CVE-2016-5264

Mozilla: Use-after-free when applying SVG effects (MFSA 2016-79)

Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application.

CVSS 3.0 · 8.8 High EPSS 3.2% KEV · Not listed

Vendors

Mozilla Oracle Redhat

Products

Firefox Linux Enterprise Linux

CVE-2016-5265

Mozilla: Same-origin policy violation using local HTML file and saved shortcut file (MFSA 2016-80)

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory.

CVSS 3.0 · 5.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Mozilla Oracle Redhat

Products

Firefox Linux Enterprise Linux

CVE-2016-5385

PHP: sets environmental variable based on user supplied Proxy request header

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

CVSS 3.1 · 8.1 High EPSS 50.4% KEV · Not listed

Vendors

Debian Drupal Fedoraproject and 5 more

Products

Debian Linux Drupal Fedora and 13 more

CVE-2016-5386

Go: sets environmental variable based on user supplied Proxy request header

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

CVSS 3.1 · 8.1 High EPSS 5.2% KEV · Not listed

Vendors

Fedoraproject Golang Oracle and 1 more

Products

Fedora Go Linux and 4 more

CVE-2016-5387

HTTPD: sets environmental variable based on user supplied Proxy request header

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.

CVSS 3.1 · 8.1 High EPSS 55.7% KEV · Not listed

Vendors

Apache Canonical Debian and 5 more

Products

Http Server Ubuntu Linux Debian Linux and 19 more

CVE-2016-5403

Qemu: virtio: unbounded memory allocation on host via guest leading to DoS

The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Oracle and 2 more

Products

Ubuntu Linux Debian Linux Linux and 12 more

CVE-2016-5404

ipa: Insufficient privileges check in certificate revocation

The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.

CVSS 3.0 · 6.5 Medium EPSS 2.6% KEV · Not listed

Vendors

Fedoraproject Freeipa Oracle and 1 more

Products

Fedora Freeipa Linux and 1 more

CVE-2016-5408

squid: Buffer overflow vulnerability in cachemgr.cgi tool

Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-4051.

CVSS 3.0 · 9.8 Critical EPSS 4.4% KEV · Not listed

Vendors

Oracle Redhat

Products

Linux Enterprise Linux Enterprise Linux Server and 1 more

CVE-2016-5418

libarchive: Archive Entry with type 1 (hardlink), but has a non-zero data size file overwrite

The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.

CVSS 3.0 · 7.5 High EPSS 4.7% KEV · Not listed

Vendors

Libarchive Oracle Redhat

Products

Libarchive Linux Enterprise Linux and 8 more

CVE-2016-5425

tomcat: Local privilege escalation via systemd-tmpfiles service

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CVSS 3.1 · 7.8 High EPSS 3.8% KEV · Not listed

Vendors

Apache Oracle Redhat

Products

Tomcat Instantis Enterprisetrack Linux and 7 more

CVE-2016-5440

mysql: unspecified vulnerability in subcomponent: Server: RBR (CPU July 2016)

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators to affect availability via vectors related to Server: RBR.

CVSS 3.0 · 4.9 Medium EPSS 3.9% KEV · Not listed

Vendors

Canonical Debian Ibm and 3 more

Products

Ubuntu Linux Debian Linux Powerkvm and 11 more

CVE-2016-5444

mysql: unspecified vulnerability in subcomponent: Server: Connection (CPU July 2016)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Connection.

CVSS 3.0 · 3.7 Low EPSS 4.3% KEV · Not listed

Vendors

Ibm Mariadb Oracle and 1 more

Products

Powerkvm Mariadb Linux and 9 more

CVE-2016-5696

kernel: challenge ACK counter information disclosure.

net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.

CVSS 3.0 · 4.8 Medium EPSS 14.5% KEV · Not listed

Vendors

Google Linux Oracle and 1 more

Products

Android Linux Kernel Vm Server and 5 more

CVE-2016-5844

libarchive: undefined behaviour (integer overflow) in iso parser

Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file.

CVSS 3.0 · 6.5 Medium EPSS 4.1% KEV · Not listed

Vendors

Libarchive Oracle Redhat

Products

Libarchive Linux Solaris and 8 more

CVE-2016-6197

kernel: overlayfs: missing upper dentry verification before unlink and rename

fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not properly verify the upper dentry before proceeding with unlink and rename system-call processing, which allows local users to cause a denial of service (system crash) via a rename system call that specifies a self-hardlink.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Oracle Redhat

Products

Linux Kernel Linux Vm Server and 2 more

CVE-2016-6198

kernel: vfs: missing detection of hardlinks in vfs_rename() on overlayfs

The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service (system crash) via a rename system call, related to fs/namei.c and fs/open.c.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Oracle Redhat

Products

Linux Kernel Linux Vm Server and 2 more

CVE-2016-6250

libarchive: Buffer overflow when writing large iso9660 containers

Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow.

CVSS 3.0 · 8.6 High EPSS 6.3% KEV · Not listed

Vendors

Libarchive Oracle Redhat

Products

Libarchive Linux Enterprise Linux

CVE-2016-6302

openssl: Insufficient TLS session ticket HMAC length checks

The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.

CVSS 3.0 · 7.5 High EPSS 27.8% KEV · Not listed

Vendors

Openssl Oracle Redhat

Products

Openssl Linux Solaris and 2 more

CVE-2016-7039

kernel: remotely triggerable unbounded recursion in the vlan gro code leading to a kernel crash

The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a related issue to CVE-2016-8666.

CVSS 3.1 · 7.5 High EPSS 7.6% KEV · Not listed

Vendors

Linux Oracle Redhat

Products

Linux Kernel Linux Vm Server and 3 more

CVE-2016-7166

libarchive: Denial of service using a crafted gzip file

libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip file.

CVSS 3.0 · 5.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Libarchive Oracle Redhat

Products

Libarchive Linux Enterprise Linux and 7 more