Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,826

CVE-2018-15686

systemd: reexec state injection: fgets() on overlong lines leads to line splitting

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.

CVSS 3.1 · 7.8 High EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Oracle and 2 more
Products
Ubuntu Linux Debian Linux Communications Cloud Native Core Network Function Cloud Native Environment and 7 more
CVE-2018-1000517

busybox: wget: Heap-based buffer overflow in the retrieve_file_data() function

BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.

CVSS 3.1 · 8 High EPSS 32.5% KEV · Not listed
Vendors
Busybox Canonical Debian
Products
Busybox Ubuntu Linux Debian Linux
CVE-2018-1000500

busybox: wget: Missing SSL certificate validation

Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file".

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Busybox
Products
Busybox
CVE-2018-1000168

nghttp2: Null pointer dereference when too large ALTSVC frame is received

nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.

CVSS 3.1 · 7.5 High EPSS 10.6% KEV · Not listed
Vendors
Debian Nghttp2 Nodejs and 1 more
Products
Debian Linux Nghttp2 Node.js and 1 more
CVE-2017-18018

coreutils: race condition vulnerability in chown and chgrp

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Gnu
Products
Coreutils
CVE-2017-16544

busybox: Insufficient sanitization of filenames when autocompleting

In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.

CVSS 3.1 · 8.8 High EPSS 6.1% KEV · Not listed
Vendors
Busybox Canonical Debian and 2 more
Products
Busybox Ubuntu Linux Debian Linux and 5 more
CVE-2017-15874

busybox: Integer underflow in archival/libarchive/decompress_unlzma.c

archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox
Products
Busybox
CVE-2017-15873

busybox: Integer overflow in the get_next_block function

The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Busybox Canonical Debian
Products
Busybox Ubuntu Linux Debian Linux
CVE-2016-2781

coreutils: Non-privileged session can escape to the parent session in chroot

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu
Products
Coreutils
CVE-2015-0973

libpng: Heap-buffer overflow png_combine_row() with very wide interlaced images

Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width, a different vulnerability than CVE-2014-9495.

CVSS 3.1 · 8.8 High EPSS 4.1% KEV · Not listed
Vendors
Apple Libpng Oracle
Products
Mac Os X Libpng Solaris
CVE-2014-9495

libpng: buffer overflow in png_combine_row

Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers to execute arbitrary code via a "very wide interlaced" PNG image.

CVSS 3.1 · 8.8 High EPSS 4.1% KEV · Not listed
Vendors
Apple Libpng
Products
Mac Os X Libpng
CVE-2013-7354

libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

Multiple integer overflows in libpng before 1.5.14rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to the (1) png_set_sPLT or (2) png_set_text_2 function, which triggers a heap-based buffer overflow.

CVSS 3.1 · 6.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Libpng
Products
Libpng
CVE-2013-7353

libpng: integer overflow leading to a heap-based buffer overflow in png_set_unknown_chunks()

Integer overflow in the png_set_unknown_chunks function in libpng/pngset.c in libpng before 1.5.14beta08 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a crafted image, which triggers a heap-based buffer overflow.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Libpng
Products
Libpng
CVE-2013-4392

systemd: TOCTOU race condition when updating file permissions and SELinux security contexts

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Systemd Project
Products
Systemd
CVE-2011-3045

libpng: buffer overflow in png_inflate caused by invalid type conversions

Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.

CVSS 3.1 · 8.8 High EPSS 3.3% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Chrome and 10 more
CVE-2018-16864

systemd: stack overflow when calling syslog from a command with long cmdline

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Oracle and 2 more
Products
Ubuntu Linux Debian Linux Communications Session Border Controller and 13 more
CVE-2018-16865

systemd: stack overflow when receiving many journald entries

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.

CVSS 3.1 · 7.8 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Oracle and 2 more
Products
Ubuntu Linux Debian Linux Communications Session Border Controller and 13 more
CVE-2019-3843

systemd: services with DynamicUser can create SUID/SGID binaries

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Netapp and 2 more
Products
Ubuntu Linux Fedora Cn1610 and 6 more
CVE-2019-3844

systemd: services with DynamicUser can get new privileges and create SGID binaries

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Netapp Redhat and 1 more
Products
Ubuntu Linux Cn1610 Cn1610 Firmware and 5 more