Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,088

Export CSV
CVE-2009-2694

pidgin: insufficient input validation in msn_slplink_process_msg()

The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.

CVSS 2.0 · 10.0 Critical EPSS 20.3% KEV · Not listed
Vendors
Adium Pidgin Redhat
Products
Adium Pidgin Enterprise Linux
CVE-2009-2695

kernel: SELinux and mmap_min_addr

The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2009-2697

gdm not built with tcp_wrappers

The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat Enterprise Linux (RHEL) 5 omits TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions via XDMCP connections, a different vulnerability than CVE-2007-5079.

CVSS 2.0 · 6.8 Medium EPSS 1.8% KEV · Not listed
Vendors
Gnome Redhat
Products
Gdm Enterprise Linux
CVE-2009-2698

kernel: udp socket NULL ptr dereference

The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.

CVSS 3.1 · 7.8 High EPSS 7.1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 3 more
Products
Ubuntu Linux Fedora Linux Kernel and 11 more
CVE-2009-2703

Pidgin: NULL pointer dereference by handling IRC topic(s) (DoS)

libpurple/protocols/irc/msgs.c in the IRC protocol plugin in libpurple in Pidgin before 2.6.2 allows remote IRC servers to cause a denial of service (NULL pointer dereference and application crash) via a TOPIC message that lacks a topic string.

CVSS 2.0 · 5.0 Medium EPSS 1.9% KEV · Not listed
Vendors
Pidgin Redhat
Products
Libpurple Pidgin Enterprise Linux
CVE-2009-2730

gnutls: incorrect verification of SSL certificate with NUL in name (GNUTLS-SA-2009-4)

libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

CVSS 2.0 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Gnu Redhat
Products
Gnutls Enterprise Linux
CVE-2009-2813

Samba: Share restriction bypass via home-less directory user account(s)

Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances involving user accounts that lack home directories.

CVSS 2.0 · 6.0 Medium EPSS 2.7% KEV · Not listed
Vendors
Apple Fedoraproject Redhat and 1 more
Products
Mac Os X Mac Os X Server Fedora and 3 more
CVE-2009-2820

cups: Several XSS flaws in forms processed by CUPS web interface

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.

CVSS 2.0 · 4.3 Medium EPSS 5.8% KEV · Not listed
Vendors
Apple Redhat
Products
Mac Os X Mac Os X Server Enterprise Linux
CVE-2009-2847

kernel: information leak in sigaltstack

The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not clear certain padding bytes from a structure, which allows local users to obtain sensitive information from the kernel stack via the sigaltstack function.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Kernel Linux Linux Kernel and 3 more
CVE-2009-2848

kernel: execve: must clear current->clear_child_tid

The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.

CVSS 2.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 5 more
Products
Ubuntu Linux Fedora Linux Kernel and 12 more
CVE-2009-2849

kernel: md: NULL pointer deref when accessing suspend_* sysfs attributes

The md driver (drivers/md/md.c) in the Linux kernel before 2.6.30.2 might allow local users to cause a denial of service (NULL pointer dereference) via vectors related to "suspend_* sysfs attributes" and the (1) suspend_lo_store or (2) suspend_hi_store functions. NOTE: this is only a vulnerability when sysfs is writable by an attacker.

CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg
CVE-2009-2855

squid: DoS (100% CPU use) while processing certain external ACL helper HTTP headers

The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.

CVSS 2.0 · 5.0 Medium EPSS 34.0% KEV · Not listed
Vendors
Redhat Squid-cache
Products
Enterprise Linux Squid
CVE-2009-2904

openssh: possible privilege escalation when using ChrootDirectory setting

A certain Red Hat modification to the ChrootDirectory feature in OpenSSH 4.8, as used in sshd in OpenSSH 4.3 in Red Hat Enterprise Linux (RHEL) 5.4 and Fedora 11, allows local users to gain privileges via hard links to setuid programs that use configuration files within the chroot directory, related to requirements for directory ownership.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Openbsd Redhat
Products
Fedora Openssh Enterprise Linux and 2 more
CVE-2009-2905

newt: heap-overflow in textbox when text reflowing

Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to cause a denial of service (application crash) or possibly execute arbitrary code via a request to display a crafted text dialog box.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Fedorahosted Redhat
Products
Newt Enterprise Linux
CVE-2009-2906

samba: infinite loop flaw in smbd on unexpected oplock break notification reply

smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break notification reply packet.

CVSS 2.0 · 4.0 Medium EPSS 4.2% KEV · Not listed
Vendors
Canonical Redhat Samba
Products
Ubuntu Linux Enterprise Linux Rhel Extras and 1 more
CVE-2009-2908

kernel ecryptfs NULL pointer dereference

The d_delete function in fs/ecryptfs/inode.c in eCryptfs in the Linux kernel 2.6.31 allows local users to cause a denial of service (kernel OOPS) and possibly execute arbitrary code via unspecified vectors that cause a "negative dentry" and trigger a NULL pointer dereference, as demonstrated via a Mutt temporary directory in an eCryptfs mount.

CVSS 2.0 · 4.9 Medium EPSS 1.2% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2009-2910

kernel: x86_64 32 bit process register leak

arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.31.4 on the x86_64 platform does not clear certain kernel registers before a return to user mode, which allows local users to read register values from an earlier process by switching an ia32 process to 64-bit mode.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 3 more
Products
Ubuntu Linux Fedora Linux Kernel and 12 more
CVE-2009-2948

samba: information disclosure in suid mount.cifs

mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Rhel Extras Samba
CVE-2009-2957

dnsmasq: multiple vulnerabilities in TFTP server

Heap-based buffer overflow in the tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read (aka RRQ) request.

CVSS 2.0 · 6.8 Medium EPSS 15.3% KEV · Not listed
Vendors
Redhat Thekelleys
Products
Enterprise Linux Dnsmasq
CVE-2009-2958

dnsmasq: multiple vulnerabilities in TFTP server

The tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a TFTP read (aka RRQ) request with a malformed blksize option.

CVSS 2.0 · 4.3 Medium EPSS 10.4% KEV · Not listed
Vendors
Redhat Thekelleys
Products
Enterprise Linux Dnsmasq