Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,351

Export CSV
CVE-2018-1125

procps: stack buffer overflow in pgrep

procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Canonical Debian Opensuse and 1 more
Products
Ubuntu Linux Debian Linux Leap and 1 more
CVE-2018-15473

openssh: User enumeration via malformed packets in authentication requests

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

CVSS 3.1 · 5.9 Medium EPSS 98.7% KEV · Not listed
Vendors
Canonical Debian Netapp and 4 more
Products
Ubuntu Linux Debian Linux Aff Baseboard Management Controller and 22 more
CVE-2016-1762

libxml2: Heap-based buffer-overread in xmlNextChar

The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

CVSS 3.1 · 8.1 High EPSS 6.1% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Safari and 14 more
CVE-2017-7526

libgcrypt: Use of left-to-right sliding window method allows full RSA key recovery

libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.

CVSS 3.0 · 6.1 Medium EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Gnupg
Products
Ubuntu Linux Debian Linux Libgcrypt
CVE-2018-1123

procps: denial of service in ps via mmap buffer overflow

procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).

CVSS 3.0 · 3.9 Low EPSS 8.7% KEV · Not listed
Vendors
Canonical Debian Procps-ng Project
Products
Ubuntu Linux Debian Linux Procps-ng
CVE-2018-1126

procps: incorrect integer size in proc/alloc.* leading to truncation / integer overflow issues

procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.

CVSS 3.0 · 4.8 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Procps-ng Project and 2 more
Products
Ubuntu Linux Debian Linux Procps-ng and 10 more
CVE-2025-5467

Ubuntu Apport Insecure File Permissions Vulnerability

It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.

CVSS 4.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Apport Ubuntu
CVE-2025-54293

Path Traversal in LXD Instance Log File Retrieval

Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Canonical Linux
Products
Lxd Linux Linux Kernel
CVE-2025-54292

Client-Side Path Traversal in LXD-UI

Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Lxd
CVE-2016-1834

libxml2: Heap-buffer-overflow in xmlStrncat

Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.

CVSS 3.1 · 7.8 High EPSS 4.6% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Tvos and 13 more
CVE-2016-9842

zlib: Undefined left shift of negative number

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

CVSS 3.1 · 8.8 High EPSS 5.2% KEV · Not listed
Vendors
Apple Canonical Debian and 5 more
Products
Iphone Os Mac Os X Tvos and 19 more
CVE-2016-3627

libxml2: stack exhaustion while parsing xml files in recovery mode

The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document.

CVSS 3.1 · 7.5 High EPSS 7.0% KEV · Not listed
Vendors
Canonical Debian Hp and 4 more
Products
Ubuntu Linux Debian Linux Icewall Federation Agent and 12 more
CVE-2017-9022

strongswan: Insufficient validation of RSA public keys passed to the gmp plugin

The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers to cause a denial of service (floating point exception and process crash) via a crafted certificate.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Strongswan
Products
Ubuntu Linux Debian Linux Strongswan
CVE-2017-6519

avahi: Multicast DNS responds to unicast queries outside of local network

avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service (traffic amplification) and may cause information leakage by obtaining potentially sensitive information from the responding device via port-5353 UDP packets. NOTE: this may overlap CVE-2015-2809.

CVSS 3.1 · 9.1 Critical EPSS 3.2% KEV · Not listed
Vendors
Avahi Canonical Redhat
Products
Avahi Ubuntu Linux Enterprise Linux
CVE-2018-16152

strongswan: authentication bypass in verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c

In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. This is a variant of CVE-2006-4790 and CVE-2014-1568.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Strongswan
Products
Ubuntu Linux Debian Linux Strongswan
CVE-2018-16151

strongswan: authentication bypass in verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c

In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data after the encoded algorithm OID during PKCS#1 v1.5 signature verification. Similar to the flaw in the same version of strongSwan regarding digestAlgorithm.parameters, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Strongswan
Products
Ubuntu Linux Debian Linux Strongswan
CVE-2018-11574

ppp: Remote client crash in ppp EAP-TLS patch

Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authentication bypass. This implementation is distributed as a patch for PPPD 0.91, and includes the affected eap.c and eap-tls.c files. Configurations that use the `refuse-app` option are unaffected.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed
Vendors
Canonical Point-to-point Protocol Project
Products
Ubuntu Linux Point-to-point Protocol
CVE-2019-15165

libpcap: Resource exhaustion during PHB header length validation

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.

CVSS 3.1 · 5.3 Medium EPSS 2.8% KEV · Not listed
Vendors
Apple Canonical Debian and 5 more
Products
Ipados Iphone Os Mac Os X and 9 more