Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,194

Export CSV
CVE-2016-2391

Qemu: usb: multiple eof_timers in ohci module leads to null pointer dereference

The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.

CVSS 3.1 · 5.0 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-2178

openssl: Non-constant time codepath followed for certain operations in DSA implementation

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.

CVSS 3.1 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Nodejs and 4 more
Products
Ubuntu Linux Debian Linux Node.js and 7 more
CVE-2015-5277

glibc: data corruption while reading the NSS files database

The get_contents function in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) before 2.20 might allow local users to cause a denial of service (heap corruption) or gain privileges via a long line in the NSS files database.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Canonical Gnu Redhat
Products
Ubuntu Linux Glibc Enterprise Linux and 5 more
CVE-2016-2184

kernel: Kernel panic on invalid USB device descriptor (snd_usb_audio driver)

The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference or double free, and system crash) via a crafted endpoints value in a USB device descriptor.

CVSS 3.0 · 4.6 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Linux Novell
Products
Ubuntu Linux Linux Kernel Suse Linux Enterprise Debuginfo and 7 more
CVE-2015-5262

httpcomponents-core: missing HTTPS connection timeout

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 18.8% KEV · Not listed
Vendors
Apache Canonical Fedoraproject
Products
Httpclient Ubuntu Linux Fedora
CVE-2015-5261

spice: host memory access from guest using crafted images

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 7 more
CVE-2016-2185

kernel: Kernel panic on invalid USB device descriptor (ati_remote2 driver)

The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.

CVSS 3.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Novell
Products
Ubuntu Linux Linux Kernel Suse Linux Enterprise Debuginfo and 7 more
CVE-2015-5260

spice: insufficient validation of surface_id parameter can cause crash

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL commands related to the surface_id parameter.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 7 more
CVE-2015-5252

samba: Insufficient symlink verification in smbd

vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.

CVSS 3.1 · 7.2 High EPSS 13.3% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 2 more
CVE-2016-2118

samba: SAMR and LSA man in the middle attacks

The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "BADLOCK."

CVSS 3.1 · 7.5 High EPSS 37.2% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 6 more
CVE-2015-5247

libvirt: denial of service when volume creation fails on NFS pool

The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unlink after creating a volume on a root_squash NFS pool.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Redhat
Products
Ubuntu Linux Libvirt
CVE-2016-2117

kernel: Kernel memory leakage to ethernet frames due to buffer overflow in ethernet drivers

The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data.

CVSS 3.0 · 7.5 High EPSS 6.4% KEV · Not listed
Vendors
Canonical Linux Oracle and 1 more
Products
Ubuntu Linux Linux Kernel Vm Server and 2 more
CVE-2016-2186

kernel: Kernel panic on invalid USB device descriptor (powermate driver)

The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.

CVSS 3.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Novell
Products
Ubuntu Linux Linux Kernel Suse Linux Enterprise Debuginfo and 7 more
CVE-2015-5214

libreoffice: Bookmarks in DOC documents are insufficiently checked causing memory corruption

LibreOffice before 4.4.6 and 5.x before 5.0.1 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via an index to a non-existent bookmark in a DOC file.

CVSS 2.0 · 6.8 Medium EPSS 9.0% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Openoffice Ubuntu Linux Debian Linux and 2 more
CVE-2016-2114

samba: Samba based active directory domain controller does not enforce smb signing

The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream.

CVSS 3.0 · 5.9 Medium EPSS 2.7% KEV · Not listed
Vendors
Canonical Redhat Samba
Products
Ubuntu Linux Enterprise Linux Rhel Aus and 4 more
CVE-2015-5312

libxml2: CPU exhaustion when processing specially crafted XML input

The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.

CVSS 2.0 · 7.1 High EPSS 4.5% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Tvos and 12 more
CVE-2015-5213

libreoffice: Integer overflow in DOC files

Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a long DOC file, which triggers a buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 9.6% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Openoffice Ubuntu Linux Debian Linux and 2 more
CVE-2015-5212

libreoffice: Integer underflow in PrinterSetup length

Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via crafted PrinterSetup data in an ODF document.

CVSS 2.0 · 6.8 Medium EPSS 8.7% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Openoffice Ubuntu Linux Debian Linux and 2 more
CVE-2016-2115

samba: Smb signing not required by default when smb client connection is used for ipc usage

Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream.

CVSS 3.0 · 5.9 Medium EPSS 10.2% KEV · Not listed
Vendors
Canonical Redhat Samba
Products
Ubuntu Linux Enterprise Linux Rhel Aus and 4 more
CVE-2015-5200

libvdpau vulnerability in trace functionality

The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors.

CVSS 2.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Libvdpau Project
Products
Ubuntu Linux Libvdpau