Export limit exceeded: 425868 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,386

Export CSV
CVE-2022-3171

Memory handling vulnerability in ProtocolBuffers Java core and lite

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Fedoraproject Google Redhat
Products
Fedora Google-protobuf Protobuf-java and 7 more
CVE-2023-40032

Potential segfault due to NULL pointer dereference in libvips

libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Libvips
Products
Fedora Libvips
CVE-2015-3420

dovecot: SSL/TLS handshake failures leading to a crash of the login process.

The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to handshake failures.

CVSS 3.0 · 5.9 Medium EPSS 2.8% KEV · Not listed
Vendors
Dovecot Fedoraproject
Products
Dovecot Fedora
CVE-2015-3405

ntp: ntp-keygen may generate non-random symmetric keys on big-endian systems

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.

CVSS 3.0 · 7.5 High EPSS 5.3% KEV · Not listed
Vendors
Debian Fedoraproject Ntp and 4 more
Products
Debian Linux Fedora Ntp and 11 more
CVE-2015-1839

salt: insecure /tmp file handling in salt/modules/chef.py

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

CVSS 3.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Saltstack
Products
Fedora Salt
CVE-2015-1838

salt: insecure /tmp file handling in salt/modules/serverdensity_device.py

modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

CVSS 3.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Saltstack
Products
Fedora Salt
CVE-2015-1783

lasso: use of uninitialized value leading to a crash

The prefix variable in the get_or_define_ns function in Lasso before commit 6d854cef4211cdcdbc7446c978f23ab859847cdd allows remote attackers to cause a denial of service (uninitialized memory access and application crash) via unspecified vectors.

CVSS 3.0 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Entrouvert Fedoraproject
Products
Lasso Fedora
CVE-2015-1395

patch: directory traversal via file rename

Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name.

CVSS 3.0 · 7.5 High EPSS 11.3% KEV · Not listed
Vendors
Canonical Fedoraproject Gnu
Products
Ubuntu Linux Fedora Patch
CVE-2015-0296

texlive rpm scriptlet allows unprivileged user to delete arbitrary files

The pre-install script in texlive 3.1.20140525_r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226_r32488.fc20 and rpm allows local users to delete arbitrary files via a crafted file in the user's home directory.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Tug
Products
Fedora Texlive
CVE-2017-8932

golang: Elliptic curves carry propagation issue in x86-64 P-256

A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.

CVSS 3.0 · 5.9 Medium EPSS 2.2% KEV · Not listed
Vendors
Fedoraproject Golang Novell and 2 more
Products
Fedora Go Suse Package Hub For Suse Linux Enterprise and 2 more
CVE-2017-8386

git: Escape out of git-shell

git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.

CVSS 3.0 · 8.8 High EPSS 12.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 4 more
CVE-2017-6362

gd: Double free in the gdImagePngPtr function

Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.

CVSS 3.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 1 more
Products
Ubuntu Linux Debian Linux Fedora and 1 more
CVE-2017-6314

gdk-pixbuf: Infinite loop in io-tiff.c

The make_available_at_least function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (infinite loop) via a large TIFF file.

CVSS 3.1 · 5.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Debian Fedoraproject Gnome
Products
Debian Linux Fedora Gdk-pixbuf
CVE-2017-6313

gdk-pixbuf: Integer underflow in io-icns.c

Integer underflow in the load_resources function in io-icns.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (out-of-bounds read and program crash) via a crafted image entry size in an ICO file.

CVSS 3.1 · 7.1 High EPSS 1.9% KEV · Not listed
Vendors
Debian Fedoraproject Gnome
Products
Debian Linux Fedora Gdk-pixbuf
CVE-2017-6312

gdk-pixbuf: Out-of-bounds read in io-ico.c

Integer overflow in io-ico.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted image entry offset in an ICO file, which triggers an out-of-bounds read, related to compiler optimizations.

CVSS 3.1 · 5.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Debian Fedoraproject Gnome
Products
Debian Linux Fedora Gdk-pixbuf
CVE-2017-6311

gdk-pixbuf: NULL pointer dereference in gdk-pixbuf-thumbnailer

gdk-pixbuf-thumbnailer.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to printing an error message.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Fedoraproject Gnome
Products
Fedora Gdk-pixbuf
CVE-2017-5885

gtk-vnc: Integer overflow when processing SetColorMapEntries

Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow.

CVSS 3.0 · 9.8 Critical EPSS 5.0% KEV · Not listed
Vendors
Fedoraproject Gnome Redhat
Products
Fedora Gtk-vnc Enterprise Linux
CVE-2017-5884

gtk-vnc: Improper check of framebuffer boundaries when processing a tile

gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted (1) rre, (2) hextile, or (3) copyrect tile.

CVSS 3.0 · 7.8 High EPSS 2.3% KEV · Not listed
Vendors
Fedoraproject Gnome Redhat
Products
Fedora Gtk-vnc Enterprise Linux
CVE-2017-5849

netpbm: Calls TIFFRGBA with width and height parameters switched

tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff image file, related to transposing width and height values.

CVSS 3.0 · 5.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Fedoraproject Netpbm Project
Products
Fedora Netpbm