CVE-2015-4142

hostapd: integer underflow in AP mode WMM Action frame processing

Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.

CVSS 2.0 · 4.3 Medium EPSS 4.0% KEV · Not listed

Vendors

Opensuse Redhat W1.fi

Products

Opensuse Enterprise Linux Enterprise Linux Desktop and 5 more

CVE-2015-4026

php: pcntl_exec() accepts paths with NUL character

The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a crafted first argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

CVSS 2.0 · 7.5 High EPSS 18.8% KEV · Not listed

Vendors

Apple Php Redhat

Products

Mac Os X Php Enterprise Linux and 7 more

CVE-2015-4025

php: regressions in 5.4+

PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a crafted argument to (1) set_include_path, (2) tempnam, (3) rmdir, or (4) readlink. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

CVSS 2.0 · 7.5 High EPSS 17.0% KEV · Not listed

Vendors

Apple Php Redhat

Products

Mac Os X Php Enterprise Linux and 7 more

CVE-2015-4024

php: multipart/form-data request parsing CPU usage DoS

Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.

CVSS 2.0 · 5.0 Medium EPSS 41.8% KEV · Not listed

Vendors

Apple Hp Oracle and 2 more

Products

Mac Os X System Management Homepage Linux and 10 more

CVE-2015-4022

php: integer overflow leading to heap overflow when reading FTP file listing

Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.

CVSS 2.0 · 7.5 High EPSS 20.1% KEV · Not listed

Vendors

Apple Php Redhat

Products

Mac Os X Php Enterprise Linux and 7 more

CVE-2015-4021

php: memory corruption in phar_parse_tarfile caused by empty entry file name

The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.

CVSS 2.0 · 5.0 Medium EPSS 20.5% KEV · Not listed

Vendors

Apple Php Redhat

Products

Mac Os X Php Enterprise Linux and 7 more

CVE-2015-3412

php: missing null byte checks for paths in various PHP extensions

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.

CVSS 3.0 · 5.3 Medium EPSS 3.9% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Enterprise Linux Desktop and 6 more

CVE-2015-3411

php: missing null byte checks for paths in various PHP extensions

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that bypasses an intended configuration in which client users may read only .xml files.

CVSS 3.0 · 6.5 Medium EPSS 3.3% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Enterprise Linux Desktop and 6 more

CVE-2015-3330

php: pipelined request executed in deinitialized interpreter under httpd 2.4

The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter."

CVSS 2.0 · 6.8 Medium EPSS 13.5% KEV · Not listed

Vendors

Apple Oracle Php and 1 more

Products

Mac Os X Linux Solaris and 9 more

CVE-2015-3329

php: buffer overflow in phar_set_inode()

Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.

CVSS 2.0 · 7.5 High EPSS 38.2% KEV · Not listed

Vendors

Apple Oracle Php and 1 more

Products

Mac Os X Linux Solaris and 9 more

CVE-2015-3307

php: invalid pointer free() in phar_tar_process_metadata()

The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.

CVSS 2.0 · 7.5 High EPSS 6.7% KEV · Not listed

Vendors

Apple Php Redhat

Products

Mac Os X Php Enterprise Linux and 7 more

CVE-2015-3281

haproxy: information leak in buffer_slow_realign()

The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.

CVSS 2.0 · 5.0 Medium EPSS 4.3% KEV · Not listed

Vendors

Canonical Debian Haproxy and 3 more

Products

Ubuntu Linux Debian Linux Haproxy and 11 more

CVE-2015-3276

openldap: incorrect multi-keyword mode cipherstring parsing

The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

CVSS 3.1 · 7.5 High EPSS 5.3% KEV · Not listed

Vendors

Openldap Oracle Redhat

Products

Openldap Linux Enterprise Linux and 7 more

CVE-2015-3247

spice: memory corruption in worker_update_monitors_config()

Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.

CVSS 2.0 · 6.9 Medium EPSS 1.1% KEV · Not listed

Vendors

Redhat Spice Project

Products

Enterprise Linux Enterprise Linux Desktop Enterprise Linux Hpc Node and 3 more

CVE-2015-3214

qemu/kvm: i8254: out-of-bounds memory access in pit_ioport_read function

The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.

CVSS 2.0 · 6.9 Medium EPSS 1.6% KEV · Not listed

Vendors

Arista Debian Lenovo and 3 more

Products

Eos Debian Linux Emc Px12-400r Ivx and 17 more

CVE-2015-3209

qemu: pcnet: multi-tmd buffer overflow in the tx path

Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.

CVSS 2.0 · 7.5 High EPSS 9.7% KEV · Not listed

Vendors

Arista Canonical Debian and 5 more

Products

Eos Ubuntu Linux Debian Linux and 17 more

CVE-2015-3196

OpenSSL: Race condition handling PSK identify hint

ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.

CVSS 2.0 · 4.3 Medium EPSS 13.5% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 12 more

CVE-2015-3195

OpenSSL: X509_ATTRIBUTE memory leak

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

CVSS 3.1 · 5.3 Medium EPSS 38.7% KEV · Not listed

Vendors

Apple Canonical Debian and 6 more

Products

Mac Os X Ubuntu Linux Debian Linux and 25 more

CVE-2015-3152

mysql: use of SSL/TLS can not be enforced in mysql client library (oCERT-2015-003, BACKRONYM)

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.

CVSS 3.1 · 5.9 Medium EPSS 7.1% KEV · Not listed

Vendors

Debian Fedoraproject Mariadb and 3 more

Products

Debian Linux Fedora Mariadb and 11 more

CVE-2015-3044

flash-plugin: security bypass leading to information disclosure (APSB15-06)

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 9.4% KEV · Not listed

Vendors

Adobe Apple Linux and 4 more

Products

Flash Player Mac Os X Linux Kernel and 10 more