Export limit exceeded: 425850 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,194

Export CSV
CVE-2018-17466

firefox: Memory corruption in Angle

Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 8 more
CVE-2018-17456

git: arbitrary code execution via .gitmodules

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.

CVSS 3.0 · 9.8 Critical EPSS 97.4% KEV · Not listed
Vendors
Canonical Debian Git-scm and 1 more
Products
Ubuntu Linux Debian Linux Git and 9 more
CVE-2018-17407

texlive: Buffer overflow in t1_check_unusual_charstring function in writet1.c

An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 1 more
CVE-2018-17336

udisks: Format string vulnerability in udisks_log in udiskslogging.c

UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Freedesktop Redhat
Products
Ubuntu Linux Udisks Enterprise Linux
CVE-2018-17294

liblouis: Stack-based buffer over-read in matchCurrentInput function lou_translateString.c

The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's length, allowing attackers to cause a denial of service (application crash via out-of-bounds read) by crafting an input file with certain translation dictionaries.

CVSS 3.0 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Canonical Liblouis Opensuse
Products
Ubuntu Linux Liblouis Leap
CVE-2018-17206

openvswitch: Buffer over-read in lib/ofp-actions.c:decode_bundle()

An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6. The decode_bundle function inside lib/ofp-actions.c is affected by a buffer over-read issue during BUNDLE action decoding.

CVSS 3.1 · 4.9 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Openvswitch and 1 more
Products
Ubuntu Linux Debian Linux Openvswitch and 2 more
CVE-2018-17205

openvswitch: Error during bundle commit in ofproto/ofproto.c:ofproto_rule_insert__() allows for crash

An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c. During bundle commit, flows that are added in a bundle are applied to ofproto in order. If a flow cannot be added (e.g., the flow action is a go-to for a group id that does not exist), OvS tries to revert back all previous flows that were successfully applied from the same bundle. This is possible since OvS maintains list of old flows that were replaced by flows from the bundle. While reinserting old flows, OvS has an assertion failure due to a check on rule state != RULE_INITIALIZED. This would work for new flows, but for an old flow the rule state is RULE_REMOVED. The assertion failure causes an OvS crash.

CVSS 3.0 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Canonical Openvswitch Redhat
Products
Ubuntu Linux Openvswitch Enterprise Linux and 1 more
CVE-2018-17204

openvswitch: Mishandle of group mods in lib/ofp-util.c:parse_group_prop_ntr_selection_method() allows for assertion failure

An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c. When decoding a group mod, it validates the group type and command after the whole group mod has been decoded. The OF1.5 decoder, however, tries to use the type and command earlier, when it might still be invalid. This causes an assertion failure (via OVS_NOT_REACHED). ovs-vswitchd does not enable support for OpenFlow 1.5 by default.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Openvswitch and 1 more
Products
Ubuntu Linux Debian Linux Openvswitch and 2 more
CVE-2018-17199

httpd: mod_session_cookie does not respect expiry time

In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.

CVSS 3.0 · 7.5 High EPSS 20.0% KEV · Not listed
Vendors
Apache Canonical Debian and 3 more
Products
Http Server Ubuntu Linux Debian Linux and 6 more
CVE-2018-17189

httpd: mod_http2: DoS via slow, unneeded request bodies

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.

CVSS 3.1 · 5.3 Medium EPSS 19.4% KEV · Not listed
Vendors
Apache Canonical Debian and 4 more
Products
Http Server Ubuntu Linux Debian Linux and 11 more
CVE-2018-17183

ghostscript: User-writable error exception table

Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code.

CVSS 3.0 · 7.8 High EPSS 1.8% KEV · Not listed
Vendors
Artifex Canonical Debian and 1 more
Products
Ghostscript Ubuntu Linux Debian Linux and 7 more
CVE-2018-17182

kernel: Use-after-free in the vmacache_flush_all function resulting in a possible privilege escalation

An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations.

CVSS 3.1 · 7.8 High EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 3 more
CVE-2018-17101

libtiff: Two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c

An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.

CVSS 3.0 · 8.8 High EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Libtiff and 1 more
Products
Ubuntu Linux Debian Linux Libtiff and 1 more
CVE-2018-17100

libtiff: Integer overflow in multiply_ms in tools/ppm2tiff.c

An issue was discovered in LibTIFF 4.0.9. There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file.

CVSS 3.0 · 8.8 High EPSS 2.5% KEV · Not listed
Vendors
Canonical Debian Libtiff and 1 more
Products
Ubuntu Linux Debian Linux Libtiff and 1 more
CVE-2018-17000

libtiff: NULL pointer dereference in function _TIFFmemcmp at tif_unix.c

A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp.

CVSS 3.0 · 6.5 Medium EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Libtiff
Products
Ubuntu Linux Debian Linux Libtiff
CVE-2018-16888

systemd: kills privileged process if unprivileged PIDFile was tampered

It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Netapp Redhat and 1 more
Products
Ubuntu Linux Active Iq Performance Analytics Services Element Software and 3 more
CVE-2018-16884

kernel: nfs: use-after-free in svc_process_common()

A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.

CVSS 3.1 · 8.0 High EPSS 1.5% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 5 more
CVE-2018-16882

Kernel: KVM: nVMX: use after free in posted interrupt processing

A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before 4.14.91 and before 4.19.13 are vulnerable.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Linux
Products
Ubuntu Linux Linux Kernel
CVE-2018-16880

kernel: Out of bounds write in get_rx_bufs() function in drivers/vhost/net.c

A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Canonical Linux
Products
Ubuntu Linux Linux Kernel