Export limit exceeded: 425865 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,194

Export CSV
CVE-2014-2270

file: out-of-bounds access in search rules with offsets from input file

softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.

CVSS 2.0 · 4.3 Medium EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian File Project and 3 more
Products
Ubuntu Linux Debian Linux File and 4 more
CVE-2014-2241

freetype: OOB stack-based read/write in cf2_hintmap_build()

The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.

CVSS 2.0 · 6.8 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Freetype
Products
Ubuntu Linux Freetype
CVE-2014-2038

kernel: nfs: data leak during extended writes

The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operation without a certain up-to-date verification, which allows local users to obtain sensitive information from kernel memory in opportunistic circumstances by writing to a file in an NFS filesystem and then reading the same file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux
CVE-2015-3258

cups-filters: texttopdf heap-based buffer overflow

Heap-based buffer overflow in the WriteProlog function in filter/texttopdf.c in texttopdf in cups-filters before 1.0.70 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a small line size in a print job.

CVSS 2.0 · 7.5 High EPSS 7.9% KEV · Not listed
Vendors
Canonical Debian Linuxfoundation and 1 more
Products
Ubuntu Linux Debian Linux Cups-filters and 1 more
CVE-2016-2834

nss: Multiple security flaws (MFSA 2016-61)

Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.

CVSS 3.0 · 8.8 High EPSS 3.4% KEV · Not listed
Vendors
Canonical Mozilla Novell and 2 more
Products
Ubuntu Linux Firefox Network Security Services and 6 more
CVE-2014-1829

python-requests: redirect can expose netrc password

Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.

CVSS 2.0 · 5.0 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Mageia and 1 more
Products
Ubuntu Linux Debian Linux Mageia and 1 more
CVE-2015-3146

libssh: null pointer dereference due to a logical error in the handling of a SSH_MSG_NEWKEYS and KEXDH_REPLY packets

The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet.

CVSS 3.0 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 1 more
Products
Ubuntu Linux Debian Linux Fedora and 1 more
CVE-2014-1874

Kernel: SELinux: local denial-of-service

The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat and 1 more
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 2 more
CVE-2015-3209

qemu: pcnet: multi-tmd buffer overflow in the tx path

Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.

CVSS 2.0 · 7.5 High EPSS 9.7% KEV · Not listed
Vendors
Arista Canonical Debian and 5 more
Products
Eos Ubuntu Linux Debian Linux and 17 more
CVE-2016-2841

Qemu: net: ne2000: infinite loop in ne2000_receive

The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.

CVSS 3.0 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Qemu
Products
Ubuntu Linux Qemu
CVE-2016-3075

glibc: Stack overflow in nss_dns_getnetbyname_r

Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name.

CVSS 3.0 · 7.5 High EPSS 7.3% KEV · Not listed
Vendors
Canonical Fedoraproject Gnu and 2 more
Products
Ubuntu Linux Fedora Glibc and 2 more
CVE-2014-1739

Kernel: drivers: media: an information leakage

The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.

CVSS 2.0 · 2.1 Low EPSS 1.1% KEV · Not listed
Vendors
Canonical Linux Redhat and 1 more
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 3 more
CVE-2014-1690

Kernel: netfilter: nf_nat: leakage of uninitialized buffer in IRC NAT helper

The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature.

CVSS 2.0 · 2.6 Low EPSS 3.9% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Mrg
CVE-2016-2825

Mozilla: Partial same-origin-policy through setting location.host through data: URI (MFSA 2016-54)

Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Mozilla Opensuse
Products
Ubuntu Linux Firefox Leap and 1 more
CVE-2016-2828

Mozilla: Use-after-free when textures are used in WebGL operations after recycle pool destruction (MFSA 2016-56)

Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via WebGL content that triggers texture access after destruction of the texture's recycle pool.

CVSS 3.0 · 8.8 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 2 more
Products
Ubuntu Linux Debian Linux Firefox and 3 more
CVE-2014-1528

Mozilla: Out-of-bounds write in Cairo (MFSA 2014-41)

The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by painting on a CANVAS element.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed
Vendors
Canonical Fedoraproject Microsoft and 4 more
Products
Ubuntu Linux Fedora Windows and 5 more
CVE-2014-1526

Mozilla: Debugger can bypass XrayWrappers with JavaScript (MFSA 2014-47)

The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that is visited in the debugger, leading to unwrapping operations and calls to DOM methods on the unwrapped objects.

CVSS 2.0 · 6.8 Medium EPSS 1.8% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 1 more
Products
Ubuntu Linux Fedora Firefox and 2 more
CVE-2016-2822

Mozilla: Addressbar spoofing though the SELECT element (MFSA 2016-52)

Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to spoof the address bar via a SELECT element with a persistent menu.

CVSS 3.0 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 2 more
Products
Ubuntu Linux Debian Linux Firefox and 3 more
CVE-2016-2829

Mozilla: Incorrect icon displayed on permissions notifications (MFSA 2016-57)

Mozilla Firefox before 47.0 allows remote attackers to spoof permission notifications via a crafted web site that rapidly triggers permission requests, as demonstrated by the microphone permission or the geolocation permission.

CVSS 3.0 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Canonical Mozilla Opensuse
Products
Ubuntu Linux Firefox Leap and 1 more