CVE-2016-2776

bind: assertion failure in buffer.c while building responses to a specifically constructed request

buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.

CVSS 3.0 · 7.5 High EPSS 89.5% KEV · Not listed

Vendors

Hp Isc Oracle and 1 more

Products

Hp-ux Bind Linux and 7 more

CVE-2016-2792

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2800.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed

Vendors

Mozilla Opensuse Oracle and 3 more

Products

Firefox Leap Opensuse and 4 more

CVE-2016-2798

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed

Vendors

Mozilla Opensuse Oracle and 3 more

Products

Firefox Leap Opensuse and 4 more

CVE-2016-1930

Mozilla: Miscellaneous memory safety hazards (rv:38.6) (MFSA 2016-01)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 3.0 · 9.8 Critical EPSS 6.0% KEV · Not listed

Vendors

Mozilla Opensuse Oracle and 1 more

Products

Firefox Leap Opensuse and 2 more

CVE-2014-6530

mysql: unspecified vulnerability related to CLIENT:MYSQLDUMP (CPU October 2014)

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to CLIENT:MYSQLDUMP.

CVSS 2.0 · 6.5 Medium EPSS 2.7% KEV · Not listed

Vendors

Mariadb Oracle Redhat and 1 more

Products

Mariadb Mysql Solaris and 7 more

CVE-2016-1714

Qemu: nvram: OOB r/w access in processing firmware configurations

The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration.

CVSS 3.0 · 8.1 High EPSS 6.1% KEV · Not listed

Vendors

Oracle Qemu Redhat

Products

Linux Qemu Enterprise Linux and 1 more

CVE-2014-6520

mysql: unspecified vulnerability related to SERVER:DDL (CPU October 2014)

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:DDL.

CVSS 2.0 · 4.0 Medium EPSS 2.7% KEV · Not listed

Vendors

Mariadb Oracle Redhat and 1 more

Products

Mariadb Mysql Enterprise Linux and 6 more

CVE-2016-1950

nss: Heap buffer overflow vulnerability in ASN1 certificate parsing (MFSA 2016-35)

Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.

CVSS 3.0 · 8.8 High EPSS 4.2% KEV · Not listed

Vendors

Apple Mozilla Opensuse and 2 more

Products

Iphone Os Mac Os X Tvos and 13 more

CVE-2016-1952

Mozilla: Miscellaneous memory safety hazards (rv:38.7) (MFSA 2016-16)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 3.0 · 8.8 High EPSS 3.0% KEV · Not listed

Vendors

Mozilla Novell Opensuse and 2 more

Products

Firefox Thunderbird Suse Package Hub For Suse Linux Enterprise and 4 more

CVE-2016-1954

Mozilla: Local file overwriting and potential privilege escalation through CSP reports (MFSA 2016-17)

The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy (CSP) violation report, which allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed

Vendors

Mozilla Novell Opensuse and 2 more

Products

Firefox Thunderbird Suse Package Hub For Suse Linux Enterprise and 4 more

CVE-2016-2179

openssl: DTLS memory exhaustion DoS when messages are not removed from fragment buffer

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.

CVSS 3.0 · 7.5 High EPSS 26.6% KEV · Not listed

Vendors

Openssl Oracle Redhat

Products

Openssl Linux Enterprise Linux

CVE-2016-1958

Mozilla: Displayed page address can be overridden (MFSA 2016-21)

browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascript: URL.

CVSS 3.0 · 4.3 Medium EPSS 2.2% KEV · Not listed

Vendors

Mozilla Opensuse Oracle and 1 more

Products

Firefox Opensuse Linux and 1 more

CVE-2016-1960

Mozilla: Use-after-free in HTML5 string parser (MFSA 2016-23)

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.

CVSS 3.0 · 8.8 High EPSS 30.9% KEV · Not listed

Vendors

Mozilla Opensuse Oracle and 2 more

Products

Firefox Thunderbird Leap and 4 more

CVE-2016-1961

Mozilla: Use-after-free in SetBody (MFSA 2016-24)

Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element, aka ZDI-CAN-3574.

CVSS 3.0 · 8.8 High EPSS 2.9% KEV · Not listed

Vendors

Mozilla Opensuse Oracle and 2 more

Products

Firefox Thunderbird Leap and 4 more

CVE-2014-6507

mysql: unspecified vulnerability related to SERVER:DML (CPU October 2014)

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML.

CVSS 2.0 · 4.3 Medium EPSS 7.3% KEV · Not listed

Vendors

Mariadb Oracle Redhat and 1 more

Products

Mariadb Mysql Solaris and 7 more

CVE-2016-1964

Mozilla: Use-after-free during XML transformations (MFSA 2016-27)

Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations.

CVSS 3.0 · 8.8 High EPSS 2.8% KEV · Not listed

Vendors

Mozilla Opensuse Oracle and 2 more

Products

Firefox Thunderbird Leap and 4 more

CVE-2016-0695

OpenJDK: insufficient DSA key parameters checks (Security, 8138593)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security.

CVSS 3.0 · 5.9 Medium EPSS 3.4% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 11 more

CVE-2016-1966

Mozilla: Memory corruption with malicious NPAPI plugin (MFSA 2016-31)

The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin.

CVSS 3.0 · 8.8 High EPSS 2.9% KEV · Not listed

Vendors

Mozilla Opensuse Oracle and 1 more

Products

Firefox Thunderbird Opensuse and 2 more

CVE-2016-1973

Mozilla: Use-after-free in GetStaticInstance in WebRTC (MFSA 2016-33)

Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 3.0% KEV · Not listed

Vendors

Mozilla Oracle Redhat

Products

Firefox Linux Enterprise Linux

CVE-2016-0668

mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU April 2016)

Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier and MariaDB 10.0.x before 10.0.24 and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to InnoDB.

CVSS 3.1 · 4.1 Medium EPSS 1.6% KEV · Not listed

Vendors

Canonical Debian Mariadb and 4 more

Products

Ubuntu Linux Debian Linux Mariadb and 8 more