Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 626

Export CSV
CVE-2018-1087

Kernel: KVM: error in exception handling leads to wrong debug stack value

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.

CVSS 3.0 · 8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 13 more
CVE-2018-1086

pcs: Debug parameter removal bypass, allowing information disclosure

pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege.

CVSS 3.0 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Clusterlabs Debian Redhat
Products
Pacemaker Command Line Interface Debian Linux Enterprise Linux and 1 more
CVE-2018-1068

kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c

A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 14 more
CVE-2018-1049

systemd: automount: access to automounted volumes can lock up

In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted.

CVSS 3.1 · 5.9 Medium EPSS 7.4% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 8 more
CVE-2018-19475

ghostscript: access bypass in psi/zdevice2.c (700153)

psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same.

CVSS 3.0 · 7.8 High EPSS 9.5% KEV · Not listed
Vendors
Artifex Canonical Debian and 1 more
Products
Ghostscript Ubuntu Linux Debian Linux and 8 more
CVE-2018-19409

ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c

An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used.

CVSS 3.0 · 9.8 Critical EPSS 7.8% KEV · Not listed
Vendors
Artifex Canonical Debian and 1 more
Products
Ghostscript Ubuntu Linux Debian Linux and 6 more
CVE-2018-19134

ghostscript: Type confusion in setpattern (700141)

In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.

CVSS 3.0 · 7.8 High EPSS 2.8% KEV · Not listed
Vendors
Artifex Debian Redhat
Products
Ghostscript Debian Linux Enterprise Linux and 5 more
CVE-2018-19115

keepalived: Heap-based buffer overflow when parsing HTTP status codes allows for denial of service or possibly arbitrary code execution

keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extract_status_code in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap.

CVSS 3.0 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Debian Keepalived Redhat
Products
Debian Linux Keepalived Enterprise Linux and 6 more
CVE-2018-18559

kernel: Use-after-free due to race condition in AF_PACKET implementation

In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control.

CVSS 3.1 · 8.1 High EPSS 2.6% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Linux Desktop and 13 more
CVE-2018-18506

Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied

When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server. This behavior is disallowed by default when a proxy is manually configured, but when enabled could allow for attacks on services and tools that bind to the localhost for networked behavior if they are accessed through browsing. This vulnerability affects Firefox < 65.

CVSS 3.1 · 5.9 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Mozilla and 2 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more
CVE-2018-18501

Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5

Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65.

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 8 more
CVE-2018-18500

Mozilla: Use-after-free parsing HTML5 stream

A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being freed while still in use, leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65.

CVSS 3.0 · 9.8 Critical EPSS 12.7% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more
CVE-2018-18498

Mozilla: Integer overflow when calculating buffer sizes for images

A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This leads to a possible out-of-bounds write. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.

CVSS 3.0 · 9.8 Critical EPSS 4.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more
CVE-2018-18445

kernel: Faulty computation of numberic bounds in the BPF verifier

In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 7 more
CVE-2018-18397

kernel: userfaultfd bypasses tmpfs file permissions

The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 9 more
CVE-2018-18356

mozilla: Use after free in Skia

An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 3.3% KEV · Not listed
Vendors
Canonical Debian Google and 2 more
Products
Ubuntu Linux Debian Linux Chrome and 9 more
CVE-2018-18073

ghostscript: Saved execution stacks can leak operator arrays

Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object.

CVSS 3.1 · 6.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Artifex Canonical Debian and 1 more
Products
Ghostscript Ubuntu Linux Debian Linux and 7 more