Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 612

Export CSV
CVE-2010-3861

kernel: heap contents leak from ETHTOOL_GRXCLSRLALL

The ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize a certain block of heap memory, which allows local users to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value, a different vulnerability than CVE-2010-2478.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Opensuse and 2 more
Products
Ubuntu Linux Linux Kernel Opensuse and 5 more
CVE-2010-3858

kernel: setup_arg_pages: diagnose excessive argument size

The setup_arg_pages function in fs/exec.c in the Linux kernel before 2.6.36, when CONFIG_STACK_GROWSDOWN is used, does not properly restrict the stack memory consumption of the (1) arguments and (2) environment for a 32-bit application on a 64-bit platform, which allows local users to cause a denial of service (system crash) via a crafted exec system call, a related issue to CVE-2010-2240.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 2 more
CVE-2010-3705

kernel: sctp memory corruption in HMAC handling

The sctp_auth_asoc_get_hmac function in net/sctp/auth.c in the Linux kernel before 2.6.36 does not properly validate the hmac_ids array of an SCTP peer, which allows remote attackers to cause a denial of service (memory corruption and panic) via a crafted value in the last element of this array.

CVSS 2.0 · 8.3 High EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2010-3701

MRG: remote authenticated DoS in broker

lib/MessageStoreImpl.cpp in Red Hat Enterprise MRG before 1.2.2 allows remote authenticated users to cause a denial of service (stack memory exhaustion and broker crash) via a large persistent message.

CVSS 2.0 · 4.0 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Enterprise Mrg
CVE-2010-3477

kernel: net/sched/act_police.c infoleak

The tcf_act_police_dump function in net/sched/act_police.c in the actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc4 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel memory via vectors involving a dump operation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2942.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 2 more
CVE-2010-3442

kernel: prevent heap corruption in snd_ctl_new()

Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel before 2.6.36-rc5-next-20100929 allow local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call.

CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more
CVE-2010-4655

kernel: heap contents leak for CAP_NET_ADMIN via ethtool ioctl

net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability for an ethtool ioctl call.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat and 1 more
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 2 more
CVE-2010-3432

kernel: sctp: do not reset the packet during sctp_packet_config

The sctp_packet_config function in net/sctp/output.c in the Linux kernel before 2.6.35.6 performs extraneous initializations of packet data structures, which allows remote attackers to cause a denial of service (panic) via a certain sequence of SCTP traffic.

CVSS 2.0 · 7.8 High EPSS 5.5% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 4 more
CVE-2010-3297

kernel: drivers/net/eql.c: reading uninitialized stack memory

The eql_g_master_cfg function in drivers/net/eql.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an EQL_GETMASTRCFG ioctl call.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 5 more
CVE-2010-3296

kernel: drivers/net/cxgb3/cxgb3_main.c reading uninitialized stack memory

The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 6 more
CVE-2010-3083

MRG: SSL connections to MRG broker can be blocked

sys/ssl/SslSocket.cpp in qpidd in Apache Qpid, as used in Red Hat Enterprise MRG before 1.2.2 and other products, when SSL is enabled, allows remote attackers to cause a denial of service (daemon outage) by connecting to the SSL port but not participating in an SSL handshake.

CVSS 2.0 · 4.3 Medium EPSS 4.7% KEV · Not listed
Vendors
Apache Redhat
Products
Qpid Enterprise Mrg
CVE-2010-3081

kernel: 64-bit Compatibility Mode Stack Pointer Underflow

The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.

CVSS 3.1 · 7.8 High EPSS 3.5% KEV · Not listed
Vendors
Linux Redhat Suse and 1 more
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 5 more
CVE-2010-3067

kernel: do_io_submit() infoleak

Integer overflow in the do_io_submit function in fs/aio.c in the Linux kernel before 2.6.36-rc4-next-20100915 allows local users to cause a denial of service or possibly have unspecified other impact via crafted use of the io_submit system call.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 7 more
CVE-2010-4649

kernel: IB/uverbs: Handle large number of entries in poll CQ

Integer overflow in the ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large value of a certain structure member.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Linux Desktop and 5 more
CVE-2010-2962

kernel: arbitrary kernel memory write via i915 GEM ioctl

drivers/gpu/drm/i915/i915_gem.c in the Graphics Execution Manager (GEM) in the Intel i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.36 does not properly validate pointers to blocks of memory, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via crafted use of the ioctl interface, related to (1) pwrite and (2) pread operations.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 3 more
Products
Ubuntu Linux Fedora Linux Kernel and 6 more
CVE-2010-2955

kernel: wireless: fix 64K kernel heap content leak via ioctl

The cfg80211_wext_giwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctl_standard_iw_point function in net/wireless/wext-core.c, and obtain potentially sensitive information from kernel heap memory, via vectors involving an SIOCGIWESSID ioctl call that specifies a large buffer size.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Opensuse and 2 more
Products
Ubuntu Linux Linux Kernel Opensuse and 5 more
CVE-2010-2942

kernel: net sched: fix some kernel memory leaks

The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump operations, which allows local users to obtain potentially sensitive information from kernel memory via vectors related to (1) the tcf_gact_dump function in net/sched/act_gact.c, (2) the tcf_mirred_dump function in net/sched/act_mirred.c, (3) the tcf_nat_dump function in net/sched/act_nat.c, (4) the tcf_simp_dump function in net/sched/act_simple.c, and (5) the tcf_skbedit_dump function in net/sched/act_skbedit.c.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Avaya Canonical Linux and 4 more
Products
Aura Communication Manager Aura Presence Services Aura Session Manager and 12 more
CVE-2010-2521

kernel: nfsd4: bug in read_buf

Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementation in the NFS server in the Linux kernel before 2.6.34-rc6 allow remote attackers to cause a denial of service (panic) or possibly execute arbitrary code via a crafted NFSv4 compound WRITE request, related to the read_buf and nfsd4_decode_compound functions.

CVSS 2.0 · 10.0 Critical EPSS 9.0% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2010-2248

kernel: cifs: Fix a kernel BUG with remote OS/2 server

fs/cifs/cifssmb.c in the CIFS implementation in the Linux kernel before 2.6.34-rc4 allows remote attackers to cause a denial of service (panic) via an SMB response packet with an invalid CountHigh value, as demonstrated by a response from an OS/2 server, related to the CIFSSMBWrite and CIFSSMBWrite2 functions.

CVSS 2.0 · 7.8 High EPSS 4.0% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg
CVE-2010-2240

kernel: mm: keep a guard page below a grow-down stack segment

The do_anonymous_page function in mm/memory.c in the Linux kernel before 2.6.27.52, 2.6.32.x before 2.6.32.19, 2.6.34.x before 2.6.34.4, and 2.6.35.x before 2.6.35.2 does not properly separate the stack and the heap, which allows context-dependent attackers to execute arbitrary code by writing to the bottom page of a shared memory segment, as demonstrated by a memory-exhaustion attack against the X.Org X server.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 2 more