Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 772

CVE-2018-1000001

glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.

CVSS 3.0 · 7.8 High EPSS 13.4% KEV · Not listed
Vendors
Canonical Gnu Redhat
Products
Ubuntu Linux Glibc Enterprise Linux and 7 more
CVE-2017-5333

icoutils: Integer overflow vulnerability in extract.c

Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) or execute arbitrary code via a crafted executable file.

CVSS 3.1 · 7.8 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Icoutils Project and 2 more
Products
Ubuntu Linux Debian Linux Icoutils and 8 more
CVE-2017-5332

icoutils: Access to unallocated memory possible in extract.c

The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Icoutils Project and 2 more
Products
Ubuntu Linux Debian Linux Icoutils and 8 more
CVE-2017-3145

Improper fetch cleanup sequencing in the resolver can cause named to crash

BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.

CVSS 3.1 · 7.5 High EPSS 27.7% KEV · Not listed
Vendors
Debian Isc Juniper and 2 more
Products
Debian Linux Bind Junos and 40 more
CVE-2017-3144

Failure to properly clean up closed OMAPI connections can exhaust available sockets

A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested.

CVSS 3.1 · 7.5 High EPSS 72.7% KEV · Not listed
Vendors
Canonical Debian Isc and 1 more
Products
Ubuntu Linux Debian Linux Dhcp and 7 more
CVE-2017-3143

An error in TSIG authentication can permit unauthorized dynamic updates

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.

CVSS 3.0 · 7.5 High EPSS 18.2% KEV · Not listed
Vendors
Debian Isc Redhat
Products
Debian Linux Bind Enterprise Linux and 6 more
CVE-2017-3142

An error in TSIG authentication can permit unauthorized zone transfers

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.

CVSS 3.0 · 5.3 Medium EPSS 5.4% KEV · Not listed
Vendors
Debian Isc Redhat
Products
Debian Linux Bind Enterprise Linux and 6 more
CVE-2017-3137

A response packet can cause a resolver to terminate when processing an answer containing a CNAME or DNAME

Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8.

CVSS 3.0 · 7.5 High EPSS 8.9% KEV · Not listed
Vendors
Debian Isc Netapp and 1 more
Products
Debian Linux Bind Data Ontap Edge and 13 more
CVE-2017-3136

An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;"

A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met. Affects BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8.

CVSS 3.0 · 5.9 Medium EPSS 11.1% KEV · Not listed
Vendors
Debian Isc Netapp and 1 more
Products
Debian Linux Bind Data Ontap Edge and 9 more
CVE-2017-3135

Combination of DNS64 and RPZ Can Lead to Crash

Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1.

CVSS 3.0 · 7.5 High EPSS 17.1% KEV · Not listed
Vendors
Debian Isc Netapp and 1 more
Products
Debian Linux Bind Data Ontap Edge and 8 more
CVE-2017-2885

libsoup: Stack based buffer overflow with HTTP Chunked Encoding

An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.

CVSS 3.1 · 9.8 Critical EPSS 23.1% KEV · Not listed
Vendors
Debian Gnome Redhat
Products
Debian Linux Libsoup Enterprise Linux and 6 more
CVE-2017-18344

kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c

The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).

CVSS 3.0 · 5.5 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 13 more
CVE-2017-17833

openslp: Heap memory corruption in slpd/slpd_process.c allows denial of service or potentially code execution

OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability.

CVSS 3.0 · 9.8 Critical EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Lenovo and 2 more
Products
Ubuntu Linux Debian Linux Bm Nextscale Fan Power Controller and 59 more
CVE-2017-15129

kernel: net: double-free and memory corruption in get_net_ns_by_id()

A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 1 more
Products
Ubuntu Linux Fedora Linux Kernel and 19 more
CVE-2016-9600

jasper: JP2 encoder NULL pointer dereference due to uninitialized cmprof_

JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Canonical Jasper Project Redhat
Products
Ubuntu Linux Jasper Enterprise Linux and 6 more
CVE-2016-2125

samba: Unconditional privilege delegation to Kerberos servers in trusted realms

It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.

CVSS 3.1 · 6.5 Medium EPSS 9.2% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Server and 7 more
CVE-2016-2124

samba: SMB1 client connections can be downgraded to plaintext authentication

A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.

CVSS 3.1 · 5.9 Medium EPSS 1.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 23 more