Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,088

Export CSV
CVE-2008-0006

Xorg / XFree86 PCF font parser buffer overflow

Buffer overflow in (1) X.Org Xserver before 1.4.1, and (2) the libfont and libXfont libraries on some platforms including Sun Solaris, allows context-dependent attackers to execute arbitrary code via a PCF font with a large difference between the last col and first col values in the PCF_BDF_ENCODINGS table.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Redhat Sun X.org
Products
Enterprise Linux Solaris Libfont Solaris Libxfont and 1 more
CVE-2008-0007

kernel: insufficient range checks in fault handlers with mremap

Linux kernel before 2.6.22.17, when using certain drivers that register a fault handler that does not perform range checks, allows local users to access kernel memory via an out-of-range offset.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2008-0016

Mozilla UTF-8 stack buffer overflow

Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to execute arbitrary code via a crafted UTF-8 URL in a link.

CVSS 2.0 · 10.0 Critical EPSS 43.9% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Enterprise Linux
CVE-2008-0017

Mozilla buffer overflow in http-index-format parser

The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 does not check for an allocation failure, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP index response with a crafted 200 header, which triggers memory corruption and a buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 7.7% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 2 more
CVE-2008-0047

cups: heap based buffer overflow in cgiCompileSearch()

Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the version bundled with Apple Mac OS X 10.5.2, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions.

CVSS 2.0 · 9.3 Critical EPSS 6.8% KEV · Not listed
Vendors
Apple Cups Redhat
Products
Mac Os X Mac Os X Server Cups and 1 more
CVE-2008-0053

cups: buffer overflows in HP-GL/2 filter

Multiple buffer overflows in the HP-GL/2-to-PostScript filter in CUPS before 1.3.6 might allow remote attackers to execute arbitrary code via a crafted HP-GL/2 file.

CVSS 2.0 · 10.0 Critical EPSS 8.3% KEV · Not listed
Vendors
Apple Redhat
Products
Cups Enterprise Linux
CVE-2008-0062

krb5: uninitialized pointer use in krb5kdc

KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free.

CVSS 3.1 · 9.8 Critical EPSS 10.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2008-0063

krb5: possible leak of sensitive data from krb5kdc using krb4 request

The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Apple Canonical Debian and 5 more
Products
Mac Os X Mac Os X Server Ubuntu Linux and 10 more
CVE-2008-0072

Evolution format string flaw

Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.

CVSS 2.0 · 6.8 Medium EPSS 6.0% KEV · Not listed
Vendors
Gnome Linux Redhat
Products
Evolution Linux Kernel Enterprise Linux and 1 more
CVE-2008-0122

libbind off-by-one buffer overflow

Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted input that triggers memory corruption.

CVSS 2.0 · 10.0 Critical EPSS 12.4% KEV · Not listed
Vendors
Freebsd Isc Redhat
Products
Freebsd Bind Enterprise Linux
CVE-2008-0171

boost regular expression memory corruption flaws

regex/v4/perl_matcher_non_recursive.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (failed assertion and crash) via an invalid regular expression.

CVSS 2.0 · 5.0 Medium EPSS 2.7% KEV · Not listed
Vendors
Boost Redhat
Products
Boost Boost Regex Library Enterprise Linux
CVE-2008-0172

boost regular expression NULL dereference flaw

The get_repeat_type function in basic_regex_creator.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (NULL dereference and crash) via an invalid regular expression.

CVSS 2.0 · 5.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Boost Redhat Ubuntu
Products
Boost Enterprise Linux Ubuntu Linux
CVE-2008-0304

thunderbird/seamonkey: MIME External-Body Heap Overflow Vulnerability

Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.12 and SeaMonkey before 1.1.8 might allow remote attackers to execute arbitrary code via a crafted external-body MIME type in an e-mail message, related to an incorrect memory allocation during message preview.

CVSS 2.0 · 7.5 High EPSS 6.0% KEV · Not listed
Vendors
Linux Microsoft Mozilla and 1 more
Products
Linux Kernel Windows Seamonkey and 2 more
CVE-2008-0320

openoffice.org: OLE files parsing heap overflows

Heap-based buffer overflow in the OLE importer in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an OLE file with a crafted DocumentSummaryInformation stream.

CVSS 2.0 · 9.3 Critical EPSS 56.9% KEV · Not listed
Vendors
Openoffice Redhat
Products
Openoffice.org Enterprise Linux
CVE-2008-0411

ghostscript: stack-based buffer overflow in .seticcspace operator

Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a .seticcspace operator.

CVSS 2.0 · 6.8 Medium EPSS 14.5% KEV · Not listed
Vendors
Debian Ghostscript Mandrakesoft and 3 more
Products
Debian Linux Ghostscript Mandrake Linux and 11 more
CVE-2008-0412

Mozilla layout engine crashes

The browser engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via vectors related to the (1) nsTableFrame::GetFrameAtOrBefore, (2) nsAccessibilityService::GetAccessible, (3) nsBindingManager::GetNestedInsertionPoint, (4) nsXBLPrototypeBinding::AttributeChanged, (5) nsColumnSetFrame::GetContentInsertionFrame, and (6) nsLineLayout::TrimTrailingWhiteSpaceIn methods, and other vectors.

CVSS 2.0 · 9.3 Critical EPSS 3.3% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Thunderbird and 1 more
CVE-2008-0413

Mozilla javascript engine crashes

The JavaScript engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via (1) a large switch statement, (2) certain uses of watch and eval, (3) certain uses of the mousedown event listener, and other vectors.

CVSS 2.0 · 9.3 Critical EPSS 2.5% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Thunderbird and 1 more
CVE-2008-0414

mozilla: multiple file input focus stealing vulnerabilities

Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8 allows user-assisted remote attackers to trick the user into uploading arbitrary files via label tags that shift focus to a file input field, aka "focus spoofing."

CVSS 2.0 · 4.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Enterprise Linux
CVE-2008-0415

Mozilla arbitrary code execution

Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to execute script outside of the sandbox and conduct cross-site scripting (XSS) attacks via multiple vectors including the XMLDocument.load function, aka "JavaScript privilege escalation bugs."

CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Thunderbird and 1 more
CVE-2008-0416

Mozilla arbitrary code execution

Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allow remote attackers to inject arbitrary web script or HTML via certain character encodings, including (1) a backspace character that is treated as whitespace, (2) 0x80 with Shift_JIS encoding, and (3) "zero-length non-ASCII sequences" in certain Asian character sets.

CVSS 2.0 · 4.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Thunderbird and 1 more