Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,351

Export CSV
CVE-2017-15281

ImageMagick: Conditional statement depends on unitialized value

ReadPSDImage in coders/psd.c in ImageMagick 7.0.7-6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to "Conditional jump or move depends on uninitialised value(s)."

CVSS 3.0 · 8.8 High EPSS 2.7% KEV · Not listed
Vendors
Canonical Imagemagick
Products
Ubuntu Linux Imagemagick
CVE-2017-15115

kernel: use-after-free in sctp_cmp_addr_exact

The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 1 more
CVE-2017-15298

git: Mishandling layers of tree objects

Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service (memory consumption) via a crafted repository, aka a Git bomb. This can also have an impact of disk consumption; however, an affected process typically would not survive its attempt to build the data structure in memory before writing to disk.

CVSS 3.0 · 5.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Canonical Git-scm
Products
Ubuntu Linux Git
CVE-2017-15102

kernel: NULL pointer dereference due to race condition in probe function of legousbtower driver

The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.

CVSS 3.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux
CVE-2017-14859

exiv2: Invalid memory address dereference in Exiv2::StringValueBase::read

An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian Exiv2
Products
Ubuntu Linux Debian Linux Exiv2
CVE-2017-14862

exiv2: Invalid memory address dereference in the Exiv2::DataValue::read

An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian Exiv2
Products
Ubuntu Linux Debian Linux Exiv2
CVE-2017-14632

libvorbis: Invalid freeing of uninitialized memory in the function vorbis_analysis_headerout()

Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184.

CVSS 3.1 · 9.8 Critical EPSS 5.7% KEV · Not listed
Vendors
Canonical Debian Xiph.org
Products
Ubuntu Linux Debian Linux Libvorbis
CVE-2017-14633

libvorbis: Out-of-bounds array read in the function mapping0_forward()

In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis().

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Xiph.org
Products
Ubuntu Linux Debian Linux Libvorbis
CVE-2017-14864

exiv2: Invalid memory address dereference in Exiv2::getULong

An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian Exiv2
Products
Ubuntu Linux Debian Linux Exiv2
CVE-2017-14624

ImageMagick: NULL pointer dereference in the PostscriptDelegateMessage function

ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function PostscriptDelegateMessage in coders/ps.c.

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Canonical Imagemagick
Products
Ubuntu Linux Imagemagick
CVE-2017-14625

ImageMagick: NULL pointer dereference in the sixel_output_create function

ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_output_create in coders/sixel.c.

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Canonical Imagemagick
Products
Ubuntu Linux Imagemagick
CVE-2017-14607

ImageMagick: Out-of-bounds read in ReadTIFFImage in coders/tiff.c

In ImageMagick 7.0.7-4 Q16, an out of bounds read flaw related to ReadTIFFImage has been reported in coders/tiff.c. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.

CVSS 3.0 · 8.1 High EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Imagemagick
Products
Ubuntu Linux Debian Linux Imagemagick
CVE-2017-14626

ImageMagick: NULL pointer dereference in the sixel_decode function

ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_decode in coders/sixel.c.

CVSS 3.0 · 9.8 Critical EPSS 2.6% KEV · Not listed
Vendors
Canonical Imagemagick
Products
Ubuntu Linux Imagemagick