CVE-2015-7513

Kernel: kvm: divide by zero issue leads to DoS

arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 1 more

Products

Ubuntu Linux Debian Linux Fedora and 1 more

CVE-2015-8551

xen: Linux pciback missing sanity checks leading to crash (XSA-157)

The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka "Linux pciback missing sanity checks."

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Linux Opensuse and 1 more

Products

Debian Linux Linux Kernel Opensuse and 5 more

CVE-2015-8629

krb5: xdr_nullstring() doesn't check for terminating null character

The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.

CVSS 3.1 · 5.3 Medium EPSS 3.7% KEV · Not listed

Vendors

Debian Mit Opensuse and 2 more

Products

Debian Linux Kerberos 5 Leap and 10 more

CVE-2015-8631

krb5: Memory leak caused by supplying a null principal name in request

Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name.

CVSS 3.1 · 6.5 Medium EPSS 4.7% KEV · Not listed

Vendors

Debian Mit Opensuse and 2 more

Products

Debian Linux Kerberos 5 Leap and 9 more

CVE-2015-8767

kernel: SCTP denial of service during timeout

net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does not properly manage the relationship between a lock and a socket, which allows local users to cause a denial of service (deadlock) via a crafted sctp_accept call.

CVSS 3.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 3 more

CVE-2015-8776

glibc: Segmentation fault caused by passing out-of-range data to strftime()

The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain sensitive information via an out-of-range time value.

CVSS 3.0 · 9.1 Critical EPSS 4.8% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 8 more

CVE-2015-8778

glibc: Integer overflow in hcreate and hcreate_r

Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds heap-memory access.

CVSS 3.0 · 9.8 Critical EPSS 5.7% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 8 more

CVE-2015-8779

glibc: Unbounded stack allocation in catopen function

Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.

CVSS 3.0 · 9.8 Critical EPSS 6.2% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 8 more

CVE-2015-8931

libarchive: Undefined behavior (signed integer overflow) in mtree parser

Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Canonical Debian Libarchive and 2 more

Products

Ubuntu Linux Debian Linux Libarchive and 4 more

CVE-2015-8932

libarchive: Undefined behavior / invalid shiftleft in TAR parser

The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file, which triggers an invalid left shift.

CVSS 3.0 · 5.5 Medium EPSS 2.2% KEV · Not listed

Vendors

Canonical Debian Libarchive and 2 more

Products

Ubuntu Linux Debian Linux Libarchive and 4 more

CVE-2016-0505

mysql: unspecified vulnerability in subcomponent: Server: Options (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Options.

CVSS 2.0 · 6.8 Medium EPSS 7.5% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0546

mysql: unspecified vulnerability in subcomponent: Client (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that these are multiple buffer overflows in the mysqlshow tool that allow remote database servers to have unspecified impact via a long table or database name.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0596

mysql: unspecified vulnerability in subcomponent: Server: DML (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML.

CVSS 2.0 · 4.0 Medium EPSS 4.3% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0597

mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 4.3% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0598

mysql: unspecified vulnerability in subcomponent: Server: DML (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML.

CVSS 2.0 · 3.5 Low EPSS 3.9% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0600

mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

CVSS 2.0 · 3.5 Low EPSS 3.9% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0606

mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect integrity via unknown vectors related to encryption.

CVSS 2.0 · 3.5 Low EPSS 4.2% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0608

mysql: unspecified vulnerability in subcomponent: Server: UDF (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to UDF.

CVSS 2.0 · 3.5 Low EPSS 3.9% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0609

mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to privileges.

CVSS 2.0 · 1.7 Low EPSS 4.4% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0616

mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 4.3% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 13 more