Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,218

Export CSV
CVE-2018-14629

samba: Unprivileged adding of CNAME record causing loop in AD LDAP server

A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead to infinite recursion in the server. An unprivileged local attacker could create such an entry, leading to denial of service.

CVSS 3.0 · 6.5 Medium EPSS 5.2% KEV · Not listed
Vendors
Canonical Debian Samba
Products
Ubuntu Linux Debian Linux Samba
CVE-2018-14625

kernel: use-after-free Read in vhost_transport_send_pkt

A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt AF_VSOCK messages destined to other clients.

CVSS 3.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 2 more
CVE-2018-14622

libtirpc: Segmentation fault in makefd_xprt return value in svc_vc.c

A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections.

CVSS 3.1 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Libtirpc Project and 1 more
Products
Ubuntu Linux Debian Linux Libtirpc and 5 more
CVE-2018-14617

kernel: NULL pointer dereference in fs/hfsplus/dir.c:hfsplus_lookup() when operating on a file in a crafted hfs+ image

An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory.

CVSS 3.0 · 5.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Canonical Debian Linux
Products
Ubuntu Linux Debian Linux Linux Kernel
CVE-2018-14609

kernel: Invalid pointer dereference in fs/btrfs/relocation.c:__del_reloc_root() when mounting crafted btrfs image

An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in __del_reloc_root() in fs/btrfs/relocation.c when mounting a crafted btrfs image, related to removing reloc rb_trees when reloc control has not been initialized.

CVSS 3.0 · 5.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Canonical Debian Linux
Products
Ubuntu Linux Debian Linux Linux Kernel
CVE-2018-14600

libX11: Out of Bounds write in XListExtensions in ListExt.c

An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution.

CVSS 3.1 · 8.1 High EPSS 9.2% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 1 more
CVE-2018-14599

libX11: Off-by-one error in XListExtensions in ListExt.c

An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact.

CVSS 3.1 · 9.8 Critical EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2018-14598

libX11: Crash on invalid reply in XListExtensions in ListExt.c

An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault).

CVSS 3.0 · 7.5 High EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 2 more
CVE-2018-14553

gd: NULL pointer dereference in gdImageClone

gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).

CVSS 3.1 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2018-14551

ImageMagick: Uninitialized variable in coders/mat.c:ReadMATImageV4() allows for memory corruption

The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption.

CVSS 3.0 · 9.8 Critical EPSS 4.0% KEV · Not listed
Vendors
Canonical Imagemagick
Products
Ubuntu Linux Imagemagick
CVE-2018-14526

wpa_supplicant: Unauthenticated EAPOL-Key decryption in wpa_supplicant

An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive information.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 1 more
CVE-2018-14362

mutt: POP body caching path traversal vulnerability

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cache pathnames, as demonstrated by a '/' character.

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Canonical Debian Mutt and 2 more
Products
Ubuntu Linux Debian Linux Mutt and 8 more
CVE-2018-14358

mutt: stack-based buffer overflow in imap/message.c

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long RFC822.SIZE field.

CVSS 3.1 · 9.8 Critical EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Mutt and 1 more
Products
Ubuntu Linux Debian Linux Mutt and 1 more
CVE-2018-14357

mutt: Remote Code Execution via backquote characters

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription.

CVSS 3.1 · 9.8 Critical EPSS 5.0% KEV · Not listed
Vendors
Canonical Debian Mutt and 2 more
Products
Ubuntu Linux Debian Linux Mutt and 8 more