CVE-2013-6672

Mozilla: Linux clipboard information disclosure though selection paste (MFSA 2013-112)

Mozilla Firefox before 26.0 and SeaMonkey before 2.23 on Linux allow user-assisted remote attackers to read clipboard data by leveraging certain middle-click paste operations.

CVSS 2.0 · 4.3 Medium EPSS 3.3% KEV · Not listed

Vendors

Canonical Fedoraproject Linux and 4 more

Products

Ubuntu Linux Fedora Linux Kernel and 7 more

CVE-2012-5833

Mozilla: Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer (MFSA 2012-106)

The texImage2D implementation in the WebGL subsystem in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 does not properly interact with Mesa drivers, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via function calls involving certain values of the level parameter.

CVSS 2.0 · 9.3 Critical EPSS 4.8% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 11 more

CVE-2012-5835

Mozilla: Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer (MFSA 2012-106)

Integer overflow in the WebGL subsystem in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (invalid write operation) via crafted data.

CVSS 2.0 · 10.0 Critical EPSS 8.5% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 11 more

CVE-2012-5838

Mozilla: Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer (MFSA 2012-106)

The copyTexImage2D implementation in the WebGL subsystem in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via large image dimensions.

CVSS 2.0 · 9.3 Critical EPSS 6.2% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Seamonkey and 6 more

CVE-2012-5839

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2012-105)

Heap-based buffer overflow in the gfxShapedWord::CompressedGlyph::IsClusterStart function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 7.0% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 11 more

CVE-2012-5840

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2012-105)

Use-after-free vulnerability in the nsTextEditorState::PrepareEditor function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-4214.

CVSS 2.0 · 9.3 Critical EPSS 6.1% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 11 more

CVE-2012-5841

Mozilla: Improper security filtering for cross-origin wrappers (MFSA 2012-100)

Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 implement cross-origin wrappers with a filtering behavior that does not properly restrict write actions, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.

CVSS 2.0 · 4.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 11 more

CVE-2012-5842

Mozilla: Miscellaneous memory safety hazards (rv:10.0.11) (MFSA 2012-91)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.8% KEV · Not listed

Vendors

Canonical Debian Mozilla and 3 more

Products

Ubuntu Linux Debian Linux Firefox and 12 more

CVE-2012-5843

Mozilla: Miscellaneous memory safety hazards (rv:17.0) (MFSA 2012-91)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 9.3 Critical EPSS 5.8% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Seamonkey and 6 more

CVE-2012-6075

qemu: e1000 driver buffer overflow when processing large packets when SBP and LPE flags are disabled

Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet.

CVSS 2.0 · 9.3 Critical EPSS 4.9% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 12 more

CVE-2013-0170

libvirt: use-after-free in virNetMessageFree()

Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue.

CVSS 2.0 · 6.8 Medium EPSS 5.8% KEV · Not listed

Vendors

Canonical Fedoraproject Opensuse and 2 more

Products

Ubuntu Linux Fedora Opensuse and 9 more

CVE-2022-31254

rmt-server-pubcloud allows to escalate from user _rmt to root

A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP 15-SP1, SUSE Manager Server 4.1; openSUSE Leap 15.3, openSUSE Leap 15.4 allows local attackers with access to the _rmt user to escalate to root. This issue affects: SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.10. SUSE Linux Enterprise Server for SAP 15-SP1 rmt-server versions prior to 2.10. SUSE Manager Server 4.1 rmt-server versions prior to 2.10. openSUSE Leap 15.3 rmt-server versions prior to 2.10. openSUSE Leap 15.4 rmt-server versions prior to 2.10.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Opensuse Suse

Products

Leap Rmt-server Linux Enterprise Server and 1 more

CVE-2023-23005

kernel: incorrect check for error case in the memory_tier_init

In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc_memory_type return value (expects it to be NULL in the error case, whereas it is actually an error pointer). NOTE: this is disputed by third parties because there are no realistic cases in which a user can cause the alloc_memory_type error case to be reached.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Suse

Products

Linux Kernel Linux Enterprise Server

CVE-2022-45153

saphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha_cluster.sls

An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created. This issue affects: SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. SUSE Linux Enterprise Server for SAP 12-SP5 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. openSUSE Leap 15.4 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Opensuse Suse

Products

Leap Linux Enterprise Module For Sap Applications Linux Enterprise Server

CVE-2022-45154

supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh

A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Opensuse Suse

Products

Supportutils Linux Enterprise Server

CVE-2017-18017

kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c

The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.

CVSS 3.1 · 9.8 Critical EPSS 52.8% KEV · Not listed

Vendors

Arista Canonical Debian and 6 more

Products

Eos Ubuntu Linux Debian Linux and 30 more

CVE-2022-31252

permissions: chkstat does not check for group-writable parent directories or target files in safeOpen()

A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the path to a privileged binary to influence path resolution. This issue affects: SUSE Linux Enterprise Server 12-SP5 permissions versions prior to 20170707. openSUSE Leap 15.3 permissions versions prior to 20200127. openSUSE Leap 15.4 permissions versions prior to 20201225. openSUSE Leap Micro 5.2 permissions versions prior to 20181225.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Opensuse Suse

Products

Leap Leap Micro Linux Enterprise Server

CVE-2022-27239

cifs-utils: stack-based buffer overflow mount.cifs may lead to local privilege escalation to root

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Hp and 3 more

Products

Debian Linux Fedora Helion Openstack and 17 more

CVE-2021-46705

grub2-once uses fixed file name in /var/tmp

A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versions prior to 2.06-150400.7.1. SUSE openSUSE Factory grub2 versions prior to 2.06-18.1.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Opensuse Suse

Products

Grub2 Factory Linux Enterprise Server

CVE-2021-45082

cobbler: incomplete template sanitization

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Cobbler Project Fedoraproject Opensuse and 1 more

Products

Cobbler Fedora Backports and 2 more