CVE-2014-2894

QEMU: out of bounds buffer accesses, guest triggerable via IDE SMART

Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux Openstack

CVE-2016-6662

mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.

CVSS 3.0 · 9.8 Critical EPSS 67.7% KEV · Not listed

Vendors

Debian Mariadb Oracle and 2 more

Products

Debian Linux Mariadb Mysql and 10 more

CVE-2014-2828

openstack-keystone: denial of service via V3 API authentication chaining

The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining."

CVSS 2.0 · 7.8 High EPSS 3.2% KEV · Not listed

Vendors

Openstack Redhat

Products

Keystone Openstack

CVE-2016-6186

django: XSS in admin's add/change related popup

Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.

CVSS 3.0 · 6.1 Medium EPSS 5.5% KEV · Not listed

Vendors

Debian Djangoproject Redhat

Products

Debian Linux Django Openstack and 1 more

CVE-2016-5403

Qemu: virtio: unbounded memory allocation on host via guest leading to DoS

The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Oracle and 2 more

Products

Ubuntu Linux Debian Linux Linux and 12 more

CVE-2014-2525

libyaml: heap-based buffer overflow when parsing URLs

Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.

CVSS 2.0 · 6.8 Medium EPSS 8.8% KEV · Not listed

Vendors

Opensuse Pyyaml Redhat

Products

Leap Opensuse Libyaml and 3 more

CVE-2016-5363

openstack-neutron: MAC source address spoofing vulnerability

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via (1) a crafted DHCP discovery message or (2) crafted non-IP traffic.

CVSS 3.0 · 8.2 High EPSS 3.3% KEV · Not listed

Vendors

Openstack Redhat

Products

Neutron Openstack

CVE-2016-5362

openstack-neutron: DHCP spoofing vulnerability

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.

CVSS 3.0 · 8.2 High EPSS 3.4% KEV · Not listed

Vendors

Openstack Redhat

Products

Neutron Openstack

CVE-2014-2494

mysql: unspecified vulnerability related to ENARC (CPU July 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to ENARC.

CVSS 2.0 · 4.0 Medium EPSS 3.5% KEV · Not listed

Vendors

Debian Mariadb Oracle and 2 more

Products

Debian Linux Mariadb Mysql and 7 more

CVE-2016-5126

Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl

Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Oracle and 2 more

Products

Ubuntu Linux Debian Linux Linux and 10 more

CVE-2016-4985

openstack-ironic: Ironic Node information including credentials exposed to unauthenticated users

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed

Vendors

Canonical Redhat

Products

Openstack Ironic Openstack

CVE-2014-2237

openstack-keystone: trustee token revocation does not work with memcache backend

The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.

CVSS 2.0 · 5.0 Medium EPSS 1.4% KEV · Not listed

Vendors

Openstack Redhat

Products

Keystone Openstack

CVE-2012-6619

mongodb: memory over-read via incorrect BSON object length

The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert command, which triggers a buffer over-read.

CVSS 2.0 · 6.4 Medium EPSS 3.9% KEV · Not listed

Vendors

Mongodb Redhat

Products

Mongodb Enterprise Mrg Openstack and 2 more

CVE-2016-4474

overcloud-full: Default root password set

The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) director (aka overcloud-full) use a default root password of ROOTPW, which allows attackers to gain access via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openstack Openstack-director

CVE-2016-4428

python-django-horizon: XSS in client side template

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

CVSS 3.1 · 5.4 Medium EPSS 2.1% KEV · Not listed

Vendors

Debian Openstack Redhat

Products

Debian Linux Horizon Enterprise Linux and 1 more

CVE-2013-4151

qemu: virtio: out-of-bounds buffer write on invalid state load

The virtio_load function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds write.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux Openstack

CVE-2016-4020

Qemu: i386: leakage of stack memory to guest in kvmvapic.c

The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Qemu and 1 more

Products

Ubuntu Linux Debian Linux Qemu and 9 more

CVE-2014-0474

python-django: MySQL typecasting

The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting."

CVSS 2.0 · 10.0 Critical EPSS 4.8% KEV · Not listed

Vendors

Canonical Djangoproject Redhat

Products

Ubuntu Linux Django Openstack

CVE-2013-4150

qemu: virtio-net: out-of-bounds buffer write on invalid state load

The virtio_net_load function in hw/net/virtio-net.c in QEMU 1.5.0 through 1.7.x before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors in which the value of curr_queues is greater than max_queues, which triggers an out-of-bounds write.

CVSS 2.0 · 7.5 High EPSS 5.0% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux Openstack

CVE-2016-3710

qemu: incorrect banked access bounds checking in vga module

The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Citrix Debian and 4 more

Products

Ubuntu Linux Xenserver Debian Linux and 14 more