Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,296

Export CSV
CVE-2017-2636

kernel: Race condition access to n_hdlc.tbuf causes double free in n_hdlc_release()

Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline.

CVSS 3.1 · 7.0 High EPSS 1.0% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 6 more
CVE-2017-6074

kernel: use after free in dccp protocol

The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.

CVSS 3.1 · 7.8 High EPSS 6.0% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 6 more
CVE-2017-17405

ruby: Command injection vulnerability in Net::FTP

Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.

CVSS 3.0 · 8.8 High EPSS 73.8% KEV · Not listed
Vendors
Debian Redhat Ruby-lang
Products
Debian Linux Enterprise Linux Enterprise Linux Desktop and 10 more
CVE-2017-14491

dnsmasq: heap overflow in the code responsible for building DNS replies

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

CVSS 3.1 · 9.8 Critical EPSS 86.5% KEV · Not listed
Vendors
Arista Arubanetworks Canonical and 10 more
Products
Eos Arubaos Ubuntu Linux and 32 more
CVE-2017-12613

apr: Out-of-bounds array deref in apr_time_exp*() functions

When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.

CVSS 3.1 · 7.1 High EPSS 1.7% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Portable Runtime Debian Linux Enterprise Linux and 14 more
CVE-2017-10661

kernel: Handling of might_cancel queueing is not properly pretected against race

Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing.

CVSS 3.1 · 7.0 High EPSS 13.5% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 9 more
CVE-2017-1000379

kernel: Incorrectly mapped contents of PIE executable

The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected.

CVSS 3.1 · 7.8 High EPSS 1.8% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 6 more
CVE-2017-1000366

glibc: heap/stack gap jumping via unbounded stack allocations

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.

CVSS 3.0 · 7.8 High EPSS 2.7% KEV · Not listed
Vendors
Debian Gnu Mcafee and 5 more
Products
Debian Linux Glibc Web Gateway and 23 more
CVE-2017-7184

kernel: Out-of-bounds heap access in xfrm

The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52.

CVSS 3.1 · 7.8 High EPSS 1.8% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 5 more
CVE-2017-7555

augeas: Improper handling of escaped strings leading to memory corruption

Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution.

CVSS 3.0 · 9.8 Critical EPSS 5.2% KEV · Not listed
Vendors
Augeas Redhat
Products
Augeas Enterprise Linux Rhel Aus and 2 more
CVE-2017-7895

kernel: NFSv3 server does not properly handle payload bounds checking of WRITE requests

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.

CVSS 3.1 · 9.8 Critical EPSS 10.8% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 7 more
CVE-2016-9147

bind: assertion failure while handling a query response containing inconsistent DNSSEC information

named in ISC BIND 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a response containing an inconsistency among the DNSSEC-related RRsets.

CVSS 3.0 · 7.5 High EPSS 24.6% KEV · Not listed
Vendors
Isc Redhat
Products
Bind Enterprise Linux Rhel Aus and 3 more
CVE-2017-1000112

kernel: Exploitable memory corruption due to UFO to non-UFO path switch

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.

CVSS 3.1 · 7.0 High EPSS 20.8% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 5 more
CVE-2017-1000251

kernel: stack buffer overflow in the native Bluetooth stack

The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.

CVSS 3.1 · 8.0 High EPSS 16.2% KEV · Not listed
Vendors
Debian Linux Nvidia and 1 more
Products
Debian Linux Linux Kernel Jetson Tk1 and 14 more
CVE-2017-8824

kernel: Use-after-free vulnerability in DCCP socket

The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 6 more
CVE-2017-1000364

kernel: heap/stack gap jumping via unbounded stack allocations

An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010).

CVSS 3.0 · 7.4 High EPSS 5.2% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Container Development Kit Enterprise Linux and 7 more
CVE-2024-33871

ghostscript: OPVP device arbitrary code execution via custom Driver library

An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Artifex Redhat
Products
Ghostscript Enterprise Linux Rhel Aus and 4 more
CVE-2022-45405

Mozilla: Use-after-free in InputStream implementation

Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2022-45404

Mozilla: Fullscreen notification bypass

Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 5 more