CVE-2007-6427

xfree86: memory corruption via XInput extension

The XInput extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code via requests related to byte swapping and heap corruption within multiple functions, a different vulnerability than CVE-2007-4990.

CVSS 2.0 · 9.3 Critical EPSS 4.3% KEV · Not listed

Vendors

Apple Canonical Debian and 5 more

Products

Mac Os X Ubuntu Linux Debian Linux and 9 more

CVE-2007-6428

xfree86: information disclosure via TOG-CUP extension

The ProcGetReservedColormapEntries function in the TOG-CUP extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to read the contents of arbitrary memory locations via a request containing a 32-bit value that is improperly used as an array index.

CVSS 2.0 · 5.0 Medium EPSS 1.7% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Tog-cup Xserver

CVE-2007-6429

xfree86: integer overflow in EVI extension

Multiple integer overflows in X.Org Xserver before 1.4.1 allow context-dependent attackers to execute arbitrary code via (1) a GetVisualInfo request containing a 32-bit value that is improperly used to calculate an amount of memory for allocation by the EVI extension, or (2) a request containing values related to pixmap size that are improperly used in management of shared memory by the MIT-SHM extension.

CVSS 2.0 · 9.3 Critical EPSS 2.5% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Evi Mit-shm and 1 more

CVE-2007-6438

wireshark SMB dissector crash

Unspecified vulnerability in the SMB dissector in Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service via unknown vectors. NOTE: this identifier originally included MP3 and NCP, but those issues are already covered by CVE-2007-6111.

CVSS 2.0 · 5.0 Medium EPSS 2.0% KEV · Not listed

Vendors

Redhat Wireshark

Products

Enterprise Linux Wireshark

CVE-2007-6439

wireshark IPv6 and USB dissector crash

Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (infinite or large loop) via the (1) IPv6 or (2) USB dissector, which can trigger resource consumption or a crash. NOTE: this identifier originally included Firebird/Interbase, but it is already covered by CVE-2007-6116. The DCP ETSI issue is already covered by CVE-2007-6119.

CVSS 2.0 · 6.1 Medium EPSS 1.3% KEV · Not listed

Vendors

Redhat Wireshark

Products

Enterprise Linux Wireshark

CVE-2007-6441

wireshark WiMAX dissector possible crash

The WiMAX dissector in Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (crash) via unknown vectors related to "unaligned access on some platforms."

CVSS 2.0 · 3.3 Low EPSS 1.0% KEV · Not listed

Vendors

Redhat Wireshark

Products

Enterprise Linux Wireshark

CVE-2007-6450

wireshark RPL dissector crash

The RPL dissector in Wireshark (formerly Ethereal) 0.9.8 to 0.99.6 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.

CVSS 2.0 · 5.0 Medium EPSS 2.9% KEV · Not listed

Vendors

Redhat Wireshark

Products

Enterprise Linux Wireshark

CVE-2007-6451

wireshark CIP dissector crash

Unspecified vulnerability in the CIP dissector in Wireshark (formerly Ethereal) 0.9.14 to 0.99.6 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger allocation of large amounts of memory.

CVSS 2.0 · 4.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Redhat Wireshark

Products

Enterprise Linux Wireshark

CVE-2007-6598

dovecot LDAP+auth cache user login mixup

Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.

CVSS 2.0 · 6.8 Medium EPSS 2.0% KEV · Not listed

Vendors

Dovecot Redhat

Products

Dovecot Enterprise Linux

CVE-2007-6600

PostgreSQL privilege escalation

PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VACUUM and (2) ANALYZE operations within index functions, and supports (3) SET ROLE and (4) SET SESSION AUTHORIZATION within index functions, which allows remote authenticated users to gain privileges.

CVSS 2.0 · 6.5 Medium EPSS 3.1% KEV · Not listed

Vendors

Postgresql Redhat

Products

Postgresql Enterprise Linux Rhel Application Stack

CVE-2007-6601

PostgreSQL privilege escalation via dblink

The DBLink module in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21, when local trust or ident authentication is used, allows remote attackers to gain privileges via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2007-3278.

CVSS 2.0 · 7.2 High EPSS 1.6% KEV · Not listed

Vendors

Debian Fedoraproject Postgresql and 1 more

Products

Debian Linux Fedora Postgresql and 2 more

CVE-2007-6694

/proc/cpuinfo DoS on some ppc machines

The chrp_show_cpuinfo function (chrp/setup.c) in Linux kernel 2.4.21 through 2.6.18-53, when running on PowerPC, might allow local users to cause a denial of service (crash) via unknown vectors that cause the of_get_property function to fail, which triggers a NULL pointer dereference.

CVSS 2.0 · 7.8 High EPSS 2.6% KEV · Not listed

Vendors

Apple Linux Redhat

Products

Powerpc Linux Kernel Enterprise Linux

CVE-2007-6698

openldap: slapd crash on NOOP control operation on entry in bdb storage

The BDB backend for slapd in OpenLDAP before 2.3.36 allows remote authenticated users to cause a denial of service (crash) via a potentially-successful modify operation with the NOOP control set to critical, possibly due to a double free vulnerability.

CVSS 2.0 · 4.0 Medium EPSS 2.0% KEV · Not listed

Vendors

Openldap Redhat

Products

Openldap Enterprise Linux

CVE-2007-6712

kernel: infinite loop in highres timers (kernel hang)

Integer overflow in the hrtimer_forward function (hrtimer.c) in Linux kernel 2.6.21-rc4, when running on 64-bit systems, allows local users to cause a denial of service (infinite loop) via a timer with a large expiry value, which causes the timer to always be expired.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Kernel Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg

CVE-2007-6716

kernel: dio: zero struct dio with kzalloc instead of manually

fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct, which allows local users to cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 4 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 5 more

CVE-2007-6725

ghostscript: DoS (crash) in CCITTFax decoding filter

The CCITTFax decoding filter in Ghostscript 8.60, 8.61, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF file that triggers a buffer underflow in the cf_decode_2d function.

CVSS 2.0 · 7.5 High EPSS 4.8% KEV · Not listed

Vendors

Ghostscript Redhat

Products

Ghostscript Enterprise Linux

CVE-2007-6720

mikmod: crash or abort when loading/playing multiple files with different number of channels

libmikmod 3.1.9 through 3.2.0, as used by MikMod, SDL-mixer, and possibly other products, relies on the channel count of the last loaded song, rather than the currently playing song, for certain playback calculations, which allows user-assisted attackers to cause a denial of service (application crash) by loading multiple songs (aka MOD files) with different numbers of channels.

CVSS 2.0 · 4.3 Medium EPSS 2.3% KEV · Not listed

Vendors

Igno Saitz Redhat

Products

Libmikmod Enterprise Linux

CVE-2008-0001

kernel: filesystem corruption by unprivileged user via directory truncation

VFS in the Linux kernel before 2.6.22.16, and 2.6.23.x before 2.6.23.14, performs tests of access mode by using the flag variable instead of the acc_mode variable, which might allow local users to bypass intended permissions and remove directories.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2008-0003

tog-pegasus pam authentication buffer overflow

Stack-based buffer overflow in the PAMBasicAuthenticator::PAMCallback function in OpenPegasus CIM management server (tog-pegasus), when compiled to use PAM and without PEGASUS_USE_PAM_STANDALONE_PROC defined, might allow remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2007-5360.

CVSS 2.0 · 10.0 Critical EPSS 7.8% KEV · Not listed

Vendors

Openpegasus Redhat

Products

Management Server Enterprise Linux Enterprise Linux Desktop and 1 more

CVE-2008-0005

mod_proxy_ftp XSS

mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.

CVSS 2.0 · 4.3 Medium EPSS 14.7% KEV · Not listed

Vendors

Apache Canonical Fedoraproject and 1 more

Products

Http Server Ubuntu Linux Fedora and 3 more