CVE-2011-1493

kernel: multiple issues in rose protocol

Array index error in the rose_parse_national function in net/rose/rose_subr.c in the Linux kernel before 2.6.39 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by composing FAC_NATIONAL_DIGIS data that specifies a large number of digipeaters, and then sending this data to a ROSE socket.

CVSS 2.0 · 7.5 High EPSS 3.3% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2012-0029

qemu: e1000: process_tx_desc legacy mode packets heap overflow

Heap-based buffer overflow in the process_tx_desc function in the e1000 emulation (hw/e1000.c) in qemu-kvm 0.12, and possibly other versions, allows guest OS users to cause a denial of service (QEMU crash) and possibly execute arbitrary code via crafted legacy mode packets.

CVSS 2.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Kvm Group Redhat

Products

Qemu-kvm Enterprise Linux Rhel Virtualization

CVE-2013-4164

ruby: heap overflow in floating point parsing

Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.

CVSS 2.0 · 6.8 Medium EPSS 35.0% KEV · Not listed

Vendors

Redhat Ruby-lang

Products

Cloudforms Managementengine Enterprise Linux Openstack and 3 more

CVE-2010-0407

pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages

Multiple buffer overflows in the MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 allow local users to gain privileges via crafted message data, which is improperly demarshalled.

CVSS 2.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Muscle Redhat

Products

Pcsc-lite Certificate System Enterprise Linux

CVE-2010-2063

samba: memory corruption vulnerability

Buffer overflow in the SMB1 packet chaining implementation in the chain_reply function in process.c in smbd in Samba 3.0.x before 3.3.13 allows remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted field in a packet.

CVSS 2.0 · 7.5 High EPSS 78.6% KEV · Not listed

Vendors

Canonical Debian Redhat and 1 more

Products

Ubuntu Linux Debian Linux Enterprise Linux and 2 more

CVE-2010-3084

kernel: niu: buffer overflow for ETHTOOL_GRXCLSRLALL

Buffer overflow in the niu_get_ethtool_tcam_all function in drivers/net/niu.c in the Linux kernel before 2.6.36-rc4 allows local users to cause a denial of service or possibly have unspecified other impact via the ETHTOOL_GRXCLSRLALL ethtool command.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Redhat

Products

Ubuntu Linux Linux Kernel Enterprise Linux

CVE-2013-4348

kernel: net: deadloop path in skb_flow_dissect()

The skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel through 3.12 allows remote attackers to cause a denial of service (infinite loop) via a small value in the IHL field of a packet with IPIP encapsulation.

CVSS 2.0 · 7.1 High EPSS 9.7% KEV · Not listed

Vendors

Canonical Linux Redhat

Products

Ubuntu Linux Linux Kernel Enterprise Mrg

CVE-2012-2336

php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h

sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.

CVSS 2.0 · 5.0 Medium EPSS 52.1% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux

CVE-2011-4913

kernel: multiple issues in rose protocol

The rose_parse_ccitt function in net/rose/rose_subr.c in the Linux kernel before 2.6.39 does not validate the FAC_CCITT_DEST_NSAP and FAC_CCITT_SRC_NSAP fields, which allows remote attackers to (1) cause a denial of service (integer underflow, heap memory corruption, and panic) via a small length value in data sent to a ROSE socket, or (2) conduct stack-based buffer overflow attacks via a large length value in data sent to a ROSE socket.

CVSS 2.0 · 7.8 High EPSS 4.1% KEV · Not listed

Vendors

Linux Novell

Products

Linux Kernel Suse Linux Enterprise Server

CVE-2011-4914

kernel: multiple issues in rose protocol

The ROSE protocol implementation in the Linux kernel before 2.6.39 does not verify that certain data-length values are consistent with the amount of data sent, which might allow remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) via crafted data to a ROSE socket.

CVSS 2.0 · 6.4 Medium EPSS 8.7% KEV · Not listed

Vendors

Linux Novell

Products

Linux Kernel Suse Linux Enterprise Server

CVE-2012-0060

rpm: insufficient validation of region tags

RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a package header to the (1) headerLoad, (2) rpmReadSignature, or (3) headerVerify function.

CVSS 2.0 · 6.8 Medium EPSS 4.7% KEV · Not listed

Vendors

Redhat Rpm

Products

Enterprise Linux Rhel Els Rhel Eus and 2 more

CVE-2012-0061

rpm: improper validation of header contents total size in headerLoad()

The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large region size in a package header.

CVSS 2.0 · 6.8 Medium EPSS 4.7% KEV · Not listed

Vendors

Redhat Rpm

Products

Enterprise Linux Rhel Els Rhel Eus and 2 more

CVE-2012-0830

php: remote code exec flaw introduced in the CVE-2011-4885 hashdos fix

The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885.

CVSS 2.0 · 7.5 High EPSS 29.8% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux

CVE-2012-1182

samba: Multiple heap-based buffer overflows in memory management based on NDR marshalling code output

The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call.

CVSS 2.0 · 10.0 Critical EPSS 74.4% KEV · Not listed

Vendors

Redhat Samba

Products

Enterprise Linux Rhel Els Rhel Eus and 2 more

CVE-2012-2136

kernel: net: insufficient data_len validation in sock_alloc_send_pskb()

The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel before 3.4.5 does not properly validate a certain length value, which allows local users to cause a denial of service (heap-based buffer overflow and system crash) or possibly gain privileges by leveraging access to a TUN/TAP device.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus

CVE-2012-2744

kernel: netfilter: null pointer dereference in nf_ct_frag6_reasm()

net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6 module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets.

CVSS 2.0 · 7.8 High EPSS 4.5% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus

CVE-2009-4901

pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages

The MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 might allow local users to cause a denial of service (daemon crash) via crafted SCARD_SET_ATTRIB message data, which is improperly demarshalled and triggers a buffer over-read, a related issue to CVE-2010-0407.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Muscle Redhat

Products

Pcsc-lite Certificate System Enterprise Linux

CVE-2010-1173

kernel: sctp: crash due to malformed SCTPChunkInit packet

The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data.

CVSS 2.0 · 7.1 High EPSS 21.2% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg

CVE-2010-2492

kernel: ecryptfs_uid_hash() buffer overflow

Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Avaya Linux Redhat and 1 more

Products

Aura Communication Manager Aura Presence Services Aura Session Manager and 7 more

CVE-2010-2520

freetype: heap buffer overflow vulnerability in truetype bytecode support

Heap-based buffer overflow in the Ins_IUP function in truetype/ttinterp.c in FreeType before 2.4.0, when TrueType bytecode support is enabled, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.

CVSS 2.0 · 5.1 Medium EPSS 5.7% KEV · Not listed

Vendors

Apple Canonical Debian and 1 more

Products

Mac Os X Ubuntu Linux Debian Linux and 1 more