Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,088

Export CSV
CVE-2009-1097

OpenJDK: PNG and GIF processing buffer overflow vulnerabilities (6804996, 6804997)

Multiple buffer overflows in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allow remote attackers to access files or execute arbitrary code via (1) a crafted PNG image that triggers an integer overflow during memory allocation for display on the splash screen, aka CR 6804996; and (2) a crafted GIF image from which unspecified values are used in calculation of offsets, leading to object-pointer corruption, aka CR 6804997.

CVSS 2.0 · 9.3 Critical EPSS 7.1% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 2 more
CVE-2009-1098

OpenJDK GIF processing buffer overflow vulnerability (6804998)

Buffer overflow in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access files or execute arbitrary code via a crafted GIF image, aka CR 6804998.

CVSS 2.0 · 9.3 Critical EPSS 6.8% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 3 more
CVE-2009-1101

OpenJDK JAX-WS service endpoint remote Denial-of-Service (6630639)

Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to cause a denial of service (probably resource consumption) for a JAX-WS service endpoint via a connection without any data, which triggers a file descriptor "leak."

CVSS 2.0 · 5.0 Medium EPSS 3.6% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 2 more
CVE-2009-1102

OpenJDK code generation vulnerability (6636360)

Unspecified vulnerability in the Virtual Machine in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to access files and execute arbitrary code via unknown vectors related to "code generation."

CVSS 2.0 · 6.4 Medium EPSS 4.6% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Rhel Extras Java
CVE-2009-1169

Firefox XSLT memory corruption issue

The txMozillaXSLTProcessor::TransformToDoc function in Mozilla Firefox before 3.0.8 and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XML file with a crafted XSLT transform.

CVSS 2.0 · 9.3 Critical EPSS 10.5% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Enterprise Linux
CVE-2009-1179

PDF JBIG2 integer overflow

Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file.

CVSS 2.0 · 6.8 Medium EPSS 5.5% KEV · Not listed
Vendors
Apple Foolabs Glyphandcog and 2 more
Products
Cups Xpdf Xpdfreader and 2 more
CVE-2009-1180

PDF JBIG2 invalid free()

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a free of invalid data.

CVSS 2.0 · 6.8 Medium EPSS 5.4% KEV · Not listed
Vendors
Apple Foolabs Glyphandcog and 2 more
Products
Cups Xpdf Xpdfreader and 2 more
CVE-2009-1181

PDF JBIG2 NULL dereference

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a NULL pointer dereference.

CVSS 2.0 · 4.3 Medium EPSS 3.8% KEV · Not listed
Vendors
Apple Foolabs Glyphandcog and 2 more
Products
Cups Xpdf Xpdfreader and 2 more
CVE-2009-1182

PDF JBIG2 MMR decoder buffer overflows

Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.

CVSS 2.0 · 7.5 High EPSS 7.3% KEV · Not listed
Vendors
Apple Foolabs Glyphandcog and 2 more
Products
Cups Xpdf Xpdfreader and 2 more
CVE-2009-1183

PDF JBIG2 MMR infinite loop DoS

The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted PDF file.

CVSS 2.0 · 4.3 Medium EPSS 3.8% KEV · Not listed
Vendors
Apple Foolabs Glyphandcog and 2 more
Products
Cups Xpdf Xpdfreader and 2 more
CVE-2009-1185

udev: Uncheck origin of NETLINK messages

udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.

CVSS 2.0 · 7.2 High EPSS 80.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 7 more
CVE-2009-1187

poppler CairoOutputDev integer overflow

Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to CairoOutputDev (CairoOutputDev.cc).

CVSS 2.0 · 5.0 Medium EPSS 7.2% KEV · Not listed
Vendors
Poppler Redhat
Products
Poppler Enterprise Linux
CVE-2009-1188

xpdf/poppler: SplashBitmap integer overflow

Integer overflow in the JBIG2 decoding feature in the SplashBitmap::SplashBitmap function in SplashBitmap.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.10.6, as used in GPdf and kdegraphics KPDF, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.

CVSS 2.0 · 5.0 Medium EPSS 7.2% KEV · Not listed
Vendors
Poppler Redhat
Products
Poppler Enterprise Linux
CVE-2009-1189

dbus: invalid fix for CVE-2008-3834

The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.

CVSS 2.0 · 3.6 Low EPSS 1.3% KEV · Not listed
Vendors
Freedesktop Redhat
Products
Dbus Enterprise Linux
CVE-2009-1192

kernel: agp: zero pages before sending to userspace

The (1) agp_generic_alloc_page and (2) agp_generic_alloc_pages functions in drivers/char/agp/generic.c in the agp subsystem in the Linux kernel before 2.6.30-rc3 do not zero out pages that may later be available to a user-space process, which allows local users to obtain sensitive information by reading these pages.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg
CVE-2009-1194

pango: pango_glyph_string_set_size integer overflow

Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.

CVSS 2.0 · 6.8 Medium EPSS 4.1% KEV · Not listed
Vendors
Pango Redhat
Products
Pango Enterprise Linux
CVE-2009-1195

httpd: AllowOverride Options=IncludesNoExec allows Options Includes

The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.

CVSS 2.0 · 4.9 Medium EPSS 2.0% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Enterprise Linux Jboss Enterprise Web Server
CVE-2009-1196

cups: DoS (stop, crash) by renewing CUPS browse packets

The directory-services functionality in the scheduler in CUPS 1.1.17 and 1.1.22 allows remote attackers to cause a denial of service (cupsd daemon outage or crash) via manipulations of the timing of CUPS browse packets, related to a "pointer use-after-delete flaw."

CVSS 2.0 · 5.0 Medium EPSS 2.6% KEV · Not listed
Vendors
Apple Redhat
Products
Cups Enterprise Linux
CVE-2009-1210

wireshark: format string in PROFINET dissector

Format string vulnerability in the PROFINET/DCP (PN-DCP) dissector in Wireshark 1.0.6 and earlier allows remote attackers to execute arbitrary code via a PN-DCP packet with format string specifiers in the station name. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 10.0 Critical EPSS 15.2% KEV · Not listed
Vendors
Redhat Wireshark
Products
Enterprise Linux Wireshark
CVE-2009-1252

ntp: remote arbitrary code execution vulnerability if autokeys is enabled

Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.

CVSS 2.0 · 6.8 Medium EPSS 21.3% KEV · Not listed
Vendors
Ntp Redhat
Products
Ntp Enterprise Linux Rhel Eus