Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 626

Export CSV
CVE-2017-18344

kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c

The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).

CVSS 3.0 · 5.5 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 13 more
CVE-2017-17833

openslp: Heap memory corruption in slpd/slpd_process.c allows denial of service or potentially code execution

OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability.

CVSS 3.0 · 9.8 Critical EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Lenovo and 2 more
Products
Ubuntu Linux Debian Linux Bm Nextscale Fan Power Controller and 59 more
CVE-2017-15101

liblouis: incomplete fix for CVE-2014-8184

A missing patch for a stack-based buffer overflow in findTable() was found in Red Hat version of liblouis before 2.5.4. An attacker could cause a denial of service condition or potentially even arbitrary code execution.

CVSS 3.0 · 7.8 High EPSS 1.5% KEV · Not listed
Vendors
Liblouis Redhat
Products
Liblouis Enterprise Linux Enterprise Linux Desktop and 4 more
CVE-2017-15097

postgresql: Start scripts permit database administrator to modify root-owned files

Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker with access to the postgres user account could use these flaws to obtain root access on the server machine.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Server and 5 more
CVE-2017-12173

sssd: unsanitized input when searching in local cache database

It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it.

CVSS 3.0 · 4.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Sssd Enterprise Linux Enterprise Linux Desktop and 4 more
CVE-2017-12151

samba: SMB2 connections don't keep encryption across DFS redirects

A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack.

CVSS 3.0 · 7.4 High EPSS 4.1% KEV · Not listed
Vendors
Debian Hp Redhat and 1 more
Products
Debian Linux Cifs Server Enterprise Linux and 6 more
CVE-2016-9603

Qemu: cirrus: heap buffer overflow via vnc connection

A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.

CVSS 3.0 · 5.5 Medium EPSS 4.4% KEV · Not listed
Vendors
Citrix Debian Qemu and 1 more
Products
Xenserver Debian Linux Qemu and 7 more
CVE-2016-9600

jasper: JP2 encoder NULL pointer dereference due to uninitialized cmprof_

JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Canonical Jasper Project Redhat
Products
Ubuntu Linux Jasper Enterprise Linux and 6 more
CVE-2016-9577

spice: Buffer overflow in main_channel_alloc_msg_rcv_buf when reading large messages

A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.

CVSS 3.0 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Debian Redhat Spice Project
Products
Debian Linux Enterprise Linux Enterprise Linux Desktop and 5 more
CVE-2016-9573

openjpeg: heap out-of-bounds read due to insufficient check in imagetopnm()

An out-of-bounds read vulnerability was found in OpenJPEG 2.1.2, in the j2k_to_image tool. Converting a specially crafted JPEG2000 file to another format could cause the application to crash or, potentially, disclose some data from the heap.

CVSS 3.0 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Redhat Uclouvain
Products
Debian Linux Enterprise Linux Enterprise Linux Desktop and 5 more
CVE-2016-8654

jasper: heap-based buffer overflow in QMFB code in JPC codec

A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.

CVSS 3.0 · 7.8 High EPSS 1.9% KEV · Not listed
Vendors
Debian Jasper Project Redhat
Products
Debian Linux Jasper Enterprise Linux and 5 more
CVE-2016-7035

pacemaker: Privilege escalation due to improper guarding of IPC communication

An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Clusterlabs Redhat
Products
Pacemaker Enterprise Linux Enterprise Linux Server and 1 more
CVE-2016-2125

samba: Unconditional privilege delegation to Kerberos servers in trusted realms

It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.

CVSS 3.1 · 6.5 Medium EPSS 9.2% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Server and 7 more
CVE-2015-5160

libvirt: Ceph id/key leaked in the process list

libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Enterprise Linux Enterprise Linux Desktop and 8 more
CVE-2015-3147

abrt: does not validate contents of uploaded problem reports

daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other unspecified impact via a symlink attack on (1) /var/spool/abrt or (2) /var/tmp/abrt.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Automatic Bug Reporting Tool Enterprise Linux Enterprise Linux Desktop and 5 more