CVE-2014-0100

kernel: net: inet frag code race condition leading to user-after-free

Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load.

CVSS 2.0 · 9.3 Critical EPSS 3.0% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Mrg

CVE-2014-0131

kernel: net: use-after-free during segmentation with zerocopy

Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation.

CVSS 2.0 · 2.9 Low EPSS < 1% KEV · Not listed

Vendors

Linux Opensuse Suse

Products

Linux Kernel Evergreen Linux Enterprise Server

CVE-2014-0203

kernel: fs: slab corruption due to the invalid last component type during do_filp_open()

The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during use of certain filesystems, which allows local users to cause a denial of service (incorrect free operations and system crash) via an open system call.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Oracle Redhat

Products

Linux Kernel Linux Enterprise Linux

CVE-2014-0205

kernel: futex: refcount issue in case of requeue

The futex_wait function in kernel/futex.c in the Linux kernel before 2.6.37 does not properly maintain a certain reference count during requeue operations, which allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that triggers a zero count.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2014-0510

flash-plugin: use-after-free flaw leads to arbitrary code execution

Heap-based buffer overflow in Adobe Flash Player 12.0.0.77 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Zeguang Zhao and Liang Chen during a Pwn2Own competition at CanSecWest 2014.

CVSS 2.0 · 10.0 Critical EPSS 8.5% KEV · Not listed

Vendors

Adobe Redhat

Products

Flash Player Rhel Extras

CVE-2014-1525

Mozilla: Use-after-free in the Text Track Manager for HTML video (MFSA 2014-39)

The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML document.

CVSS 2.0 · 9.3 Critical EPSS 4.4% KEV · Not listed

Vendors

Canonical Fedoraproject Mozilla and 1 more

Products

Ubuntu Linux Fedora Firefox and 2 more

CVE-2014-1536

Mozilla: Use-after-free and out of bounds issues found using Address Sanitizer (MFSA 2014-49)

The PropertyProvider::FindJustificationRange function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 6.1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2014-1537

Mozilla: Use-after-free and out of bounds issues found using Address Sanitizer (MFSA 2014-49)

Use-after-free vulnerability in the mozilla::dom::workers::WorkerPrivateParent function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 4.8% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2014-1540

Mozilla: Use-after-free in Event Listener Manager (MFSA 2014-51)

Use-after-free vulnerability in the nsEventListenerManager::CompileEventHandlerInternal function in the Event Listener Manager in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.

CVSS 2.0 · 9.3 Critical EPSS 3.8% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2014-1550

Mozilla: Use-after-free in Web Audio due to incorrect control message ordering (MFSA 2014-58)

Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering.

CVSS 2.0 · 10.0 Critical EPSS 4.9% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2014-1563

Mozilla: Use-after-free during DOM interactions with SVG (MFSA 2014-68)

Use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG animation with DOM interaction that triggers incorrect cycle collection.

CVSS 2.0 · 10.0 Critical EPSS 5.8% KEV · Not listed

Vendors

Mozilla Opensuse Oracle

Products

Firefox Thunderbird Evergreen and 2 more

CVE-2014-1581

Mozilla: Use-after-free interacting with text directionality (MFSA 2014-79)

Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.

CVSS 2.0 · 7.5 High EPSS 4.1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux

CVE-2014-3190

chromium: multiple security fixes in Chrome 38.0.2125.101

Use-after-free vulnerability in the Event::currentTarget function in core/events/Event.cpp in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code that accesses the path property of an Event object.

CVSS 2.0 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Enterprise Linux Desktop Supplementary Enterprise Linux Server Supplementary and 3 more

CVE-2014-3191

chromium: multiple security fixes in Chrome 38.0.2125.101

Use-after-free vulnerability in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers a widget-position update that improperly interacts with the render tree, related to the FrameView::updateLayoutAndStyleForPainting function in core/frame/FrameView.cpp and the RenderLayerScrollableArea::setScrollOffset function in core/rendering/RenderLayerScrollableArea.cpp.

CVSS 2.0 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Enterprise Linux Desktop Supplementary Enterprise Linux Server Supplementary and 3 more

CVE-2014-3192

chromium: use-after-free in DOM, fixed in Chrome 38.0.2125.101

Use-after-free vulnerability in the ProcessingInstruction::setXSLStyleSheet function in core/dom/ProcessingInstruction.cpp in the DOM implementation in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Apple Google Redhat

Products

Iphone Os Itunes Safari and 7 more

CVE-2014-3193

chromium: multiple security fixes in Chrome 38.0.2125.101

The SessionService::GetLastSession function in browser/sessions/session_service.cc in Google Chrome before 38.0.2125.101 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors that leverage "type confusion" for callback processing.

CVSS 2.0 · 7.5 High EPSS 1.7% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Enterprise Linux Desktop Supplementary Enterprise Linux Server Supplementary and 3 more

CVE-2014-3194

chromium: use-after-free issue in Web Workers fixed in Chrome 38.0.2125.101

Use-after-free vulnerability in the Web Workers implementation in Google Chrome before 38.0.2125.101 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Enterprise Linux Desktop Supplementary Enterprise Linux Server Supplementary and 3 more

CVE-2014-3693

libreoffice: Use-After-Free in socket manager of Impress Remote

Use-after-free vulnerability in the socket manager of Impress Remote in LibreOffice 4.x before 4.2.7 and 4.3.x before 4.3.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request to TCP port 1599.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed

Vendors

Canonical Libreoffice Opensuse and 1 more

Products

Ubuntu Linux Libreoffice Opensuse and 4 more

CVE-2014-3707

curl: incorrect handle duplication after COPYPOSTFIELDS

The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.

CVSS 2.0 · 4.3 Medium EPSS 5.1% KEV · Not listed

Vendors

Apple Canonical Debian and 4 more

Products

Mac Os X Ubuntu Linux Debian Linux and 4 more

CVE-2014-4343

krb5: double-free flaw in SPNEGO initiators

Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.

CVSS 2.0 · 7.6 High EPSS 6.4% KEV · Not listed

Vendors

Debian Mit Redhat

Products

Debian Linux Kerberos 5 Enterprise Linux and 4 more