Export limit exceeded: 17085 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,085

Export CSV
CVE-2017-7558

kernel: Out of bounds read in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() in SCTP stack

A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions present since version 4.7-rc1 through version 4.13. A data leak happens when these functions fill in sockaddr data structures used to export socket's diagnostic information. As a result, up to 100 bytes of the slab data could be leaked to a userspace.

CVSS 3.0 · 5.1 Medium EPSS 3.6% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 2 more
CVE-2017-7543

openstack-neutron: iptables not active after update

A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.

CVSS 3.0 · 5.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Openstack Redhat
Products
Neutron Enterprise Linux Openstack
CVE-2017-7539

Qemu: qemu-nbd crashes due to undefined I/O coroutine

An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where the I/O coroutine was undefined. This could crash the qemu-nbd server if a client sent unexpected data during connection negotiation. A remote user or process could use this flaw to crash the qemu-nbd server resulting in denial of service.

CVSS 3.0 · 5.3 Medium EPSS 5.5% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack and 1 more
CVE-2017-7537

pki-core: mock CMC authentication plugin with hardcoded secret enabled by default

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.

CVSS 3.0 · 5.9 Medium EPSS 1.5% KEV · Not listed
Vendors
Dogtagpki Redhat
Products
Dogtagpki Enterprise Linux Enterprise Linux Desktop and 2 more
CVE-2017-7536

hibernate-validator: Privilege escalation when running under the security manager

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Hibernate Validator Jboss Amq and 6 more
CVE-2017-7518

Kernel: KVM: debug exception via syscall emulation

A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB) being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate their privileges inside the guest. Linux guests are not affected by this.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 7 more
CVE-2017-7481

ansible: Security issue with lookup return not tainting the jinja2 environment

Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.

CVSS 3.1 · 9.8 Critical EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Redhat
Products
Ubuntu Linux Debian Linux Ansible Engine and 11 more
CVE-2017-7000

chromium-browser: pointer disclosure in sqlite

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

CVSS 3.0 · 8.8 High EPSS 3.0% KEV · Not listed
Vendors
Apple Chromium Debian and 1 more
Products
Iphone Os Mac Os X Chromium and 5 more
CVE-2017-5731

edk2: Privilege escalation via processing of malformed files in TianoCompress.c

Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tianocore
Products
Enterprise Linux Edk2
CVE-2017-5467

Mozilla: Memory corruption when drawing Skia content (MFSA 2017-12)

A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 4 more
CVE-2017-5464

Mozilla: Memory corruption with accessibility and DOM manipulation (MFSA 2017-11, MFSA 2017-12)

During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 2.6% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5428

Mozilla: integer overflow in createImageBitmap() (MFSA 2017-08)

An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the "createImageBitmap" API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. This vulnerability affects Firefox ESR < 52.0.1 and Firefox < 52.0.1.

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Enterprise Linux and 5 more
CVE-2017-5333

icoutils: Integer overflow vulnerability in extract.c

Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) or execute arbitrary code via a crafted executable file.

CVSS 3.1 · 7.8 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Icoutils Project and 2 more
Products
Ubuntu Linux Debian Linux Icoutils and 8 more
CVE-2017-5332

icoutils: Access to unallocated memory possible in extract.c

The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Icoutils Project and 2 more
Products
Ubuntu Linux Debian Linux Icoutils and 8 more
CVE-2017-3145

Improper fetch cleanup sequencing in the resolver can cause named to crash

BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.

CVSS 3.1 · 7.5 High EPSS 27.7% KEV · Not listed
Vendors
Debian Isc Juniper and 2 more
Products
Debian Linux Bind Junos and 40 more
CVE-2017-3144

Failure to properly clean up closed OMAPI connections can exhaust available sockets

A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested.

CVSS 3.1 · 7.5 High EPSS 72.7% KEV · Not listed
Vendors
Canonical Debian Isc and 1 more
Products
Ubuntu Linux Debian Linux Dhcp and 7 more
CVE-2017-3143

An error in TSIG authentication can permit unauthorized dynamic updates

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.

CVSS 3.0 · 7.5 High EPSS 18.2% KEV · Not listed
Vendors
Debian Isc Redhat
Products
Debian Linux Bind Enterprise Linux and 6 more
CVE-2017-3142

An error in TSIG authentication can permit unauthorized zone transfers

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.

CVSS 3.0 · 5.3 Medium EPSS 5.4% KEV · Not listed
Vendors
Debian Isc Redhat
Products
Debian Linux Bind Enterprise Linux and 6 more
CVE-2017-3137

A response packet can cause a resolver to terminate when processing an answer containing a CNAME or DNAME

Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8.

CVSS 3.0 · 7.5 High EPSS 8.9% KEV · Not listed
Vendors
Debian Isc Netapp and 1 more
Products
Debian Linux Bind Data Ontap Edge and 13 more