CVE-2016-3107

pulp: Node certificate containing private key stored in world-readable file

The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Pulpproject Redhat

Products

Pulp Satellite Satellite Capsule

CVE-2017-2925

flash-plugin: multiple code execution issues fixed in APSB17-02

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability in the JPEG XR codec. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 5.0% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Mac Os X Chrome Os and 5 more

CVE-2016-7543

bash: Specially crafted SHELLOPTS+PS4 variables allows command substitution

Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.

CVSS 3.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Gnu Redhat

Products

Fedora Bash Enterprise Linux

CVE-2017-2926

flash-plugin: multiple code execution issues fixed in APSB17-02

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 9.9% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Mac Os X Chrome Os and 5 more

CVE-2017-2928

flash-plugin: multiple code execution issues fixed in APSB17-02

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to setting visual mode effects. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 5.0% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Mac Os X Chrome Os and 5 more

CVE-2017-2930

flash-plugin: multiple code execution issues fixed in APSB17-02

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurrency error when manipulating a display list. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 25.1% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Mac Os X Chrome Os and 5 more

CVE-2017-16541

Mozilla: Proxy bypass using automount and autofs

Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected.

CVSS 3.1 · 6.5 Medium EPSS 3.7% KEV · Not listed

Vendors

Apple Debian Linux and 2 more

Products

Macos Debian Linux Linux Kernel and 8 more

CVE-2017-2931

flash-plugin: multiple code execution issues fixed in APSB17-02

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to the parsing of SWF metadata. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 21.1% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Mac Os X Chrome Os and 5 more

CVE-2017-2932

flash-plugin: multiple code execution issues fixed in APSB17-02

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript MovieClip class. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 24.6% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Mac Os X Chrome Os and 5 more

CVE-2017-2933

flash-plugin: multiple code execution issues fixed in APSB17-02

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability related to texture compression. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 29.9% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Mac Os X Chrome Os and 5 more

CVE-2016-7797

pacemaker: pacemaker remote nodes vulnerable to hijacking, resulting in a DoS attack

Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed

Vendors

Clusterlabs Opensuse Opensuse Project and 2 more

Products

Pacemaker Leap Leap and 5 more

CVE-2016-7934

tcpdump: multiple overflow issues in protocol decoding

The RTCP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:rtcp_print().

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed

Vendors

Redhat Tcpdump

Products

Enterprise Linux Tcpdump

CVE-2016-7935

tcpdump: multiple overflow issues in protocol decoding

The RTP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:rtp_print().

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed

Vendors

Redhat Tcpdump

Products

Enterprise Linux Tcpdump

CVE-2016-7973

tcpdump: multiple overflow issues in protocol decoding

The AppleTalk parser in tcpdump before 4.9.0 has a buffer overflow in print-atalk.c, multiple functions.

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed

Vendors

Redhat Tcpdump

Products

Enterprise Linux Tcpdump

CVE-2016-7975

tcpdump: multiple overflow issues in protocol decoding

The TCP parser in tcpdump before 4.9.0 has a buffer overflow in print-tcp.c:tcp_print().

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed

Vendors

Redhat Tcpdump

Products

Enterprise Linux Tcpdump

CVE-2016-7978

ghostscript: reference leak in .setdevice allows use-after-free and remote code execution

Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.

CVSS 3.0 · 9.8 Critical EPSS 5.5% KEV · Not listed

Vendors

Artifex Redhat

Products

Ghostscript Enterprise Linux

CVE-2016-7979

ghostscript: Type confusion in .initialize_dsc_parser allows remote code execution

Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser.

CVSS 3.0 · 9.8 Critical EPSS 6.4% KEV · Not listed

Vendors

Artifex Redhat

Products

Ghostscript Enterprise Linux

CVE-2017-2935

flash-plugin: multiple code execution issues fixed in APSB17-02

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when processing the Flash Video container file format. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 29.9% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Mac Os X Chrome Os and 5 more

CVE-2017-2936

flash-plugin: multiple code execution issues fixed in APSB17-02

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript FileReference class. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 6.2% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Mac Os X Chrome Os and 5 more

CVE-2015-8896

ImageMagick: Integer truncation vulnerability in coders/pict.c

Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file.

CVSS 3.1 · 6.5 Medium EPSS 2.9% KEV · Not listed

Vendors

Imagemagick Oracle Redhat

Products

Imagemagick Linux Enterprise Linux and 6 more