Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,064

Export CSV
CVE-2017-3144

Failure to properly clean up closed OMAPI connections can exhaust available sockets

A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested.

CVSS 3.1 · 7.5 High EPSS 72.7% KEV · Not listed
Vendors
Canonical Debian Isc and 1 more
Products
Ubuntu Linux Debian Linux Dhcp and 7 more
CVE-2017-3143

An error in TSIG authentication can permit unauthorized dynamic updates

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.

CVSS 3.0 · 7.5 High EPSS 18.2% KEV · Not listed
Vendors
Debian Isc Redhat
Products
Debian Linux Bind Enterprise Linux and 6 more
CVE-2017-3142

An error in TSIG authentication can permit unauthorized zone transfers

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.

CVSS 3.0 · 5.3 Medium EPSS 5.4% KEV · Not listed
Vendors
Debian Isc Redhat
Products
Debian Linux Bind Enterprise Linux and 6 more
CVE-2017-3137

A response packet can cause a resolver to terminate when processing an answer containing a CNAME or DNAME

Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8.

CVSS 3.0 · 7.5 High EPSS 8.9% KEV · Not listed
Vendors
Debian Isc Netapp and 1 more
Products
Debian Linux Bind Data Ontap Edge and 13 more
CVE-2017-3136

An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;"

A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met. Affects BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8.

CVSS 3.0 · 5.9 Medium EPSS 11.1% KEV · Not listed
Vendors
Debian Isc Netapp and 1 more
Products
Debian Linux Bind Data Ontap Edge and 9 more
CVE-2017-3135

Combination of DNS64 and RPZ Can Lead to Crash

Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1.

CVSS 3.0 · 7.5 High EPSS 17.1% KEV · Not listed
Vendors
Debian Isc Netapp and 1 more
Products
Debian Linux Bind Data Ontap Edge and 8 more
CVE-2017-2885

libsoup: Stack based buffer overflow with HTTP Chunked Encoding

An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.

CVSS 3.1 · 9.8 Critical EPSS 23.1% KEV · Not listed
Vendors
Debian Gnome Redhat
Products
Debian Linux Libsoup Enterprise Linux and 6 more
CVE-2017-2640

pidgin: Out-of-bounds write in purple_markup_unescape_entity triggered by invalid XML

An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.

CVSS 3.0 · 7.5 High EPSS 6.2% KEV · Not listed
Vendors
Debian Pidgin Redhat
Products
Debian Linux Pidgin Enterprise Linux and 5 more
CVE-2017-2634

kernel: dccp: crash while sending ipv6 reset packet

It was found that the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation before 2.6.22.17 used the IPv4-only inet_sk_rebuild_header() function for both IPv4 and IPv6 DCCP connections, which could result in memory corruptions. A remote attacker could use this flaw to crash the system.

CVSS 3.0 · 7.5 High EPSS 5.2% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Linux Desktop and 5 more
CVE-2017-2633

Qemu: VNC: memory corruption due to unchecked resolution limit

An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process.

CVSS 3.0 · 5.4 Medium EPSS 3.1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Enterprise Linux Desktop and 5 more
CVE-2017-2626

libICE: weak entropy usage in session keys

It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list.

CVSS 3.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Freedesktop Redhat
Products
Libice Enterprise Linux Enterprise Linux Desktop and 4 more
CVE-2017-2625

libXdmcp: weak entropy usage for session keys

It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat X.org
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Server and 4 more
CVE-2017-2620

Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo

Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.

CVSS 3.0 · 5.5 Medium EPSS 3.6% KEV · Not listed
Vendors
Citrix Debian Qemu and 2 more
Products
Xenserver Debian Linux Qemu and 9 more
CVE-2017-2618

kernel: Off-by-one error in selinux_setprocattr (/proc/self/attr/fscreate)

A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty (null) write to this file can crash the system by causing the system to attempt to access unmapped kernel memory.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 7 more
CVE-2017-2615

Qemu: display: cirrus: oob access while doing bitblt copy backward mode

Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.

CVSS 3.0 · 5.5 Medium EPSS 3.6% KEV · Not listed
Vendors
Citrix Debian Qemu and 2 more
Products
Xenserver Debian Linux Qemu and 9 more
CVE-2017-2590

ipa: Insufficient permission check for ca-del, ca-disable and ca-enable commands

A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys.

CVSS 3.0 · 8.1 High EPSS 1.3% KEV · Not listed
Vendors
Freeipa Redhat
Products
Freeipa Enterprise Linux Enterprise Linux Desktop and 4 more
CVE-2017-18344

kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c

The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).

CVSS 3.0 · 5.5 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 13 more
CVE-2017-17833

openslp: Heap memory corruption in slpd/slpd_process.c allows denial of service or potentially code execution

OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability.

CVSS 3.0 · 9.8 Critical EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Lenovo and 2 more
Products
Ubuntu Linux Debian Linux Bm Nextscale Fan Power Controller and 59 more
CVE-2017-15129

kernel: net: double-free and memory corruption in get_net_ns_by_id()

A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 1 more
Products
Ubuntu Linux Fedora Linux Kernel and 19 more