CVE-2015-1805

kernel: pipe: iovec overrun leading to memory corruption

The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun."

CVSS 2.0 · 7.2 High EPSS 1.4% KEV · Not listed

Vendors

Google Linux Redhat

Products

Android Linux Kernel Enterprise Linux and 5 more

CVE-2015-3197

OpenSSL: SSLv2 doesn't block disabled ciphers

ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.

CVSS 3.0 · 5.9 Medium EPSS 10.7% KEV · Not listed

Vendors

Openssl Oracle Redhat

Products

Openssl Exalogic Infrastructure Oss Support Tools and 10 more

CVE-2015-5307

virt: guest to host DoS by triggering an infinite loop in microcode via #AC exception

The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 3 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 6 more

CVE-2015-5370

samba: crash in dcesrv_auth_bind_ack due to missing error check

Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of service (application crash or CPU consumption), or possibly execute arbitrary code on a client system via unspecified vectors.

CVSS 3.0 · 5.9 Medium EPSS 19.1% KEV · Not listed

Vendors

Canonical Redhat Samba

Products

Ubuntu Linux Enterprise Linux Rhel Aus and 4 more

CVE-2015-7181

nss: use-after-poison in sec_asn1d_parse_leaf() (MFSA 2015-133)

The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restricts access to an unspecified data structure, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data, related to a "use-after-poison" issue.

CVSS 2.0 · 7.5 High EPSS 6.9% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Network Security Services Enterprise Linux and 3 more

CVE-2015-7182

nss: ASN.1 decoder heap overflow when decoding constructed OCTET STRING that mixes indefinite and definite length encodings (MFSA 2015-133)

Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.

CVSS 3.0 · 9.8 Critical EPSS 10.2% KEV · Not listed

Vendors

Mozilla Oracle Redhat

Products

Firefox Network Security Services Glassfish Server and 8 more

CVE-2015-7183

nspr: heap-buffer overflow in PL_ARENA_ALLOCATE (MFSA 2015-133)

Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.

CVSS 2.0 · 7.5 High EPSS 6.8% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Network Security Services Enterprise Linux and 3 more

CVE-2015-7547

glibc: getaddrinfo stack-based buffer overflow

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.

CVSS 3.0 · 8.1 High EPSS 92.4% KEV · Not listed

Vendors

Canonical Debian F5 and 7 more

Products

Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 31 more

CVE-2016-0703

openssl: Divide-and-conquer session key recovery in SSLv2

The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.

CVSS 3.0 · 5.9 Medium EPSS 5.4% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Rhel Aus and 3 more

CVE-2016-0704

openssl: SSLv2 Bleichenbacher protection overwrites wrong bytes for export ciphers

An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.

CVSS 3.0 · 5.9 Medium EPSS 6.9% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Rhel Aus and 3 more

CVE-2016-0800

SSL/TLS: Cross-protocol attack on TLS using SSLv2 (DROWN)

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.

CVSS 3.0 · 5.9 Medium EPSS 82.1% KEV · Not listed

Vendors

Openssl Pulsesecure Redhat

Products

Openssl Client Steel Belted Radius and 8 more

CVE-2016-1285

bind: malformed packet sent to rndc can trigger assertion failure

named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.

CVSS 3.1 · 6.8 Medium EPSS 57.8% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 5 more

Products

Ubuntu Linux Debian Linux Fedora and 48 more

CVE-2016-1286

bind: malformed signature records for DNAME records can trigger assertion failure

named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c.

CVSS 3.1 · 8.6 High EPSS 60.8% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 5 more

Products

Ubuntu Linux Debian Linux Fedora and 48 more

CVE-2016-1950

nss: Heap buffer overflow vulnerability in ASN1 certificate parsing (MFSA 2016-35)

Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.

CVSS 3.0 · 8.8 High EPSS 4.2% KEV · Not listed

Vendors

Apple Mozilla Opensuse and 2 more

Products

Iphone Os Mac Os X Tvos and 13 more

CVE-2016-2110

samba: Man-in-the-middle attacks possible with NTLMSSP authentication

The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as demonstrated by clearing the NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN option to disrupt LDAP security.

CVSS 3.0 · 5.9 Medium EPSS 8.3% KEV · Not listed

Vendors

Canonical Redhat Samba

Products

Ubuntu Linux Enterprise Linux Rhel Aus and 5 more

CVE-2016-2111

samba: Spoofing vulnerability when domain controller is configured

The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, a related issue to CVE-2015-0005.

CVSS 3.0 · 6.3 Medium EPSS 2.9% KEV · Not listed

Vendors

Canonical Redhat Samba

Products

Ubuntu Linux Enterprise Linux Rhel Aus and 5 more

CVE-2016-2112

samba: Missing downgrade detection

The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream.

CVSS 3.0 · 5.9 Medium EPSS 9.4% KEV · Not listed

Vendors

Canonical Redhat Samba

Products

Ubuntu Linux Enterprise Linux Rhel Aus and 4 more

CVE-2016-2113

samba: Server certificates not validated at client side

Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate.

CVSS 3.0 · 7.4 High EPSS 2.7% KEV · Not listed

Vendors

Canonical Redhat Samba

Products

Ubuntu Linux Enterprise Linux Rhel Aus and 4 more

CVE-2016-2114

samba: Samba based active directory domain controller does not enforce smb signing

The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream.

CVSS 3.0 · 5.9 Medium EPSS 2.7% KEV · Not listed

Vendors

Canonical Redhat Samba

Products

Ubuntu Linux Enterprise Linux Rhel Aus and 4 more

CVE-2013-5605

nss: Null_Cipher() does not respect maxOutputLen (MFSA 2013-103)

Mozilla Network Security Services (NSS) 3.14 before 3.14.5 and 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets.

CVSS 2.0 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Mozilla Redhat

Products

Network Security Services Enterprise Linux Rhel Eus and 1 more