Export limit exceeded: 17086 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,086

Export CSV
CVE-2018-1120

kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service

A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).

CVSS 3.0 · 2.8 Low EPSS 7.1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 10 more
CVE-2018-1118

kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg()

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.

CVSS 3.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 6 more
CVE-2018-1116

polkit: Improper authorization in polkit_backend_interactive_authority_check_authorization function in polkitd

A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.

CVSS 3.1 · 4.4 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Polkit Project and 1 more
Products
Ubuntu Linux Debian Linux Polkit and 1 more
CVE-2018-1114

undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.

CVSS 3.0 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Jboss Fuse and 4 more
CVE-2018-1113

setup: nologin listed in /etc/shells violates security expectations

setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to /sbin/nologin could still access the system.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 3 more
CVE-2018-1112

glusterfs: auth.allow allows unauthenticated clients to mount gluster volumes (CVE-2018-1088 regression)

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.

CVSS 3.0 · 8 High EPSS 2.3% KEV · Not listed
Vendors
Gluster Redhat
Products
Glusterfs Enterprise Linux Storage
CVE-2018-1111

dhcp: Command injection vulnerability in the DHCP client NetworkManager integration script

DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.

CVSS 3.0 · 7.5 High EPSS 97.9% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 8 more
CVE-2018-1106

PackageKit: authentication bypass allows to install signed packages without administrator privileges

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Packagekit Project and 1 more
Products
Ubuntu Linux Debian Linux Packagekit and 7 more
CVE-2018-1100

zsh: buffer overflow in utils.c:checkmailpath() can lead to local arbitrary code execution

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Redhat Zsh
Products
Ubuntu Linux Enterprise Linux Enterprise Linux Desktop and 3 more
CVE-2018-1095

kernel: out-of-bound access in fs/posix_acl.c:get_acl() causes crash with crafted ext4 image

The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate xattr sizes, which causes misinterpretation of a size as an error code, and consequently allows attackers to cause a denial of service (get_acl NULL pointer dereference and system crash) via a crafted ext4 image.

CVSS 3.0 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2018-1094

kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image

The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image.

CVSS 3.1 · 5.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 4 more
CVE-2018-1092

kernel: NULL pointer dereference in ext4/mballoc.c:ext4_process_freed_data() when mounting crafted ext4 image

The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory with a zero i_links_count, which allows attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image.

CVSS 3.0 · 5.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Extras Rt
CVE-2018-1091

kernel: guest kernel crash during core dump on POWER9 host

In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2018-1089

389-ds-base: ns-slapd crash via large filter value in ldapsearch

389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.

CVSS 3.0 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Debian Fedoraproject Redhat
Products
Debian Linux 389 Directory Server Enterprise Linux and 3 more
CVE-2018-1088

glusterfs: Privilege escalation via gluster_shared_storage when snapshot scheduling is enabled

A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.

CVSS 3.1 · 8.1 High EPSS 5.5% KEV · Not listed
Vendors
Debian Opensuse Redhat
Products
Debian Linux Leap Enterprise Linux and 5 more
CVE-2018-1087

Kernel: KVM: error in exception handling leads to wrong debug stack value

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.

CVSS 3.0 · 8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 13 more
CVE-2018-1086

pcs: Debug parameter removal bypass, allowing information disclosure

pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege.

CVSS 3.0 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Clusterlabs Debian Redhat
Products
Pacemaker Command Line Interface Debian Linux Enterprise Linux and 1 more
CVE-2018-1083

zsh: Stack-based buffer overflow in gen_matches_files() at compctl.c

Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 4 more
CVE-2018-1080

pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.

CVSS 3.0 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Dogtagpki Redhat
Products
Dogtagpki Enterprise Linux