Export limit exceeded: 17086 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,086

Export CSV
CVE-2018-19115

keepalived: Heap-based buffer overflow when parsing HTTP status codes allows for denial of service or possibly arbitrary code execution

keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extract_status_code in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap.

CVSS 3.0 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Debian Keepalived Redhat
Products
Debian Linux Keepalived Enterprise Linux and 6 more
CVE-2018-19108

exiv2: infinite loop in Exiv2::PsdImage::readMetadata in psdimage.cpp

In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of service (infinite loop) caused by an integer overflow via a crafted PSD image file.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Exiv2 and 1 more
Products
Ubuntu Linux Debian Linux Exiv2 and 4 more
CVE-2018-19107

exiv2: heap-based buffer over-read in Exiv2::IptcParser::decode in iptc.cpp

In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp (called from psdimage.cpp in the PSD image reader) may suffer from a denial of service (heap-based buffer over-read) caused by an integer overflow via a crafted PSD image file.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Canonical Debian Exiv2 and 1 more
Products
Ubuntu Linux Debian Linux Exiv2 and 4 more
CVE-2018-19060

poppler: pdfdetach utility does not validate save paths

An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Freedesktop Redhat
Products
Ubuntu Linux Poppler Enterprise Linux
CVE-2018-19059

poppler: out-of-bounds read in EmbFile::save2 in FileSpec.cc

An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.

CVSS 3.0 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Canonical Freedesktop Redhat
Products
Ubuntu Linux Poppler Enterprise Linux
CVE-2018-19058

poppler: reachable abort in Object.h

An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Freedesktop and 1 more
Products
Ubuntu Linux Debian Linux Poppler and 4 more
CVE-2018-19044

keepalived: Improper pathname validation allows for overwrite of arbitrary filenames via symlinks

keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Keepalived Redhat
Products
Keepalived Enterprise Linux
CVE-2018-18915

exiv2: infinite loop in Exiv2::Image::printIFDStructure function in image.cpp

There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.27-RC1. A crafted input will lead to a remote denial of service attack.

CVSS 3.0 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Exiv2 Redhat
Products
Exiv2 Enterprise Linux
CVE-2018-18897

poppler: memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc

An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Freedesktop and 1 more
Products
Ubuntu Linux Debian Linux Poppler and 7 more
CVE-2018-18751

gettext: double free in default_add_message in read-catalog.c

An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-catalog.c, related to an invalid free in po_gram_parse in po-gram-gen.y, as demonstrated by lt-msgfmt.

CVSS 3.0 · 9.8 Critical EPSS 4.3% KEV · Not listed
Vendors
Canonical Gnu Redhat
Products
Ubuntu Linux Gettext Enterprise Linux and 1 more
CVE-2018-18690

kernel: filesystem corruption due to an unchecked error condition during an xfs attribute change

In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because xfs_attr_shortform_addname in fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE operations with conversion of an attr from short to long form.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 2 more
CVE-2018-18624

grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen

Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

CVSS 3.1 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Grafana Redhat
Products
Grafana Enterprise Linux Openshift
CVE-2018-18585

libmspack: chmd_read_headers() fails to reject filenames containing NULL bytes

chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name).

CVSS 3.1 · 4.3 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Kyzer and 3 more
Products
Ubuntu Linux Debian Linux Libmspack and 6 more
CVE-2018-18559

kernel: Use-after-free due to race condition in AF_PACKET implementation

In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control.

CVSS 3.1 · 8.1 High EPSS 2.6% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Linux Desktop and 13 more
CVE-2018-18557

libtiff: Out-of-bounds write in tif_jbig.c

LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size, which leads to a tif_jbig.c JBIGDecode out-of-bounds write.

CVSS 3.0 · 8.8 High EPSS 15.0% KEV · Not listed
Vendors
Canonical Debian Libtiff and 1 more
Products
Ubuntu Linux Debian Linux Libtiff and 1 more
CVE-2018-18544

ImageMagick: memory leak in WriteMSLImage of coders/msl.c

There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31.

CVSS 3.0 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Graphicsmagick Imagemagick Opensuse and 1 more
Products
Graphicsmagick Imagemagick Leap and 1 more
CVE-2018-18521

elfutils: Divide-by-zero in arlib_add_symbols function in arlib.c

Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.

CVSS 3.1 · 5.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Elfutils Project and 2 more
Products
Ubuntu Linux Debian Linux Elfutils and 6 more