Export limit exceeded: 425825 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,084

Export CSV
CVE-2017-18232

kernel: Mishandling mutex within libsas allowing local Denial of Service

The Serial Attached SCSI (SAS) implementation in the Linux kernel through 4.15.9 mishandles a mutex within libsas, which allows local users to cause a denial of service (deadlock) by triggering certain error-handling code.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Extras Rt
CVE-2017-18208

kernel: Inifinite loop vulnerability in mm/madvise.c:madvise_willneed() function allows local denial of service

The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 5 more
CVE-2017-18205

zsh: NULL dereference in cd in sh compatibility mode under given circumstances

In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set.

CVSS 3.0 · 8.1 High EPSS 2.0% KEV · Not listed
Vendors
Redhat Zsh Project
Products
Enterprise Linux Zsh
CVE-2017-18203

kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service

The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Extras Rt
CVE-2017-18202

kernel: Infoleak/use-after-free in __oom_reap_task_mm function in mm/oom_kill.c

The __oom_reap_task_mm function in mm/oom_kill.c in the Linux kernel before 4.14.4 mishandles gather operations, which allows attackers to cause a denial of service (TLB entry leak or use-after-free) or possibly have unspecified other impact by triggering a copy_to_user call within a certain time window.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2017-18201

libcdio: Double free in get_cdtext_generic() in lib/driver/_cdio_generic.c

An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.

CVSS 3.0 · 9.8 Critical EPSS 3.3% KEV · Not listed
Vendors
Gnu Redhat
Products
Libcdio Enterprise Linux
CVE-2017-18199

libcdio: NULL pointer dereference in realloc_symlink in rock.c

realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file.

CVSS 3.0 · 6.5 Medium EPSS 3.3% KEV · Not listed
Vendors
Gnu Redhat
Products
Libcdio Enterprise Linux
CVE-2017-18198

libcdio: Heap-based buffer over-read in print_iso9660_recurse function in iso-info.c

print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted iso file.

CVSS 3.0 · 8.8 High EPSS 3.3% KEV · Not listed
Vendors
Gnu Redhat
Products
Libcdio Enterprise Linux
CVE-2017-18190

cups: DNS rebinding attacks via incorrect whitelist

A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Apple Canonical Debian and 1 more
Products
Cups Ubuntu Linux Debian Linux and 1 more
CVE-2017-18189

sox: NULL pointer dereference in startread function in xa.c

In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifying zero channels triggers an infinite loop with a resultant NULL pointer dereference, which may allow a remote attacker to cause a denial-of-service.

CVSS 3.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Debian Redhat Sound Exchange Project
Products
Debian Linux Enterprise Linux Sound Exchange
CVE-2017-18075

kernel: Mishandled freeing of instances in pcrypt.c can allow a local user to cause a denial of service

crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user able to access the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt (CONFIG_CRYPTO_PCRYPT) to cause a denial of service (kfree of an incorrect pointer) or possibly have unspecified other impact by executing a crafted sequence of system calls.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux
CVE-2017-17833

openslp: Heap memory corruption in slpd/slpd_process.c allows denial of service or potentially code execution

OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability.

CVSS 3.0 · 9.8 Critical EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Lenovo and 2 more
Products
Ubuntu Linux Debian Linux Bm Nextscale Fan Power Controller and 59 more
CVE-2017-17742

ruby: HTTP response splitting in WEBrick

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.

CVSS 3.0 · 5.3 Medium EPSS 5.5% KEV · Not listed
Vendors
Debian Redhat Ruby-lang
Products
Debian Linux Enterprise Linux Rhel Aus and 5 more
CVE-2017-17724

exiv2: heap-buffer-overflow in Exiv2::IptcData::printStructure in src/iptc.cpp

In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::IptcData::printStructure function in iptc.cpp, related to the "!= 0x1c" case. Remote attackers can exploit this vulnerability to cause a denial of service via a crafted TIFF file.

CVSS 3.0 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Exiv2 Redhat
Products
Exiv2 Enterprise Linux
CVE-2017-15715

httpd: <FilesMatch> bypass with a trailing newline in the file name

In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.

CVSS 3.0 · 8.1 High EPSS 86.2% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Http Server Ubuntu Linux Debian Linux and 7 more
CVE-2017-15710

httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values

In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all.

CVSS 3.0 · 7.5 High EPSS 17.5% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Http Server Ubuntu Linux Debian Linux and 7 more
CVE-2017-15705

spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service

A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the future.

CVSS 3.0 · 5.3 Medium EPSS 7.9% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Spamassassin Ubuntu Linux Debian Linux and 5 more
CVE-2017-15427

chromium-browser: insufficient blocking of javascript in omnibox

Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more