Export limit exceeded: 10090 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,090

Export CSV
CVE-2022-2869

libtiff: tiffcrop.c has uint32_t underflow which leads to out of bounds read and write in extractContigSamples8bits()

libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Libtiff and 1 more
Products
Debian Linux Fedora Libtiff and 1 more
CVE-2022-2868

libtiff: Invalid crop_width and/or crop_length could cause an out-of-bounds read in reverseSamples16bits()

libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Libtiff and 1 more
Products
Debian Linux Fedora Libtiff and 1 more
CVE-2022-2867

libtiff: uint32_t underflow leads to out of bounds read and write in tiffcrop.c

libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Libtiff and 1 more
Products
Debian Linux Fedora Libtiff and 1 more
CVE-2022-2787

stricter rules on chroot names

Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Debian
Products
Debian Linux Schroot
CVE-2022-2735

pcs: obtaining an authentication token for hacluster user could lead to privilege escalation

A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemons. A privilege escalation could happen by obtaining an authentication token for a hacluster user. With the "hacluster" token, this flaw allows an attacker to have complete control over the cluster managed by PCS.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Clusterlabs Debian Redhat
Products
Pcs Debian Linux Enterprise Linux and 1 more
CVE-2022-2553

booth: authfile directive in booth config file is completely ignored.

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Clusterlabs Debian Fedoraproject and 1 more
Products
Booth Debian Linux Fedora and 2 more
CVE-2022-2521

libtiff: Invalid pointer free operation in TIFFClose() at tif_close.c

It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Libtiff Redhat
Products
Debian Linux Libtiff Enterprise Linux
CVE-2022-2520

libtiff: Assertion fail in rotateImage() function at tiffcrop.c

A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Libtiff Redhat
Products
Debian Linux Libtiff Enterprise Linux
CVE-2022-2469

libgsasl: Out of bounds read causes DoS

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client

CVSS 3.1 · 3.8 Low EPSS 1.6% KEV · Not listed
Vendors
Debian Gnu
Products
Debian Linux Gnu Sasl
CVE-2022-2318

Kernel: A use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c

There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp
Products
Debian Linux Linux Kernel H300s and 9 more
CVE-2022-2255

mod_wsgi: Trusted Proxy Headers Removing Bypass

A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Debian Modwsgi Redhat
Products
Debian Linux Mod Wsgi Enterprise Linux
CVE-2022-2132

dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs

A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.

CVSS 3.1 · 8.6 High EPSS 2.4% KEV · Not listed
Vendors
Debian Dpdk Fedoraproject and 1 more
Products
Debian Linux Data Plane Development Kit Fedora and 12 more
CVE-2022-2058

libtiff: division by zero issues in tiffcrop

Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Libtiff and 2 more
Products
Debian Linux Fedora Libtiff and 2 more
CVE-2022-2057

libtiff: division by zero issues in tiffcrop

Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Libtiff and 2 more
Products
Debian Linux Fedora Libtiff and 2 more
CVE-2022-2056

libtiff: division by zero issues in tiffcrop

Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Libtiff and 2 more
Products
Debian Linux Fedora Libtiff and 2 more
CVE-2022-2048

http2-server: Invalid HTTP/2 requests cause DoS

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Debian Eclipse Jenkins and 2 more
Products
Debian Linux Jetty Jenkins and 9 more
CVE-2022-2047

jetty-http: improver hostname input handling

In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.

CVSS 3.1 · 2.7 Low EPSS 1.3% KEV · Not listed
Vendors
Debian Eclipse Netapp and 1 more
Products
Debian Linux Jetty Element Plug-in For Vcenter Server and 6 more
CVE-2022-29901

Arbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed)

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.

CVSS 3.1 · 5.6 Medium EPSS 5.0% KEV · Not listed
Vendors
Debian Fedoraproject Intel and 3 more
Products
Debian Linux Fedora Core I3-6100 and 255 more
CVE-2022-29900

hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions

Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.

CVSS 3.1 · 6.5 Medium EPSS 3.9% KEV · Not listed
Vendors
Amd Debian Fedoraproject and 2 more
Products
A10-9600p A10-9600p Firmware A10-9630p and 250 more