Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 160

Export CSV
CVE-2014-3640

qemu: slirp: NULL pointer deref in sosendto()

The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 5 more
CVE-2014-4342

krb5: denial of service flaws when handling RFC 1964 tokens

MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session.

CVSS 2.0 · 5.0 Medium EPSS 6.5% KEV · Not listed
Vendors
Debian Mit Redhat
Products
Debian Linux Kerberos Kerberos 5 and 5 more
CVE-2014-4343

krb5: double-free flaw in SPNEGO initiators

Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.

CVSS 2.0 · 7.6 High EPSS 6.4% KEV · Not listed
Vendors
Debian Mit Redhat
Products
Debian Linux Kerberos 5 Enterprise Linux and 4 more
CVE-2014-4344

krb5: NULL pointer dereference flaw in SPNEGO acceptor for continuation tokens

The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation.

CVSS 2.0 · 7.8 High EPSS 6.6% KEV · Not listed
Vendors
Debian Mit Redhat
Products
Debian Linux Kerberos 5 Enterprise Linux and 4 more
CVE-2014-4975

ruby: off-by-one stack-based buffer overflow in the encodes() function

Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 6 more
CVE-2014-7145

Kernel: cifs: NULL pointer dereference in SMB2_tcon

The SMB2_tcon function in fs/cifs/smb2pdu.c in the Linux kernel before 3.16.3 allows remote CIFS servers to cause a denial of service (NULL pointer dereference and client system crash) or possibly have unspecified other impact by deleting the IPC$ share during resolution of DFS referrals.

CVSS 2.0 · 7.8 High EPSS 3.7% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 4 more
CVE-2014-7300

gnome-shell: lockscreen bypass with printscreen key

GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Gnome-shell Enterprise Linux Enterprise Linux Desktop and 3 more
CVE-2014-8108

subversion: NULL pointer dereference flaw in mod_dav_svn when handling URIs for virtual transaction names

The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist.

CVSS 2.0 · 5.0 Medium EPSS 10.0% KEV · Not listed
Vendors
Apache Apple Redhat
Products
Subversion Xcode Enterprise Linux and 4 more
CVE-2014-8136

libvirt: local denial of service in qemu/qemu_driver.c

The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Mageia Opensuse and 1 more
Products
Ubuntu Linux Mageia Opensuse and 7 more
CVE-2014-8169

autofs: priv escalation via interpreter load path for program based automount maps

automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Automount Project Opensuse Redhat
Products
Automount Opensuse Enterprise Linux and 4 more
CVE-2014-8564

gnutls: Heap corruption when generating key ID for ECC (GNUTLS-SA-2014-5)

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.

CVSS 2.0 · 5.0 Medium EPSS 3.3% KEV · Not listed
Vendors
Canonical Gnu Opensuse and 1 more
Products
Ubuntu Linux Gnutls Opensuse and 5 more
CVE-2014-9273

hivex: missing checks for small-sized files

lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Redhat
Products
Hivex Opensuse Enterprise Linux and 4 more
CVE-2014-9657

freetype: off-by-one buffer over-read in tt_face_load_hdmx()

The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2014-9658

freetype: buffer over-read and integer underflow in tt_face_load_kern()

The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2014-9660

freetype: missing ENDCHAR NULL pointer dereference in the _bdf_parse_glyphs()

The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2014-9661

freetype: out of bounds read in Type42 font parser

type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.

CVSS 2.0 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 9 more
CVE-2014-9663

freetype: out-of-bounds read in tt_cmap4_validate()

The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2014-9664

freetype: off-by-one buffer over-read in parse_charstrings() / t42_parse_charstrings()

FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c.

CVSS 2.0 · 6.8 Medium EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2014-9666

freetype: integer overflow in tt_sbit_decoder_init() leading to out-of-bounds read

The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap.

CVSS 2.0 · 6.8 Medium EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 9 more