Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,842

Export CSV
CVE-2023-6546

Kernel: gsm multiplexing race condition leads to privilege escalation

A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privileges on the system.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux and 7 more
CVE-2023-5367

Xorg-x11-server: out-of-bounds write in xichangedeviceproperty/rrchangeoutputproperty

A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 14 more
CVE-2022-2068

The c_rehash script allows command injection

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).

CVSS 3.1 · 9.8 Critical EPSS 96.4% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 4 more
Products
Sannav Debian Linux Fedora and 46 more
CVE-2022-1292

The c_rehash script allows command injection

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

CVSS 3.1 · 9.8 Critical EPSS 82.6% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 4 more
Products
Debian Linux Fedora A250 and 55 more
CVE-2015-5477

bind: TKEY query handling flaw leading to denial of service

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

CVSS 3.1 · 7.5 High EPSS 99.6% KEV · Listed
Vendors
Apple Canonical Debian and 10 more
Products
Os X Server Ubuntu Linux Debian Linux and 76 more
CVE-2023-29007

Arbitrary configuration injection via `git submodule deinit`

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.

CVSS 3.1 · 7 High EPSS 5.6% KEV · Not listed
Vendors
Fedoraproject Git-scm Redhat
Products
Fedora Git Enterprise Linux and 4 more
CVE-2023-25815

Git looks for localized messages in the wrong place

In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\` (and since `C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1. This vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\`.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Git For Windows Project Redhat
Products
Fedora Git For Windows Enterprise Linux and 4 more
CVE-2022-2625

postgresql: Extension scripts replace objects not belonging to the extension.

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

CVSS 3.1 · 8.0 High EPSS 2.2% KEV · Not listed
Vendors
Fedoraproject Postgresql Redhat
Products
Fedora Postgresql Enterprise Linux and 5 more
CVE-2022-1354

libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c

A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Libtiff and 2 more
Products
Debian Linux Fedora Libtiff and 2 more
CVE-2021-4217

unzip: Null pointer dereference in Unicode strings code

A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Unzip Project
Products
Fedora Enterprise Linux Unzip
CVE-2021-41184

XSS in the `of` option of the `.position()` util

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

CVSS 3.1 · 6.5 Medium EPSS 40.8% KEV · Not listed
Vendors
Drupal Fedoraproject Jqueryui and 4 more
Products
Drupal Fedora Jquery Ui and 33 more
CVE-2021-3826

libiberty: Heap/stack buffer overflow in the dlang_lname function in d-demangle.c

Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Gnu Redhat
Products
Fedora Gcc Enterprise Linux and 1 more
CVE-2021-38593

qt: out-of-bounds write in QOutlineMapper::convertPath called from QRasterPaintEngine::fill and QPaintEngineEx::stroke

Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).

CVSS 3.1 · 7.5 High EPSS 3.0% KEV · Not listed
Vendors
Fedoraproject Qt Redhat
Products
Fedora Qt Enterprise Linux
CVE-2021-31566

libarchive: symbolic links incorrectly followed when changing modes, times, ACL and flags of a file while extracting an archive

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Libarchive and 2 more
Products
Debian Linux Fedora Libarchive and 11 more
CVE-2020-11022

jQuery has a potential XSS vulnerability

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVSS 3.1 · 6.9 Medium EPSS 99.2% KEV · Not listed
Vendors
Debian Drupal Fedoraproject and 6 more
Products
Debian Linux Drupal Fedora and 85 more
CVE-2019-20454

pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode

An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Fedoraproject Pcre Redhat and 1 more
Products
Fedora Pcre2 Enterprise Linux and 1 more
CVE-2018-20406

python: Integer overflow in Modules/_pickle.c allows for memory exhaustion if serializing gigabytes of data

Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.7, v3.6.7rc1, v3.6.7rc2, v3.6.8, v3.6.8rc1, v3.6.9, v3.6.9rc1; v3.7.1, v3.7.1rc1, v3.7.1rc2, v3.7.2, v3.7.2rc1, v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVSS 3.0 · 7.5 High EPSS 5.8% KEV · Not listed
Vendors
Debian Fedoraproject Python and 1 more
Products
Debian Linux Fedora Python and 1 more
CVE-2018-1061

python: DOS via regular expression backtracking in difflib.IS_LINE_JUNK method in difflib

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.

CVSS 3.0 · 6.5 Medium EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2018-19139

jasper: memory leak of data allocated in jpc_unk_getparms() after abort in jpc_dec_process_sot()

An issue has been found in JasPer 2.0.14. There is a memory leak in jas_malloc.c when called from jpc_unk_getparms in jpc_cs.c.

CVSS 3.0 · 5.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Debian Jasper Project Redhat
Products
Debian Linux Jasper Fedora