5 string parser (MFSA 2016-23)

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.

CVSS 3.0 · 8.8 High EPSS 30.9% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 2 more
Products
Firefox Thunderbird Leap and 4 more
CVE-2014-6568

mysql: unspecified vulnerability related to Server:InnoDB:DML (CPU Jan 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DML.

CVSS 2.0 · 3.5 Low EPSS 7.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 16 more
CVE-2016-1961

Mozilla: Use-after-free in SetBody (MFSA 2016-24)

Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element, aka ZDI-CAN-3574.

CVSS 3.0 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 2 more
Products
Firefox Thunderbird Leap and 4 more
CVE-2014-6564

mysql: unspecified vulnerability related to SERVER:INNODB FULLTEXT SEARCH DML (CPU October 2014)

Unspecified vulnerability in Oracle MySQL Server 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:INNODB FULLTEXT SEARCH DML.

CVSS 2.0 · 4.0 Medium EPSS 2.4% KEV · Not listed
Vendors
Mariadb Oracle Suse
Products
Mariadb Mysql Linux Enterprise Desktop and 3 more
CVE-2014-6559

mysql: unspecified vulnerability related to C API SSL CERTIFICATE HANDLING (CPU October 2014)

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING.

CVSS 2.0 · 4.3 Medium EPSS 4.7% KEV · Not listed
Vendors
Juniper Mariadb Oracle and 2 more
Products
Junos Space Mariadb Mysql and 8 more
CVE-2016-1957

Mozilla: Memory leak in libstagefright when deleting an array during MP4 processing (MFSA 2016-20)

Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (memory consumption) via an MPEG-4 file that triggers a delete operation on an array.

CVSS 3.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Mozilla Novell Opensuse and 2 more
Products
Firefox Thunderbird Suse Package Hub For Suse Linux Enterprise and 4 more
CVE-2014-6555

mysql: unspecified vulnerability related to SERVER:DML (CPU October 2014)

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML.

CVSS 2.0 · 6.5 Medium EPSS 3.9% KEV · Not listed
Vendors
Mariadb Oracle Redhat and 1 more
Products
Mariadb Mysql Enterprise Linux and 6 more
CVE-2014-6551

mysql: unspecified vulnerability related to CLIENT:MYSQLADMIN (CPU October 2014)

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows local users to affect confidentiality via vectors related to CLIENT:MYSQLADMIN.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Mariadb Oracle Redhat and 1 more
Products
Mariadb Mysql Solaris and 7 more
CVE-2016-1958

Mozilla: Displayed page address can be overridden (MFSA 2016-21)

browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascript: URL.

CVSS 3.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 1 more
Products
Firefox Opensuse Linux and 1 more
CVE-2016-1962

Mozilla: Use-after-free when using multiple WebRTC data channels (MFSA 2016-25)

Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections.

CVSS 3.0 · 9.8 Critical EPSS 6.1% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 1 more
Products
Firefox Opensuse Linux and 1 more