Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,301

Export CSV
CVE-2015-7216

Mozilla: Linux file chooser crashes on malformed JPEG2000 and TGA images due to flaws in underlying libraries (MFSA 2015-143)

The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the JasPer decoder, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG 2000 image.

CVSS 2.0 · 6.8 Medium EPSS 2.1% KEV · Not listed
Vendors
Fedoraproject Gnome Mozilla and 1 more
Products
Fedora Gnome Firefox and 2 more
CVE-2015-7215

Mozilla: Cross-origin information leak through web workers error events (MFSA 2015-140)

The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by triggering use of the no-cors mode in the fetch API to attempt resource access that throws an exception, leading to information disclosure after a rethrow.

CVSS 2.0 · 5.0 Medium EPSS 2.5% KEV · Not listed
Vendors
Fedoraproject Mozilla Opensuse
Products
Fedora Firefox Leap and 1 more
CVE-2016-1669

V8: integer overflow leading to buffer overflow in Zone::New

The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.

CVSS 3.1 · 8.8 High EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Chrome and 8 more
CVE-2016-1674

chromium-browser: cross-origin bypass in extensions

The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Debian Google Opensuse and 2 more
Products
Debian Linux Chrome Leap and 6 more
CVE-2015-7214

Mozilla: Cross-site reading attack through data: and view-source: URIs (MFSA 2015-149)

Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs.

CVSS 2.0 · 5.0 Medium EPSS 6.1% KEV · Not listed
Vendors
Fedoraproject Mozilla Opensuse and 1 more
Products
Fedora Firefox Leap and 2 more
CVE-2015-7213

Mozilla: Integer overflow in MP4 playback in 64-bit versions (MFSA 2015-146)

Integer overflow in the MPEG4Extractor::readMetaData function in MPEG4Extractor.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 on 64-bit platforms allows remote attackers to execute arbitrary code via a crafted MP4 video file that triggers a buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 4.1% KEV · Not listed
Vendors
Fedoraproject Mozilla Opensuse and 1 more
Products
Fedora Firefox Leap and 2 more
CVE-2015-7219

Mozilla: DOS due to malformed frames in HTTP/2 (MFSA 2015-142)

The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow, assertion failure, and application exit) via a malformed PushPromise frame that triggers decompressed-buffer length miscalculation and incorrect memory allocation.

CVSS 2.0 · 5.0 Medium EPSS 2.9% KEV · Not listed
Vendors
Fedoraproject Mozilla Opensuse
Products
Fedora Firefox Leap and 1 more
CVE-2015-7220

Mozilla: Buffer overflows found through code inspection (MFSA 2015-144)

Buffer overflow in the XDRBuffer::grow function in js/src/vm/Xdr.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.

CVSS 2.0 · 10.0 Critical EPSS 4.5% KEV · Not listed
Vendors
Fedoraproject Mozilla Opensuse
Products
Fedora Firefox Leap and 1 more
CVE-2015-7221

Mozilla: Buffer overflows found through code inspection (MFSA 2015-144)

Buffer overflow in the nsDeque::GrowCapacity function in xpcom/glue/nsDeque.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a deque size change.

CVSS 2.0 · 10.0 Critical EPSS 4.5% KEV · Not listed
Vendors
Fedoraproject Mozilla Opensuse
Products
Fedora Firefox Leap and 1 more
CVE-2015-7222

Mozilla: Integer underflow and buffer overflow processing MP4 metadata in libstagefright (MFSA 2015-147)

Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect memory allocation and application crash) via an MP4 video file with crafted covr metadata that triggers a buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 4.3% KEV · Not listed
Vendors
Fedoraproject Mozilla Opensuse and 1 more
Products
Fedora Firefox Leap and 2 more
CVE-2015-7499

libxml2: Heap-based buffer overflow in xmlGROW

Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 6.4% KEV · Not listed
Vendors
Apple Canonical Debian and 4 more
Products
Iphone Os Mac Os X Tvos and 14 more
CVE-2015-8080

redis: Integer wraparound in lua_struct.c causing stack-based buffer overflow

Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Opensuse and 3 more
CVE-2015-7545

git: arbitrary code execution via crafted URLs

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.

CVSS 3.0 · 9.8 Critical EPSS 18.7% KEV · Not listed
Vendors
Canonical Git Project Opensuse and 1 more
Products
Ubuntu Linux Git Opensuse and 3 more
CVE-2015-7212

Mozilla: Integer overflow allocating extremely large textures (MFSA 2015-139)

Integer overflow in the mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering a graphics operation that requires a large texture allocation.

CVSS 2.0 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Fedoraproject Mozilla Opensuse and 1 more
Products
Fedora Firefox Leap and 2 more
CVE-2015-7552

gdk-pixbuf: Heap-based buffer overflow in the gdk_pixbuf_flip function

Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.

CVSS 3.0 · 7.8 High EPSS 3.9% KEV · Not listed
Vendors
Opensuse Redhat
Products
Opensuse Enterprise Linux
CVE-2015-7211

Mozilla: Hash in data: URI is incorrectly parsed (MFSA 2015-141)

Mozilla Firefox before 43.0 mishandles the # (number sign) character in a data: URI, which allows remote attackers to spoof web sites via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 2.5% KEV · Not listed
Vendors
Fedoraproject Mozilla Opensuse
Products
Fedora Firefox Leap and 1 more
CVE-2016-1665

chromium-browser: information leak in v8

The JSGenericLowering class in compiler/js-generic-lowering.cc in Google V8, as used in Google Chrome before 50.0.2661.94, mishandles comparison operators, which allows remote attackers to obtain sensitive information via crafted JavaScript code.

CVSS 3.0 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Google Opensuse Redhat
Products
Chrome Opensuse Enterprise Linux Desktop Supplementary and 4 more
CVE-2016-1667

chromium-browser: same origin bypass in dom

The TreeScope::adoptIfNeeded function in WebKit/Source/core/dom/TreeScope.cpp in the DOM implementation in Blink, as used in Google Chrome before 50.0.2661.102, does not prevent script execution during node-adoption operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

CVSS 3.0 · 8.8 High EPSS 2.1% KEV · Not listed
Vendors
Debian Google Opensuse and 1 more
Products
Debian Linux Chrome Opensuse and 1 more
CVE-2015-7210

Mozilla: Use-after-free in WebRTC when datachannel is used after being destroyed (MFSA 2015-138)

Use-after-free vulnerability in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering attempted use of a data channel that has been closed by a WebRTC function.

CVSS 2.0 · 7.5 High EPSS 4.3% KEV · Not listed
Vendors
Fedoraproject Mozilla Opensuse and 1 more
Products
Fedora Firefox Leap and 2 more