Export limit exceeded: 425864 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425864 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,218

Export CSV
CVE-2018-17095

audiofile: Heap-based buffer overflow in Expand3To4Module::run() when running sfconvert

An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.

CVSS 3.1 · 8.8 High EPSS 4.7% KEV · Not listed
Vendors
Audiofile Canonical Redhat
Products
Audiofile Ubuntu Linux Enterprise Linux
CVE-2018-13440

audiofile: NULL pointer dereference in ModuleState::setup() in modules/ModuleState.cpp allows for denial of service via crafted file

The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.cpp, which allows an attacker to cause a denial of service via a crafted caf file, as demonstrated by sfconvert.

CVSS 3.0 · 6.5 Medium EPSS 3.1% KEV · Not listed
Vendors
Audiofile Canonical Redhat
Products
Audiofile Ubuntu Linux Enterprise Linux
CVE-2015-7747

audiofile: Buffer overflow when changing number of channels and sample format

Buffer overflow in the afReadFrames function in audiofile (aka libaudiofile and Audio File Library) allows user-assisted remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted audio file, as demonstrated by sixteen-stereo-to-eight-mono.c.

CVSS 3.1 · 8.8 High EPSS 8.8% KEV · Not listed
Vendors
Audiofile Canonical Fedoraproject
Products
Audiofile Ubuntu Linux Fedora
CVE-2024-36391

MileSight DeviceHub - CWE-320: Key Management Errors

MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Canonical Milesight
Products
Ubuntu Linux Devicehub
CVE-2018-7726

zziplib: Bus error in zip.c:__zzip_parse_root_directory() cause crash via crafted zip file

An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Gdraheim Redhat
Products
Ubuntu Linux Zziplib Enterprise Linux and 3 more
CVE-2018-7725

zziplib: out of bound read in mmapped.c:zzip_disk_fread() causes crash

An issue was discovered in ZZIPlib 0.13.68. An invalid memory address dereference was discovered in zzip_disk_fread in mmapped.c. The vulnerability causes an application crash, which leads to denial of service.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Gdraheim Redhat
Products
Ubuntu Linux Zziplib Enterprise Linux and 3 more
CVE-2018-6484

zziplib: Loading of misaligned memory address in zip.c:__zzip_fetch_disk_trailer can lead to a denial of service via crafted zip file

In ZZIPlib 0.13.67, there is a memory alignment error and bus error in the __zzip_fetch_disk_trailer function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.

CVSS 3.0 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Gdraheim
Products
Ubuntu Linux Zziplib
CVE-2018-6381

zziplib: Invalid memory access in the zzip_disk_fread function in zzip/mmapped.c

In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.56 there is a segmentation fault caused by invalid memory access in the zzip_disk_fread function (zzip/mmapped.c) because the size variable is not validated against the amount of file->stored data.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Gdraheim
Products
Ubuntu Linux Zziplib
CVE-2018-6540

zziplib: bus error in zzip_disk_findfirst function in zzip/mmapped.c

In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address in the zzip_disk_findfirst function of zzip/mmapped.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.

CVSS 3.0 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Gdraheim
Products
Ubuntu Linux Zziplib
CVE-2018-6541

zziplib: Bus error caused by loading of a misaligned address inzzip/zip.c

In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.

CVSS 3.0 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Gdraheim Redhat
Products
Ubuntu Linux Zziplib Enterprise Linux
CVE-2018-6869

zziplib: uncontrolled memory allocation in __zzip_parse_root_directory in zzip/zip.c

In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.

CVSS 3.0 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Gdraheim
Products
Ubuntu Linux Debian Linux Zziplib
CVE-2022-4964

pipewire: grants microphone access even when the snap interface for audio-record

Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Pipewire-pulse
CVE-2019-5747

busybox: Out of bounds read in udhcp components resulting in information disclosure

An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.

CVSS 3.1 · 7.5 High EPSS 4.7% KEV · Not listed
Vendors
Busybox Canonical
Products
Busybox Ubuntu Linux
CVE-2018-6954

systemd: Mishandled symlinks in systemd-tmpfiles allows local users to obtain ownership of arbitrary files

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Opensuse Systemd Project
Products
Ubuntu Linux Leap Systemd
CVE-2018-20679

busybox: Out of bounds read in udhcp components resulting in information disclosure

An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.

CVSS 3.1 · 7.5 High EPSS 7.7% KEV · Not listed
Vendors
Busybox Canonical
Products
Busybox Ubuntu Linux
CVE-2018-15688

Out-of-Bounds write in systemd-networkd dhcpv6 option handling

A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 7 more
CVE-2018-15687

systemd: chown_one() can dereference symlinks

A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.

CVSS 3.1 · 7.0 High EPSS 1.1% KEV · Not listed
Vendors
Canonical Systemd Project
Products
Ubuntu Linux Systemd
CVE-2018-15686

systemd: reexec state injection: fgets() on overlong lines leads to line splitting

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.

CVSS 3.1 · 7.8 High EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Oracle and 2 more
Products
Ubuntu Linux Debian Linux Communications Cloud Native Core Network Function Cloud Native Environment and 7 more