CVE-2015-3630

docker: Read/write proc paths allow host modification & information disclosure

Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Docker Redhat

Products

Docker Rhel Extras Other

CVE-2015-3631

docker: volume mounts allow LSM profile escalation

Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Docker Redhat

Products

Docker Rhel Extras Other

CVE-2015-3636

kernel: ping sockets: use-after-free leading to local privilege escalation

The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect.

CVSS 2.0 · 4.9 Medium EPSS 2.5% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 5 more

CVE-2015-8438

flash-plugin: multiple code execution issues fixed in APSB15-32

Heap-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted XML object that is mishandled during a toString call, a different vulnerability than CVE-2015-8446.

CVSS 2.0 · 9.3 Critical EPSS 8.0% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Air Air Sdk Air Sdk \& Compiler and 7 more

CVE-2015-4170

kernel: pty layer race condition on tty ldisc shutdown.

Race condition in the ldsem_cmpxchg function in drivers/tty/tty_ldsem.c in the Linux kernel before 3.13-rc4-next-20131218 allows local users to cause a denial of service (ldsem_down_read and ldsem_down_write deadlock) by establishing a new tty thread during shutdown of a previous tty thread.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Linux Compute Node Eus and 6 more

CVE-2015-4428

flash-plugin: multiple code execution issues fixed in APSB15-16

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4430, and CVE-2015-5117.

CVSS 2.0 · 10.0 Critical EPSS 6.7% KEV · Not listed

Vendors

Adobe Apple Linux and 2 more

Products

Air Air Sdk Air Sdk \& Compiler and 5 more

CVE-2015-0347

flash-plugin: multiple code execution issues fixed in APSB15-06

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.

CVSS 2.0 · 10.0 Critical EPSS 6.2% KEV · Not listed

Vendors

Adobe Apple Linux and 4 more

Products

Flash Player Mac Os X Linux Kernel and 9 more

CVE-2015-4430

flash-plugin: multiple code execution issues fixed in APSB15-16

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, and CVE-2015-5117.

CVSS 2.0 · 10.0 Critical EPSS 32.8% KEV · Not listed

Vendors

Adobe Apple Linux and 2 more

Products

Air Air Sdk Air Sdk \& Compiler and 5 more

CVE-2015-0346

flash-plugin: multiple code execution issues fixed in APSB15-06

Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0359.

CVSS 2.0 · 10.0 Critical EPSS 10.4% KEV · Not listed

Vendors

Adobe Apple Linux and 4 more

Products

Flash Player Mac Os X Linux Kernel and 9 more

CVE-2015-4432

flash-plugin: multiple code execution issues fixed in APSB15-16

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3135 and CVE-2015-5118.

CVSS 2.0 · 10.0 Critical EPSS 34.2% KEV · Not listed

Vendors

Adobe Apple Linux and 2 more

Products

Air Air Sdk Air Sdk \& Compiler and 5 more

CVE-2015-8439

flash-plugin: multiple code execution issues fixed in APSB15-32

The SharedObject object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code by leveraging an unspecified "type confusion" during a getRemote call, a different vulnerability than CVE-2015-8456.

CVSS 2.0 · 9.3 Critical EPSS 6.6% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Air Air Sdk Air Sdk \& Compiler and 7 more

CVE-2015-4700

kernel: Crafted BPF filters may crash kernel during JIT optimisation

The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Extras Rt

CVE-2015-4729

JDK: unspecified vulnerability fixed in 7u85 and 8u51 (Deployment)

Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment.

CVSS 2.0 · 4.0 Medium EPSS 2.7% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Rhel Extras and 1 more

CVE-2015-8442

flash-plugin: multiple code execution issues fixed in APSB15-32

Use-after-free vulnerability in the MovieClip object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted filters property value, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

CVSS 2.0 · 9.3 Critical EPSS 6.5% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Air Air Sdk Air Sdk \& Compiler and 7 more

CVE-2015-0342

flash-plugin: multiple code execution issues fixed in APSB15-05

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0341.

CVSS 2.0 · 10.0 Critical EPSS 6.7% KEV · Not listed

Vendors

Adobe Apple Linux and 2 more

Products

Flash Player Mac Os X Linux Kernel and 2 more

CVE-2015-0341

flash-plugin: multiple code execution issues fixed in APSB15-05

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0342.

CVSS 2.0 · 10.0 Critical EPSS 7.0% KEV · Not listed

Vendors

Adobe Apple Linux and 2 more

Products

Flash Player Mac Os X Linux Kernel and 2 more

CVE-2015-8435

flash-plugin: multiple code execution issues fixed in APSB15-32

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

CVSS 2.0 · 10.0 Critical EPSS 6.7% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Air Air Sdk Air Sdk \& Compiler and 7 more

CVE-2015-4736

JDK: unspecified vulnerability fixed in 7u85 and 8u51 (Deployment)

Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0 · 9.3 Critical EPSS 4.4% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Rhel Extras and 1 more

CVE-2015-0340

flash-plugin: file upload restriction bypass (APSB15-05)

Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows remote attackers to bypass intended file-upload restrictions via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed

Vendors

Adobe Apple Linux and 2 more

Products

Flash Player Mac Os X Linux Kernel and 2 more

CVE-2015-0339

flash-plugin: multiple code execution issues fixed in APSB15-05

Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0332, CVE-2015-0333, and CVE-2015-0335.

CVSS 2.0 · 10.0 Critical EPSS 5.5% KEV · Not listed

Vendors

Adobe Apple Linux and 2 more

Products

Flash Player Mac Os X Linux Kernel and 2 more