CVE-2015-2568

mysql: unspecified vulnerability related to Server:Security:Privileges (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote attackers to affect availability via unknown vectors related to Server : Security : Privileges.

CVSS 2.0 · 5.0 Medium EPSS 7.2% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 15 more

CVE-2015-2348

php: move_uploaded_file() NUL byte injection in file name

The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

CVSS 2.0 · 5.0 Medium EPSS 8.3% KEV · Not listed

Vendors

Apple Opensuse Php and 1 more

Products

Mac Os X Opensuse Php and 8 more

CVE-2015-2301

php: use after free in phar_object.c

Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.

CVSS 2.0 · 7.5 High EPSS 14.7% KEV · Not listed

Vendors

Apple Canonical Debian and 3 more

Products

Mac Os X Ubuntu Linux Debian Linux and 10 more

CVE-2012-6662

jquery-ui: XSS vulnerability in default content in Tooltip widget

Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

CVSS 2.0 · 4.3 Medium EPSS 7.5% KEV · Not listed

Vendors

Jqueryui Redhat

Products

Jquery Ui Enterprise Linux Enterprise Linux Desktop and 3 more

CVE-2015-1863

wpa_supplicant: P2P SSID processing vulnerability

Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.

CVSS 2.0 · 5.8 Medium EPSS 5.2% KEV · Not listed

Vendors

Canonical Debian Opensuse and 2 more

Products

Ubuntu Linux Debian Linux Opensuse and 8 more

CVE-2015-1774

libreoffice: HWP file filter vulnerability

The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write.

CVSS 2.0 · 6.8 Medium EPSS 7.6% KEV · Not listed

Vendors

Apache Canonical Debian and 3 more

Products

Openoffice Ubuntu Linux Debian Linux and 6 more

CVE-2015-1288

chromium-browser: Spell checking dictionaries fetched over HTTP in unspecified

The Spellcheck API implementation in Google Chrome before 44.0.2403.89 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file, a related issue to CVE-2015-1263.

CVSS 2.0 · 6.8 Medium EPSS 1.1% KEV · Not listed

Vendors

Debian Google Opensuse and 1 more

Products

Debian Linux Chrome Opensuse and 5 more

CVE-2015-1287

chromium-browser: SOP bypass with CSS in unspecified

Blink, as used in Google Chrome before 44.0.2403.89, enables a quirks-mode exception that limits the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to core/fetch/CSSStyleSheetResource.cpp.

CVSS 2.0 · 4.3 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Google Opensuse and 1 more

Products

Debian Linux Chrome Opensuse and 5 more

CVE-2015-1286

chromium-browser: UXSS in blink.

Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context restriction, aka a Blink "Universal XSS (UXSS)."

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Debian Google Opensuse and 1 more

Products

Debian Linux Chrome Opensuse and 5 more

CVE-2015-1285

chromium-browser: Information leak in XSS auditor.

The XSSAuditor::canonicalize function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 44.0.2403.89, does not properly choose a truncation point, which makes it easier for remote attackers to obtain sensitive information via an unspecified linear-time attack.

CVSS 2.0 · 5.0 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Google Opensuse and 1 more

Products

Debian Linux Chrome Opensuse and 5 more

CVE-2015-1284

chromium-browser: Use-after-free in blink.

The LocalFrame::isURLAllowed function in core/frame/LocalFrame.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly check for a page's maximum number of frames, which allows remote attackers to cause a denial of service (invalid count value and use-after-free) or possibly have unspecified other impact via crafted JavaScript code that makes many createElement calls for IFRAME elements.

CVSS 2.0 · 7.5 High EPSS 2.1% KEV · Not listed

Vendors

Google Opensuse Redhat

Products

Chrome Opensuse Enterprise Linux Desktop Supplementary and 3 more

CVE-2015-1282

chromium-browser: Use-after-free in pdfium.

Multiple use-after-free vulnerabilities in fpdfsdk/src/javascript/Document.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to the (1) Document::delay and (2) Document::DoFieldDelay functions.

CVSS 2.0 · 6.8 Medium EPSS 1.6% KEV · Not listed

Vendors

Debian Google Opensuse and 1 more

Products

Debian Linux Chrome Opensuse and 5 more

CVE-2015-1281

chromium-browser: CSP bypass in unspecified component

core/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly determine the V8 context of a microtask, which allows remote attackers to bypass Content Security Policy (CSP) restrictions by providing an image from an unintended source.

CVSS 2.0 · 4.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Debian Google Opensuse and 1 more

Products

Debian Linux Chrome Opensuse and 5 more

CVE-2015-1280

chromium-browser: Memory corruption in skia

SkPictureShader.cpp in Skia, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging access to a renderer process and providing crafted serialized data.

CVSS 2.0 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Debian Google Opensuse and 1 more

Products

Debian Linux Chrome Opensuse and 5 more

CVE-2015-1279

chromium-browser: Heap-buffer-overflow in pdfium.

Integer overflow in the CJBig2_Image::expand function in fxcodec/jbig2/JBig2_Image.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via large height and stride values.

CVSS 2.0 · 7.5 High EPSS 2.1% KEV · Not listed

Vendors

Debian Google Opensuse and 1 more

Products

Debian Linux Chrome Opensuse and 5 more

CVE-2015-1289

chromium-browser: Various fixes from internal audits, fuzzing and other initiatives

Multiple unspecified vulnerabilities in Google Chrome before 44.0.2403.89 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Debian Google Opensuse and 1 more

Products

Debian Linux Chrome Opensuse and 5 more

CVE-2015-1278

chromium-browser: URL spoofing using pdf files in unspecified

content/browser/web_contents/web_contents_impl.cc in Google Chrome before 44.0.2403.89 does not ensure that a PDF document's modal dialog is closed upon navigation to an interstitial page, which allows remote attackers to spoof URLs via a crafted document, as demonstrated by the alert_dialog.pdf document.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Debian Google Opensuse and 1 more

Products

Debian Linux Chrome Opensuse and 5 more

CVE-2015-1277

chromium-browser: Use-after-free in accessibility.

Use-after-free vulnerability in the accessibility implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging lack of certain validity checks for accessibility-tree data structures.

CVSS 2.0 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Debian Google Opensuse and 1 more

Products

Debian Linux Chrome Opensuse and 5 more

CVE-2015-1276

chromium-browser: Use-after-free in IndexedDB.

Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging an abort action before a certain write operation.

CVSS 3.0 · 9.8 Critical EPSS 1.6% KEV · Not listed

Vendors

Debian Google Opensuse and 1 more

Products

Debian Linux Chrome Opensuse and 5 more

CVE-2015-1274

chromium-browser: Settings allowed executable files to run immediately after download in unsepcified

Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types, which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and leveraging a user's previous "Always open files of this type" choice, related to download_commands.cc and download_prefs.cc.

CVSS 2.0 · 6.8 Medium EPSS 3.9% KEV · Not listed

Vendors

Debian Google Opensuse and 1 more

Products

Debian Linux Chrome Opensuse and 4 more