Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 998

Export CSV
CVE-2018-16878

pacemaker: Insufficient verification inflicted preference of uncontrolled processes can lead to DoS

A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Clusterlabs Debian and 3 more
Products
Ubuntu Linux Pacemaker Debian Linux and 6 more
CVE-2018-16877

pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local privesc

A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Clusterlabs Debian and 3 more
Products
Ubuntu Linux Pacemaker Debian Linux and 6 more
CVE-2018-16871

kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence

A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel Cloud Backup H300e and 28 more
CVE-2018-14633

kernel: stack-based buffer overflow in chap_server_compute_md5() in iscsi target

A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. Kernel versions 4.18.x, 4.14.x and 3.10.x are believed to be vulnerable.

CVSS 3.1 · 7.0 High EPSS 8.7% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 8 more
CVE-2018-13405

kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members

The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.

CVSS 3.1 · 7.8 High EPSS 1.0% KEV · Not listed
Vendors
Canonical Debian F5 and 3 more
Products
Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 31 more
CVE-2018-11806

QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams

m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 9 more
CVE-2018-10392

libvorbis: heap buffer overflow in mapping0_forward function

mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.

CVSS 3.1 · 8.8 High EPSS 3.2% KEV · Not listed
Vendors
Debian Redhat Xiph.org
Products
Debian Linux Enterprise Linux Enterprise Linux Eus and 3 more
CVE-2017-7829

Mozilla: From address with encoded null character is cut off in message header display

It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird < 52.5.2.

CVSS 3.0 · 5.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Thunderbird and 6 more
CVE-2017-15705

spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service

A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the future.

CVSS 3.0 · 5.3 Medium EPSS 7.9% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Spamassassin Ubuntu Linux Debian Linux and 5 more
CVE-2017-15129

kernel: net: double-free and memory corruption in get_net_ns_by_id()

A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 1 more
Products
Ubuntu Linux Fedora Linux Kernel and 19 more
CVE-2016-2124

samba: SMB1 client connections can be downgraded to plaintext authentication

A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.

CVSS 3.1 · 5.9 Medium EPSS 1.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 23 more
CVE-2015-5160

libvirt: Ceph id/key leaked in the process list

libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Enterprise Linux Enterprise Linux Desktop and 8 more
CVE-2015-1931

JDK: plain text data stored in memory dumps

IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16 FP7, and 5.0 before SR16 FP13 stores plaintext information in memory dumps, which allows local users to obtain sensitive information by reading a file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm Redhat Suse
Products
Java Sdk Enterprise Linux Desktop Enterprise Linux Eus and 7 more
CVE-2014-0148

Qemu: vhdx: bounds checking for block_size and logical_sector_size

Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for block_size and logical_sector_size variables. These are used to derive other fields like 'sectors_per_block' etc. A user able to alter the Qemu disk image could ise this flaw to crash the Qemu instance resulting in DoS.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Enterprise Linux Desktop and 8 more
CVE-2014-0147

Qemu: block: possible crash due signed types or logic error

Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or a logic error while creating QCOW2 snapshots, which leads to incorrectly calling update_refcount() routine.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Qemu Redhat
Products
Fedora Qemu Enterprise Linux and 9 more
CVE-2014-0144

Qemu: block: missing input validation

QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused by missing input validations which could allow a remote user to execute arbitrary code on the host with the privileges of the QEMU process.

CVSS 3.1 · 8.6 High EPSS 1.0% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Enterprise Linux Desktop and 8 more