Export limit exceeded: 17085 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,085

Export CSV
CVE-2018-10177

ImageMagick: Infinite loop in coders/png.c:ReadOneMNGImage() allows attackers to cause a denial of service via crafted MNG file

In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng file.

CVSS 3.0 · 6.5 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Imagemagick Redhat
Products
Ubuntu Linux Imagemagick Enterprise Linux
CVE-2018-10120

libreoffice: Out of bounds write in filter/ww8/ww8toolbar.cxx:SwCTBWrapper class allows for denial of service with crafted document

The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Libreoffice and 1 more
Products
Ubuntu Linux Debian Linux Libreoffice and 4 more
CVE-2018-10119

libreoffice: Use-after-free in sdstor/stgstrms.cxx:StgSmallStrm class allows for denial of service with crafted document

sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format.

CVSS 3.0 · 7.8 High EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Libreoffice and 1 more
Products
Ubuntu Linux Debian Linux Libreoffice and 4 more
CVE-2018-1002200

plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

CVSS 3.0 · 5.5 Medium EPSS 11.6% KEV · Not listed
Vendors
Codehaus-plexus Debian Redhat
Products
Plexus-archiver Debian Linux Enterprise Linux and 3 more
CVE-2018-1000878

libarchive: Use after free in RAR decoder resulting in a denial of service

libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c that can result in Crash/DoS - it is unknown if RCE is possible. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.

CVSS 3.1 · 8.8 High EPSS 4.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 6 more
CVE-2018-1000877

libarchive: Double free in RAR decoder resulting in a denial of service

libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar->lzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.

CVSS 3.1 · 8.8 High EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2018-1000876

binutils: integer overflow leads to heap-based buffer overflow in objdump

binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Gnu Redhat
Products
Ubuntu Linux Binutils Ansible Tower and 4 more
CVE-2018-1000858

gnupg2: Cross site request forgery in dirmngr resulting in an information disclosure or denial of service

GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.

CVSS 3.0 · 8.8 High EPSS 1.0% KEV · Not listed
Vendors
Canonical Gnupg Redhat
Products
Ubuntu Linux Gnupg Enterprise Linux
CVE-2018-1000852

freerdp: out of bounds read in drdynvc_process_capability_request

FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in channels/drdynvc/client/drdynvc_main.c, drdynvc_process_capability_request that can result in The RDP server can read the client's memory.. This attack appear to be exploitable via RDPClient must connect the rdp server with echo option. This vulnerability appears to have been fixed in after commit 205c612820dac644d665b5bb1cdf437dc5ca01e3.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Canonical Fedoraproject Freerdp and 1 more
Products
Ubuntu Linux Fedora Freerdp and 1 more
CVE-2018-1000808

pyOpenSSL: Failure to release memory before removing last reference in PKCS #12 Store

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.

CVSS 3.0 · 5.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Pyopenssl Project Redhat
Products
Ubuntu Linux Pyopenssl Enterprise Linux Desktop and 4 more
CVE-2018-1000807

pyOpenSSL: Use-after-free in X509 object handling

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.

CVSS 3.1 · 8.1 High EPSS 4.1% KEV · Not listed
Vendors
Canonical Pyopenssl Redhat
Products
Ubuntu Linux Pyopenssl Enterprise Linux Desktop and 3 more
CVE-2018-1000805

python-paramiko: Authentication bypass in auth_handler.py

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.

CVSS 3.1 · 8.8 High EPSS 4.4% KEV · Not listed
Vendors
Canonical Debian Paramiko and 1 more
Products
Ubuntu Linux Debian Linux Paramiko and 12 more
CVE-2018-1000801

okular: Directory traversal in function unpackDocumentArchive() in core/document.cpp

okular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" in "core/document.cpp" that can result in Arbitrary file creation on the user workstation. This attack appear to be exploitable via he victim must open a specially crafted Okular archive. This issue appears to have been corrected in version 18.08.1

CVSS 3.0 · 5.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Kde Redhat
Products
Debian Linux Okular Enterprise Linux
CVE-2018-1000632

dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

CVSS 3.1 · 7.5 High EPSS 6.6% KEV · Not listed
Vendors
Debian Dom4j Project Netapp and 2 more
Products
Debian Linux Dom4j Oncommand Workflow Automation and 14 more
CVE-2018-1000204

kernel: Infoleak caused by incorrect handling of the SG_IO ioctl

Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties dispute the relevance of this report, noting that the requirement for an attacker to have both the CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it "virtually impossible to exploit.

CVSS 3.0 · 5.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 1 more
CVE-2018-1000200

kernel: NULL pointer dereference on OOM kill of large mlocked process

The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory (OOM) killing of large mlocked processes. The issue arises from an oom killed process's final thread calling exit_mmap(), which calls munlock_vma_pages_all() for mlocked vmas.This can happen synchronously with the oom reaper's unmap_page_range() since the vma's VM_LOCKED bit is cleared before munlocking (to determine if any other vmas share the memory and are mlocked).

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2018-1000199

kernel: ptrace() incorrect error handling leads to corruption and DoS

The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result in crash and possibly memory corruption. This attack appear to be exploitable via local code execution and the ability to use ptrace. This vulnerability appears to have been fixed in git commit f67b15037a7a50c57f72e69a6d59941ad90a0f0f.

CVSS 3.0 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 13 more
CVE-2018-1000140

librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c

rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.

CVSS 3.0 · 9.8 Critical EPSS 9.3% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 11 more