CVE-2016-0600

mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

CVSS 2.0 · 3.5 Low EPSS 3.9% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0598

mysql: unspecified vulnerability in subcomponent: Server: DML (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML.

CVSS 2.0 · 3.5 Low EPSS 3.9% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0597

mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 4.3% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0596

mysql: unspecified vulnerability in subcomponent: Server: DML (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML.

CVSS 2.0 · 4.0 Medium EPSS 4.3% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0546

mysql: unspecified vulnerability in subcomponent: Client (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that these are multiple buffer overflows in the mysqlshow tool that allow remote database servers to have unspecified impact via a long table or database name.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0505

mysql: unspecified vulnerability in subcomponent: Server: Options (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Options.

CVSS 2.0 · 6.8 Medium EPSS 7.5% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2015-8631

krb5: Memory leak caused by supplying a null principal name in request

Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name.

CVSS 3.1 · 6.5 Medium EPSS 4.7% KEV · Not listed

Vendors

Debian Mit Opensuse and 2 more

Products

Debian Linux Kerberos 5 Leap and 9 more

CVE-2015-8629

krb5: xdr_nullstring() doesn't check for terminating null character

The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.

CVSS 3.1 · 5.3 Medium EPSS 3.7% KEV · Not listed

Vendors

Debian Mit Opensuse and 2 more

Products

Debian Linux Kerberos 5 Leap and 10 more

CVE-2015-8391

pcre: inefficient posix character class syntax check (8.38/16)

The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 3.1 · 9.8 Critical EPSS 6.4% KEV · Not listed

Vendors

Fedoraproject Oracle Pcre and 2 more

Products

Fedora Linux Pcre and 9 more

CVE-2015-7547

glibc: getaddrinfo stack-based buffer overflow

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.

CVSS 3.0 · 8.1 High EPSS 92.4% KEV · Not listed

Vendors

Canonical Debian F5 and 7 more

Products

Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 31 more

CVE-2015-5366

kernel: net: incorrect processing of checksums in UDP implementation

The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN return values, which allows remote attackers to cause a denial of service (EPOLLET epoll application read outage) via an incorrect checksum in a UDP packet, a different vulnerability than CVE-2015-5364.

CVSS 2.0 · 5.0 Medium EPSS 6.1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Linux Server Aus and 4 more

CVE-2015-5364

kernel: net: incorrect processing of checksums in UDP implementation

The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood.

CVSS 2.0 · 7.8 High EPSS 6.1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 6 more

CVE-2015-5229

glibc: calloc may return non-zero memory

The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors.

CVSS 3.0 · 7.5 High EPSS 2.2% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Desktop Enterprise Linux Hpc Node and 5 more

CVE-2015-5165

Qemu: rtl8139 uninitialized heap memory information leakage to guest (XSA-140)

The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 13.3% KEV · Not listed

Vendors

Arista Debian Fedoraproject and 4 more

Products

Eos Debian Linux Fedora and 22 more

CVE-2015-4913

mysql: unspecified vulnerability related to Server:DML (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858.

CVSS 2.0 · 3.5 Low EPSS 3.5% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 14 more

CVE-2015-4879

mysql: unspecified vulnerability related to Server:DML (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to DML.

CVSS 2.0 · 4.6 Medium EPSS 4.2% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 12 more

CVE-2015-4870

mysql: unspecified vulnerability related to Server:Parser (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser.

CVSS 2.0 · 4.0 Medium EPSS 30.1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 14 more

CVE-2015-4864

mysql: unspecified vulnerability related to Server:Security:Privileges (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges.

CVSS 2.0 · 3.5 Low EPSS 2.4% KEV · Not listed

Vendors

Canonical Mariadb Oracle and 1 more

Products

Ubuntu Linux Mariadb Mysql and 9 more

CVE-2015-4861

mysql: unspecified vulnerability related to Server:InnoDB (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.

CVSS 2.0 · 3.5 Low EPSS 3.5% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 14 more

CVE-2019-6470

dhcpd: use-after-free error leads crash in IPv6 mode when using mismatched BIND libraries

There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All releases of dhcpd from ISC contain copies of this, and other, BIND libraries in combinations that have been tested prior to release and are known to not present issues like this. Some third-party packagers of ISC software have modified the dhcpd source, BIND source, or version matchup in ways that create the crash potential. Based on reports available to ISC, the crash probability is large and no analysis has been done on how, or even if, the probability can be manipulated by an attacker. Affects: Builds of dhcpd versions prior to version 4.4.1 when using BIND versions 9.11.2 or later, or BIND versions with specific bug fixes backported to them. ISC does not have access to comprehensive version lists for all repackagings of dhcpd that are vulnerable. In particular, builds from other vendors may also be affected. Operators are advised to consult their vendor documentation.

CVSS 3.1 · 6.5 Medium EPSS 8.8% KEV · Not listed

Vendors

Isc Opensuse Redhat

Products

Dhcpd Leap Enterprise Linux and 16 more