Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,086

Export CSV
CVE-2018-9251

libxml2: infinite loop in xz_decomp function in xzlib.c

The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.

CVSS 3.0 · 5.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Debian Redhat Xmlsoft
Products
Debian Linux Enterprise Linux Libxml2
CVE-2018-9133

ImageMagick: excessive iteration in the DecodeLabImage and EncodeLabImage functions in coders/tiff.c

ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file.

CVSS 3.0 · 6.5 Medium EPSS 3.2% KEV · Not listed
Vendors
Canonical Imagemagick Redhat
Products
Ubuntu Linux Imagemagick Enterprise Linux
CVE-2018-8977

exiv2: invalid memory access in Exiv2::Internal::printCsLensFFFF function in canonmn_int.cpp

In Exiv2 0.26, the Exiv2::Internal::printCsLensFFFF function in canonmn_int.cpp allows remote attackers to cause a denial of service (invalid memory access) via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Exiv2 Redhat
Products
Exiv2 Enterprise Linux
CVE-2018-8976

exiv2: out-of-bounds read in Exiv2::Internal::stringFormat image.cpp

In Exiv2 0.26, jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringFormat out-of-bounds read) via a crafted file.

CVSS 3.1 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Debian Exiv2 Redhat
Products
Debian Linux Exiv2 Enterprise Linux and 3 more
CVE-2018-8945

binutils: Crash in elf.c:bfd_section_from_shdr() with crafted executable

The bfd_section_from_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (segmentation fault) via a large attribute section.

CVSS 3.0 · 5.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Gnu Redhat
Products
Binutils Enterprise Linux Enterprise Linux Desktop and 2 more
CVE-2018-8905

libtiff: heap-based buffer overflow in tif_lzw.c:LZWDecodeCompat() allows for denial of service

In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps.

CVSS 3.1 · 8.8 High EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Libtiff and 1 more
Products
Ubuntu Linux Debian Linux Libtiff and 4 more
CVE-2018-8897

Kernel: error in exception handling leads to DoS

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.

CVSS 3.0 · 7.8 High EPSS 18.5% KEV · Not listed
Vendors
Apple Canonical Citrix and 5 more
Products
Mac Os X Ubuntu Linux Xenserver and 16 more
CVE-2018-8804

ImageMagick: double free in WriteEPTImage function in coders/ept.c

WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact via a crafted file.

CVSS 3.0 · 8.8 High EPSS 3.6% KEV · Not listed
Vendors
Canonical Imagemagick Redhat
Products
Ubuntu Linux Imagemagick Enterprise Linux
CVE-2018-8788

freerdp: Out-of-bounds write in nsc_rle_decode() function

FreeRDP prior to version 2.0.0-rc4 contains an Out-Of-Bounds Write of up to 4 bytes in function nsc_rle_decode() that results in a memory corruption and possibly even a remote code execution.

CVSS 3.0 · 9.8 Critical EPSS 7.4% KEV · Not listed
Vendors
Canonical Debian Freerdp and 1 more
Products
Ubuntu Linux Debian Linux Freerdp and 1 more
CVE-2018-8787

freerdp: Integer overflow leading to heap-based buffer overflow in gdi_Bitmap_Decompress() function

FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_Decompress() and results in a memory corruption and probably even a remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 8.4% KEV · Not listed
Vendors
Canonical Debian Freerdp and 1 more
Products
Ubuntu Linux Debian Linux Freerdp and 7 more
CVE-2018-8786

freerdp: Integer truncation leading to heap-based buffer overflow in update_read_bitmap_update() function

FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 8.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more
CVE-2018-8781

kernel: Integer overflow in drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() can allow attackers to execute code in kernel space

The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel version 3.4 and up to and including 4.15 has an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 5 more
CVE-2018-8780

ruby: Unintentional directory traversal by poisoned NULL byte in Dir

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.

CVSS 3.0 · 9.1 Critical EPSS 10.0% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 6 more
CVE-2018-8779

ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket.

CVSS 3.0 · 7.5 High EPSS 6.9% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 2 more
CVE-2018-8778

ruby: Buffer under-read in String#unpack

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.

CVSS 3.0 · 7.5 High EPSS 7.5% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 6 more
CVE-2018-8777

ruby: DoS by large request in WEBrick

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).

CVSS 3.0 · 7.5 High EPSS 4.5% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 6 more
CVE-2018-8088

slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.

CVSS 3.1 · 9.8 Critical EPSS 14.7% KEV · Not listed
Vendors
Oracle Qos Redhat
Products
Goldengate Application Adapters Goldengate Stream Analytics Utilities Framework and 20 more
CVE-2018-8087

kernel: Memory leak in drivers/net/wireless/mac80211_hwsim.c:hwsim_new_radio_nl() can lead to potential denial of service

Memory leak in the hwsim_new_radio_nl function in drivers/net/wireless/mac80211_hwsim.c in the Linux kernel through 4.15.9 allows local users to cause a denial of service (memory consumption) by triggering an out-of-array error case.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 2 more
CVE-2018-8039

apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old com.sun.net.ssl.HostnameVerifier interface. However, the default HostnameVerifier implementation in CXF does not implement the method in this interface, and an exception is thrown. However, in Apache CXF prior to 3.2.5 and 3.1.16 the exception is caught in the reflection code and not properly propagated. What this means is that if you are using the com.sun.net.ssl stack with CXF, an error with TLS hostname verification will not be thrown, leaving a CXF client subject to man-in-the-middle attacks.

CVSS 3.0 · 8.1 High EPSS 8.2% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Enterprise Linux Jboss Amq and 3 more
CVE-2018-8037

tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up

If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.

CVSS 3.0 · 5.9 Medium EPSS 11.2% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Tomcat Debian Linux Enterprise Linux and 1 more