Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,351

Export CSV
CVE-2018-5800

LibRaw: Heap-based buffer overflow in LibRaw::kodak_ycbcr_load_raw function in internal/dcraw_common.cpp

An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.7 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash.

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Canonical Debian Libraw and 1 more
Products
Ubuntu Linux Debian Linux Libraw and 4 more
CVE-2018-5785

openjpeg: integer overflow in opj_j2k_setup_encoder function in openjp2/j2k.c

In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder function (openjp2/j2k.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 1 more
CVE-2018-5784

libtiff: uncontrolled resource consumption in TIFFSetDirectory function in tif_dir.c

In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries.

CVSS 3.0 · 6.5 Medium EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Libtiff
Products
Ubuntu Linux Debian Linux Libtiff
CVE-2018-5764

rsync: sanitization bypass in parse_argument in options.c

The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism.

CVSS 3.1 · 7.5 High EPSS 6.4% KEV · Not listed
Vendors
Canonical Debian Samba
Products
Ubuntu Linux Debian Linux Rsync
CVE-2018-5750

kernel: Kernel address information leak in drivers/acpi/sbshc.c:acpi_smbus_hc_add() function potentially allowing KASLR bypass

The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain sensitive address information by reading dmesg data from an SBS HC printk call.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 9 more
CVE-2018-5740

A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named

"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2.

CVSS 3.1 · 7.5 High EPSS 60.2% KEV · Not listed
Vendors
Canonical Debian Hp and 4 more
Products
Ubuntu Linux Debian Linux Hp-ux and 9 more
CVE-2018-5738

Some versions of BIND can improperly permit recursive query service to unauthorized clients

Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended (and documented) behavior is that if an operator has not specified a value for the "allow-recursion" setting, it SHOULD default to one of the following: none, if "recursion no;" is set in named.conf; a value inherited from the "allow-query-cache" or "allow-query" settings IF "recursion yes;" (the default for that setting) AND match lists are explicitly set for "allow-query-cache" or "allow-query" (see the BIND9 Administrative Reference Manual section 6.2 for more details); or the intended default of "allow-recursion {localhost; localnets;};" if "recursion yes;" is in effect and no values are explicitly set for "allow-query-cache" or "allow-query". However, because of the regression introduced by change #4777, it is possible when "recursion yes;" is in effect and no match list values are provided for "allow-query-cache" or "allow-query" for the setting of "allow-recursion" to inherit a setting of all hosts from the "allow-query" setting default, improperly permitting recursion to all clients. Affects BIND 9.9.12, 9.10.7, 9.11.3, 9.12.0->9.12.1-P2, the development release 9.13.0, and also releases 9.9.12-S1, 9.10.7-S1, 9.11.3-S1, and 9.11.3-S2 from BIND 9 Supported Preview Edition.

CVSS 3.0 · 5.3 Medium EPSS 11.4% KEV · Not listed
Vendors
Canonical Isc
Products
Ubuntu Linux Bind
CVE-2018-5712

php: Reflected XSS on PHAR 404 page

An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.

CVSS 3.0 · 6.1 Medium EPSS 79.9% KEV · Not listed
Vendors
Canonical Debian Php and 1 more
Products
Ubuntu Linux Debian Linux Php and 2 more
CVE-2018-5711

gd: Infinite loop in gdImageCreateFromGifCtx() in gd_gif_in.c

gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx.

CVSS 3.0 · 5.5 Medium EPSS 13.2% KEV · Not listed
Vendors
Canonical Debian Php and 1 more
Products
Ubuntu Linux Debian Linux Php and 1 more
CVE-2018-5683

Qemu: Out-of-bounds read in vga_draw_text routine

The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 8 more
CVE-2018-5391

The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of specially modified packets

The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size.

CVSS 3.1 · 7.5 High EPSS 32.1% KEV · Not listed
Vendors
Canonical Debian F5 and 4 more
Products
Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 77 more
CVE-2018-5390

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.

CVSS 3.1 · 7.5 High EPSS 71.8% KEV · Not listed
Vendors
A10networks Canonical Cisco and 5 more
Products
Advanced Core Operating System Ubuntu Linux Collaboration Meeting Rooms and 44 more
CVE-2018-5388

strongswan: integer underflow leads to buffer overflow and denial of service in stroke_socket.c

In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer underflow, which may lead to resource exhaustion and denial of service while reading from the socket.

CVSS 3.0 · 6.5 Medium EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Strongswan
Products
Ubuntu Linux Debian Linux Strongswan
CVE-2018-5381

quagga: Infinite loop issue triggered by invalid OPEN message allows denial-of-service

The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial of service.

CVSS 3.0 · 6.5 Medium EPSS 30.2% KEV · Not listed
Vendors
Canonical Debian Quagga and 1 more
Products
Ubuntu Linux Debian Linux Quagga and 2 more
CVE-2018-5380

quagga: bgpd can overrun internal BGP code-to-string conversion tables potentially allowing crash

The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.

CVSS 3.0 · 4.3 Medium EPSS 14.8% KEV · Not listed
Vendors
Canonical Debian Quagga and 1 more
Products
Ubuntu Linux Debian Linux Quagga and 2 more
CVE-2018-5379

quagga: Double free vulnerability in bgpd when processing certain forms of UPDATE message allowing to crash or potentially execute arbitrary code

The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code.

CVSS 3.0 · 7.5 High EPSS 38.5% KEV · Not listed
Vendors
Canonical Debian Quagga and 2 more
Products
Ubuntu Linux Debian Linux Quagga and 8 more
CVE-2018-5378

quagga: bgpd does not properly bounds check the data sent with a NOTIFY allowing leak of sensitive data or crash

The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.

CVSS 3.0 · 7.1 High EPSS 74.2% KEV · Not listed
Vendors
Canonical Debian Quagga
Products
Ubuntu Linux Debian Linux Quagga
CVE-2018-5358

ImageMagick: memory leak in coders/json.c:EncodeImageAttributes could cause crash

ImageMagick 7.0.7-22 Q16 has memory leaks in the EncodeImageAttributes function in coders/json.c, as demonstrated by the ReadPSDLayersInternal function in coders/psd.c.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Imagemagick
Products
Ubuntu Linux Imagemagick
CVE-2018-5345

gcab: Extracting malformed .cab files causes stack smashing potentially leading to arbitrary code execution

A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code via a crafted .cab file.

CVSS 3.0 · 7.8 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more