CVE-2017-6074

kernel: use after free in dccp protocol

The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.

CVSS 3.1 · 7.8 High EPSS 6.0% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 6 more

CVE-2017-5461

nss: Write beyond bounds caused by bugs in Base64 de/encoding in nssb64d.c and nssb64e.c (MFSA 2017-10)

Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations.

CVSS 3.0 · 9.8 Critical EPSS 4.7% KEV · Not listed

Vendors

Mozilla Redhat

Products

Network Security Services Enterprise Linux Rhel Aus and 4 more

CVE-2017-3169

httpd: mod_ssl NULL pointer dereference

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.

CVSS 3.0 · 9.8 Critical EPSS 20.0% KEV · Not listed

Vendors

Apache Redhat

Products

Http Server Enterprise Linux Jboss Core Services and 2 more

CVE-2017-2647

kernel: Null pointer dereference in search_keyring

The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 3 more

CVE-2017-2636

kernel: Race condition access to n_hdlc.tbuf causes double free in n_hdlc_release()

Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline.

CVSS 3.1 · 7.0 High EPSS 1.0% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 6 more

CVE-2017-17558

kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow

The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device.

CVSS 3.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat Suse

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 3 more

CVE-2017-17449

kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe systemwide activity

The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 2 more

CVE-2017-16939

Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation

The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 3 more

CVE-2017-15274

kernel: dereferencing NULL payload with nonzero length

security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in conjunction with a nonzero length value, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted add_key or keyctl system call, a different vulnerability than CVE-2017-12192.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2017-15265

kernel: Use-after-free in snd_seq_ioctl_create_port()

Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 4 more

CVE-2017-14494

dnsmasq: information leak in the DHCPv6 relay code

dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests.

CVSS 3.0 · 5.9 Medium EPSS 70.5% KEV · Not listed

Vendors

Canonical Debian Novell and 2 more

Products

Ubuntu Linux Debian Linux Leap and 6 more

CVE-2017-14493

dnsmasq: stack buffer overflow in the DHCPv6 code

Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.

CVSS 3.0 · 9.8 Critical EPSS 85.2% KEV · Not listed

Vendors

Canonical Debian Opensuse and 2 more

Products

Ubuntu Linux Debian Linux Leap and 6 more

CVE-2017-14492

dnsmasq: heap overflow in the IPv6 router advertisement code

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.

CVSS 3.0 · 9.8 Critical EPSS 94.5% KEV · Not listed

Vendors

Canonical Debian Novell and 2 more

Products

Ubuntu Linux Debian Linux Leap and 6 more

CVE-2017-14491

dnsmasq: heap overflow in the code responsible for building DNS replies

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

CVSS 3.1 · 9.8 Critical EPSS 86.5% KEV · Not listed

Vendors

Arista Arubanetworks Canonical and 10 more

Products

Eos Arubaos Ubuntu Linux and 32 more

CVE-2017-13166

kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation

An elevation of privilege vulnerability in the kernel v4l2 video driver. Product: Android. Versions: Android kernel. Android ID A-34624167.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Android Enterprise Linux Enterprise Mrg and 2 more

CVE-2017-12613

apr: Out-of-bounds array deref in apr_time_exp*() functions

When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.

CVSS 3.1 · 7.1 High EPSS 1.7% KEV · Not listed

Vendors

Apache Debian Redhat

Products

Portable Runtime Debian Linux Enterprise Linux and 14 more

CVE-2017-12190

kernel: memory leak when merging buffers in SCSI IO vectors

The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 2 more

CVE-2017-12154

Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register

The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-store exiting" L0 vmcs02 controls exist in cases where L1 omits the "use TPR shadow" vmcs12 control, which allows KVM L2 guest OS users to obtain read and write access to the hardware CR8 register.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2017-11600

kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message

net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 2 more

CVE-2017-10661

kernel: Handling of might_cancel queueing is not properly pretected against race

Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing.

CVSS 3.1 · 7.0 High EPSS 13.5% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 9 more