Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 615

Export CSV
CVE-2016-2180

OpenSSL: OOB read in TS_OBJ_print_bio()

The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command.

CVSS 3.0 · 7.5 High EPSS 30.0% KEV · Not listed
Vendors
Openssl Oracle Redhat
Products
Openssl Linux Enterprise Linux
CVE-2016-2181

openssl: DTLS replay protection bypass allows DoS against DTLS connection

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.

CVSS 3.0 · 7.5 High EPSS 22.6% KEV · Not listed
Vendors
Openssl Oracle Redhat
Products
Openssl Linux Enterprise Linux
CVE-2016-2182

openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec()

The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.

CVSS 3.0 · 9.8 Critical EPSS 44.2% KEV · Not listed
Vendors
Hp Openssl Oracle and 1 more
Products
Icewall Federation Agent Icewall Mcrp Icewall Sso and 5 more
CVE-2016-2776

bind: assertion failure in buffer.c while building responses to a specifically constructed request

buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.

CVSS 3.0 · 7.5 High EPSS 89.5% KEV · Not listed
Vendors
Hp Isc Oracle and 1 more
Products
Hp-ux Bind Linux and 7 more
CVE-2016-2790

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 3 more
Products
Firefox Leap Opensuse and 4 more
CVE-2016-2791

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 3 more
Products
Firefox Leap Opensuse and 4 more
CVE-2016-2792

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2800.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 3 more
Products
Firefox Leap Opensuse and 4 more
CVE-2016-2793

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.

CVSS 3.0 · 8.8 High EPSS 2.7% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 3 more
Products
Firefox Leap Opensuse and 4 more
CVE-2016-2794

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.

CVSS 3.0 · 8.8 High EPSS 3.5% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 3 more
Products
Firefox Leap Opensuse and 4 more
CVE-2016-2795

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 3 more
Products
Firefox Leap Opensuse and 4 more
CVE-2016-2796

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.

CVSS 3.0 · 8.8 High EPSS 3.9% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 3 more
Products
Firefox Leap Opensuse and 4 more
CVE-2016-2797

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2801.

CVSS 3.0 · 8.8 High EPSS 2.7% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 3 more
Products
Firefox Leap Opensuse and 4 more
CVE-2016-2798

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 3 more
Products
Firefox Leap Opensuse and 4 more
CVE-2016-2799

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.

CVSS 3.0 · 8.8 High EPSS 4.9% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 3 more
Products
Firefox Leap Opensuse and 4 more
CVE-2016-2800

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 3 more
Products
Firefox Leap Opensuse and 4 more
CVE-2016-2801

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2797.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 3 more
Products
Firefox Leap Opensuse and 4 more
CVE-2016-2802

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 3 more
Products
Firefox Leap Opensuse and 4 more
CVE-2016-2837

Mozilla: Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback (MFSA 2016-77)

Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass.

CVSS 3.0 · 6.3 Medium EPSS 4.6% KEV · Not listed
Vendors
Mozilla Oracle Redhat
Products
Firefox Linux Enterprise Linux
CVE-2016-3452

mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU July 2016)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Security: Encryption.

CVSS 3.0 · 3.7 Low EPSS 4.1% KEV · Not listed
Vendors
Ibm Mariadb Oracle and 1 more
Products
Powerkvm Mariadb Linux and 3 more
CVE-2016-3458

OpenJDK: insufficient restrictions on the use of custom ValueHandler (CORBA, 8079718)

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; and Java SE Embedded 8u91 allows remote attackers to affect integrity via vectors related to CORBA.

CVSS 3.0 · 4.3 Medium EPSS 3.0% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Linux and 2 more