CVE-2014-8737

binutils: directory traversal vulnerability

Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar.

CVSS 2.0 · 3.6 Low EPSS 1.0% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 1 more

Products

Ubuntu Linux Fedora Binutils and 1 more

CVE-2014-8504

binutils: stack overflow in the SREC parser

Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted file.

CVSS 2.0 · 7.5 High EPSS 6.2% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 1 more

Products

Ubuntu Linux Fedora Binutils and 1 more

CVE-2014-8503

binutils: stack overflow in objdump when parsing specially crafted ihex file

Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file.

CVSS 2.0 · 7.5 High EPSS 6.2% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 1 more

Products

Ubuntu Linux Fedora Binutils and 1 more

CVE-2014-8502

binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file.

CVSS 2.0 · 7.5 High EPSS 4.9% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 1 more

Products

Ubuntu Linux Fedora Binutils and 1 more

CVE-2015-4895

mysql: unspecified vulnerability related to Server:InnoDB (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.

CVSS 2.0 · 3.5 Low EPSS 2.9% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 3 more

CVE-2014-8501

binutils: out-of-bounds write when parsing specially crafted PE executable

The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable.

CVSS 2.0 · 7.5 High EPSS 5.2% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 1 more

Products

Ubuntu Linux Fedora Binutils and 1 more

CVE-2014-8485

binutils: lack of range checking leading to controlled write in _bfd_elf_setup_sections()

The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file.

CVSS 2.0 · 7.5 High EPSS 7.5% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 1 more

Products

Ubuntu Linux Fedora Binutils and 1 more

CVE-2014-8484

binutils: invalid read flaw in libbfd

The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a small S-record.

CVSS 2.0 · 5.0 Medium EPSS 5.1% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 1 more

Products

Ubuntu Linux Fedora Binutils and 1 more

CVE-2014-8124

python-django-horizon: denial of service via login page requests

OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page.

CVSS 2.0 · 5.0 Medium EPSS 2.9% KEV · Not listed

Vendors

Fedoraproject Openstack Opensuse and 2 more

Products

Fedora Horizon Opensuse and 2 more

CVE-2015-4913

mysql: unspecified vulnerability related to Server:DML (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858.

CVSS 2.0 · 3.5 Low EPSS 3.5% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 14 more

CVE-2015-8391

pcre: inefficient posix character class syntax check (8.38/16)

The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 3.1 · 9.8 Critical EPSS 6.4% KEV · Not listed

Vendors

Fedoraproject Oracle Pcre and 2 more

Products

Fedora Linux Pcre and 9 more

CVE-2014-8112

389-ds-base: password hashing bypassed when "nsslapd-unhashed-pw-switch" is set to off

389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog.

CVSS 2.0 · 4.0 Medium EPSS 1.7% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

389 Directory Server Fedora Enterprise Linux

CVE-2015-5154

qemu: ide: atapi: heap overflow during I/O buffer memory access

Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Qemu Redhat and 2 more

Products

Fedora Qemu Enterprise Linux and 7 more

CVE-2015-3196

OpenSSL: Race condition handling PSK identify hint

ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.

CVSS 2.0 · 4.3 Medium EPSS 13.5% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 12 more

CVE-2015-3192

Framework: denial-of-service attack with XML input

Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.

CVSS 3.0 · 5.5 Medium EPSS 2.6% KEV · Not listed

Vendors

Fedoraproject Pivotal Software Redhat and 1 more

Products

Fedora Spring Framework Jboss Amq and 5 more

CVE-2014-8105

389-ds-base: information disclosure through 'cn=changelog' subtree

389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 2.1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

389 Directory Server Fedora Enterprise Linux

CVE-2015-5165

Qemu: rtl8139 uninitialized heap memory information leakage to guest (XSA-140)

The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 13.3% KEV · Not listed

Vendors

Arista Debian Fedoraproject and 4 more

Products

Eos Debian Linux Fedora and 22 more

CVE-2014-7821

openstack-neutron: DoS via maliciously crafted dns_nameservers

OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.

CVSS 2.0 · 4.0 Medium EPSS 3.9% KEV · Not listed

Vendors

Fedoraproject Openstack Redhat

Products

Fedora Neutron Openstack

CVE-2014-6568

mysql: unspecified vulnerability related to Server:InnoDB:DML (CPU Jan 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DML.

CVSS 2.0 · 3.5 Low EPSS 7.1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 16 more

CVE-2014-6055

libvncserver: server stacked-based buffer overflow flaws in file transfer handling

Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3) FileTime attribute in a rfbFileTransferOffer message.

CVSS 2.0 · 6.5 Medium EPSS 7.8% KEV · Not listed

Vendors

Debian Fedoraproject Libvncserver and 1 more

Products

Debian Linux Fedora Libvncserver and 4 more