Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,194

Export CSV
CVE-2017-14495

dnsmasq: memory exhaustion vulnerability in the EDNS0 code

Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creation.

CVSS 3.0 · 7.5 High EPSS 85.4% KEV · Not listed
Vendors
Canonical Debian Novell and 2 more
Products
Ubuntu Linux Debian Linux Leap and 5 more
CVE-2014-9637

patch: local denial of service with a crafted patch

GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fault) via a crafted diff file.

CVSS 3.0 · 5.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Fedoraproject Gnu and 1 more
Products
Ubuntu Linux Fedora Patch and 1 more
CVE-2017-14493

dnsmasq: stack buffer overflow in the DHCPv6 code

Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.

CVSS 3.0 · 9.8 Critical EPSS 85.2% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Leap and 6 more
CVE-2017-14494

dnsmasq: information leak in the DHCPv6 relay code

dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests.

CVSS 3.0 · 5.9 Medium EPSS 70.5% KEV · Not listed
Vendors
Canonical Debian Novell and 2 more
Products
Ubuntu Linux Debian Linux Leap and 6 more
CVE-2017-16546

ImageMagick: Invalid memory allocation in the ReadWPGImage function

The ReadWPGImage function in coders/wpg.c in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which allows remote attackers to cause a denial of service (use of uninitialized data or invalid memory allocation) or possibly have unspecified other impact via a malformed WPG file.

CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Imagemagick
Products
Ubuntu Linux Debian Linux Imagemagick
CVE-2017-14326

ImageMagick: Memory leak in the ReadMATImage function

In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Canonical Imagemagick
Products
Ubuntu Linux Imagemagick
CVE-2017-14325

ImageMagick: Memory leak in the PersistPixelCache function

In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function PersistPixelCache in magick/cache.c, which allows attackers to cause a denial of service (memory consumption in ReadMPCImage in coders/mpc.c) via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Imagemagick
Products
Ubuntu Linux Imagemagick
CVE-2017-14228

nasm: NULL pointer dereference in the paste_tokens function

In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function paste_tokens() in preproc.c, aka a NULL pointer dereference. It will lead to remote denial of service.

CVSS 3.0 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Nasm
Products
Ubuntu Linux Netwide Assembler
CVE-2017-14342

ImageMagick: Memory exhaustion in the ReadWPGImage function

ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c via a crafted wpg image file.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Imagemagick
Products
Ubuntu Linux Imagemagick
CVE-2017-14174

ImageMagick: Lack of EOF check in the ReadPSDLayersInternal() function

In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "length" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Imagemagick
Products
Ubuntu Linux Debian Linux Imagemagick
CVE-2017-14175

ImageMagick: Lack of EOF check in the ReadXBMImage() function

In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted XBM file, which claims large rows and columns fields in the header but does not contain sufficient backing data, is provided, the loop over the rows would consume huge CPU resources, since there is no EOF check inside the loop.

CVSS 3.1 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Imagemagick
Products
Ubuntu Linux Debian Linux Imagemagick
CVE-2017-14172

ImageMagick: Lack of an EOF check in ReadPSImage() function

In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "extent" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Imagemagick
Products
Ubuntu Linux Debian Linux Imagemagick
CVE-2017-14173

ImageMagick: Integer overflow in the function ReadTXTImage()

In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Imagemagick
Products
Ubuntu Linux Debian Linux Imagemagick
CVE-2017-14176

bzr: does not strip bzr+ssh SSH options

Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.

CVSS 3.0 · 8.8 High EPSS 6.3% KEV · Not listed
Vendors
Canonical Debian
Products
Bazaar Ubuntu Linux Debian Linux