Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2017-13033

tcpdump: Buffer over-read in print-vtp.c:vtp_print() in VTP parser

The VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print().

CVSS 3.0 · 9.8 Critical EPSS 4.3% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2017-13026

tcpdump: Buffer over-read in print-isoclns.c, several functions in ISO IS-IS parser

The ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c, several functions.

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2016-10249

jasper: integer overflow in jas_matrix_create()

Integer overflow in the jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.12 allows remote attackers to have unspecified impact via a crafted image file, which triggers a heap-based buffer overflow.

CVSS 3.0 · 7.8 High EPSS 2.0% KEV · Not listed
Vendors
Jasper Project Redhat
Products
Jasper Enterprise Linux
CVE-2016-5213

chromium-browser: use after free in v8

A use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2017-5485

tcpdump: multiple overflow issues in protocol decoding

The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in addrtoname.c:lookup_nsap().

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2016-0959

flash-plugin: multiple code execution issues fixed in APSB16-01

Use after free vulnerability in Adobe Flash Player Desktop Runtime before 20.0.0.267, Adobe Flash Player Extended Support Release before 18.0.0.324, Adobe Flash Player for Google Chrome before 20.0.0.267, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 before 20.0.0.267, Adobe Flash Player for Internet Explorer 10 and 11 before 20.0.0.267, Adobe Flash Player for Linux before 11.2.202.559, AIR Desktop Runtime before 20.0.0.233, AIR SDK before 20.0.0.233, AIR SDK & Compiler before 20.0.0.233, AIR for Android before 20.0.0.233.

CVSS 3.0 · 9.8 Critical EPSS 5.2% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 13 more
CVE-2017-5058

chromium-browser: heap use after free in print preview

A use after free in PrintPreview in Google Chrome prior to 58.0.3029.81 for Windows allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Google Microsoft Redhat
Products
Chrome Windows Rhel Extras
CVE-2015-8895

ImageMagick: Integer and buffer overflow in coders/icon.c

Integer overflow in coders/icon.c in ImageMagick 6.9.1-3 and later allows remote attackers to cause a denial of service (application crash) via a crafted length value, which triggers a buffer overflow.

CVSS 3.0 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Imagemagick Redhat
Products
Imagemagick Enterprise Linux
CVE-2016-5205

chromium-browser: universal xss in blink

Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

CVSS 3.0 · 6.1 Medium EPSS 1.0% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2014-0146

Qemu: qcow2: NULL dereference in qcow2_open() error path

The qcow2_open function in the (block/qcow2.c) in QEMU before 1.7.2 and 2.x before 2.0.0 allows local users to cause a denial of service (NULL pointer dereference) via a crafted image which causes an error, related to the initialization of the snapshot_offset and nb_snapshots fields.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack
CVE-2016-10168

gd: Integer overflow in gd_io.c

Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image.

CVSS 3.0 · 7.8 High EPSS 3.7% KEV · Not listed
Vendors
Libgd Redhat
Products
Libgd Enterprise Linux Rhel Software Collections
CVE-2016-5201

chromium-browser: info leak in extensions

A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed a remote attacker to access privileged JavaScript code via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2017-5055

chromium-browser: use after free in printing

A use after free in printing in Google Chrome prior to 57.0.2987.133 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 2.5% KEV · Not listed
Vendors
Google Linux Microsoft and 1 more
Products
Chrome Linux Kernel Windows and 1 more
CVE-2016-10164

libXpm: Out-of-bounds write in XPM extension parsing

Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.

CVSS 3.0 · 9.8 Critical EPSS 7.6% KEV · Not listed
Vendors
Redhat X.org
Products
Enterprise Linux Libxpm
CVE-2016-5200

chromium-browser: out of bounds memory access in v8

V8 in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android incorrectly applied type rules, which allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2016-10158

php: Wrong calculation in exif_convert_any_to_int function

The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.

CVSS 3.0 · 7.5 High EPSS 7.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2014-0145

Qemu: prevent possible buffer overflows

Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack
CVE-2017-13009

tcpdump: Buffer over-read in print-mobility.c:mobility_print() in IPv6 mobility parser

The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_print().

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2014-0121

hawtio-karaf-terminal: remote code execution due to missing authentication

The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter.

CVSS 3.0 · 9.8 Critical EPSS 4.0% KEV · Not listed
Vendors
Hawt Redhat
Products
Hawtio Jboss Fuse
CVE-2016-5226

chromium-browser: limited xss in blink

Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac executed javascript: URLs entered in the URL bar in the context of the current tab, which allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras