CVE-2011-1526

krb5-appl: ftpd incorrect group privilege dropping (MITKRB5-SA-2011-005)

ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.

CVSS 2.0 · 6.5 Medium EPSS 3.9% KEV · Not listed

Vendors

Debian Fedoraproject Mit and 3 more

Products

Debian Linux Fedora Krb5-appl and 5 more

CVE-2011-1752

(mod_dav_svn): DoS (crash) via request to deliver baselined WebDAV resources

The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May 2011.

CVSS 2.0 · 5.0 Medium EPSS 8.5% KEV · Not listed

Vendors

Apache Apple Canonical and 3 more

Products

Subversion Mac Os X Ubuntu Linux and 3 more

CVE-2011-1755

jabberd: DoS via the XML "billion laughs attack"

jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVSS 3.1 · 7.5 High EPSS 3.7% KEV · Not listed

Vendors

Apple Fedoraproject Jabberd2 and 1 more

Products

Mac Os X Mac Os X Server Fedora and 3 more

CVE-2011-1770

kernel: dccp: handle invalid feature options length

Integer underflow in the dccp_parse_options function (net/dccp/options.c) in the Linux kernel before 2.6.33.14 allows remote attackers to cause a denial of service via a Datagram Congestion Control Protocol (DCCP) packet with an invalid feature options length, which triggers a buffer over-read.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Fedoraproject Linux Redhat

Products

Fedora Linux Kernel Enterprise Linux and 1 more

CVE-2011-1783

(mod_dav_svn): DoS (excessive memory use) when configured to provide path-based access control

The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is enabled, allows remote attackers to cause a denial of service (infinite loop and memory consumption) in opportunistic circumstances by requesting data.

CVSS 2.0 · 4.3 Medium EPSS 6.7% KEV · Not listed

Vendors

Apache Apple Canonical and 3 more

Products

Subversion Mac Os X Ubuntu Linux and 3 more

CVE-2011-2192

curl: Improper delegation of client credentials during GSS negotiation

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

CVSS 2.0 · 4.3 Medium EPSS 2.9% KEV · Not listed

Vendors

Apple Canonical Debian and 3 more

Products

Mac Os X Ubuntu Linux Debian Linux and 3 more

CVE-2011-2520

system-config-firewall: privilege escalation flaw via use of python pickle

fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privileges via a crafted serialized object.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Enterprise Linux System-config-firewall

CVE-2011-4516

jasper: heap buffer overflow flaws lead to arbitrary code execution (CERT VU#887409)

Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted numrlvls value in a coding style default (COD) marker segment in a JPEG2000 file.

CVSS 2.0 · 6.8 Medium EPSS 10.5% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 7 more

CVE-2011-4517

jasper: heap buffer overflow flaws lead to arbitrary code execution (CERT VU#887409)

The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.

CVSS 2.0 · 6.8 Medium EPSS 10.5% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 8 more

CVE-2011-4862

krb5: telnet client and server encrypt_keyid heap-based buffer overflow

Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.

CVSS 2.0 · 10.0 Critical EPSS 95.1% KEV · Not listed

Vendors

Debian Fedoraproject Freebsd and 6 more

Products

Debian Linux Fedora Freebsd and 11 more

CVE-2011-4930

Condor: Multiple format string flaws

Multiple format string vulnerabilities in Condor 7.2.0 through 7.6.4, and possibly certain 7.7.x versions, as used in Red Hat MRG Grid and possibly other products, allow local users to cause a denial of service (condor_schedd daemon and failure to launch jobs) and possibly execute arbitrary code via format string specifiers in (1) the reason for a hold for a job that uses an XML user log, (2) the filename of a file to be transferred, and possibly other unspecified vectors.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Condor Project Fedoraproject Redhat

Products

Condor Fedora Enterprise Mrg

CVE-2012-0037

raptor: XML External Entity (XXE) attack via RDF files

Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.

CVSS 3.1 · 6.5 Medium EPSS 13.5% KEV · Not listed

Vendors

Apache Debian Fedoraproject and 3 more

Products

Openoffice Debian Linux Fedora and 11 more

CVE-2012-1149

libreoffice: Integer overflows, leading to heap-buffer overflows in JPEG, PNG and BMP reader implementations

Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.

CVSS 2.0 · 7.5 High EPSS 14.0% KEV · Not listed

Vendors

Apache Debian Fedoraproject and 2 more

Products

Openoffice.org Debian Linux Fedora and 7 more

CVE-2012-1568

kernel: execshield: predictable ascii armour base address

The ExecShield feature in a certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 5 and 6 and Fedora 15 and 16 does not properly handle use of many shared libraries by a 32-bit executable file, which makes it easier for context-dependent attackers to bypass the ASLR protection mechanism by leveraging a predictable base address for one of these libraries.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Enterprise Linux

CVE-2012-4406

Openstack-Swift: insecure use of python pickle()

OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.

CVSS 3.1 · 9.8 Critical EPSS 6.6% KEV · Not listed

Vendors

Fedoraproject Openstack Redhat

Products

Fedora Swift Enterprise Linux Server and 5 more

CVE-2012-4453

dracut: Creates initramfs images with world-readable permissions (information disclosure)

dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Dracut Project Fedoraproject Redhat

Products

Dracut Fedora Enterprise Linux and 3 more

CVE-2012-5536

pam_ssh_agent_auth: symbol crash leading to glibc error() called incorrectly

A certain Red Hat build of the pam_ssh_agent_auth module on Red Hat Enterprise Linux (RHEL) 6 and Fedora Rawhide calls the glibc error function instead of the error function in the OpenSSH codebase, which allows local users to obtain sensitive information from process memory or possibly gain privileges via crafted use of an application that relies on this module, as demonstrated by su and sudo.

CVSS 2.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Fedora Project Redhat

Products

Fedora Release Rawhide Enterprise Linux

CVE-2012-6075

qemu: e1000 driver buffer overflow when processing large packets when SBP and LPE flags are disabled

Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet.

CVSS 2.0 · 9.3 Critical EPSS 4.9% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 12 more

CVE-2013-0170

libvirt: use-after-free in virNetMessageFree()

Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue.

CVSS 2.0 · 6.8 Medium EPSS 5.8% KEV · Not listed

Vendors

Canonical Fedoraproject Opensuse and 2 more

Products

Ubuntu Linux Fedora Opensuse and 9 more

CVE-2013-1416

krb5: NULL pointer dereference (DoS, KDC crash) by processing certain TGS requests

The prep_reprocess_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.5 does not properly perform service-principal realm referral, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS-REQ request.

CVSS 2.0 · 4.0 Medium EPSS 2.9% KEV · Not listed

Vendors

Fedoraproject Mit Opensuse and 1 more

Products

Fedora Kerberos 5 Opensuse and 6 more