Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2016-5361

IKEv1 protocol is vulnerable to DoS amplification attack

programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each.

CVSS 3.0 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Libreswan Redhat
Products
Libreswan Enterprise Linux
CVE-2016-9534

libtiff: TIFFFlushData1 heap-buffer-overflow

tif_write.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1() that didn't reset the tif_rawcc and tif_rawcp members. Reported as MSVR 35095, aka "TIFFFlushData1 heap-buffer-overflow."

CVSS 3.0 · 9.8 Critical EPSS 3.6% KEV · Not listed
Vendors
Libtiff Redhat
Products
Libtiff Enterprise Linux
CVE-2016-9536

libtiff: t2p_process_jpeg_strip heap-buffer-overflow

tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip(). Reported as MSVR 35098, aka "t2p_process_jpeg_strip heap-buffer-overflow."

CVSS 3.0 · 9.8 Critical EPSS 3.1% KEV · Not listed
Vendors
Libtiff Redhat
Products
Libtiff Enterprise Linux
CVE-2016-5144

chromium-browser: Parameter sanitization failure in DevTools

The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5143.

CVSS 3.0 · 9.8 Critical EPSS 1.7% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2015-8835

php: type confusion issue in Soap Client call() method

The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not properly retrieve keys, which allows remote attackers to cause a denial of service (NULL pointer dereference, type confusion, and application crash) or possibly execute arbitrary code via crafted serialized data representing a numerically indexed _cookies array, related to the SoapClient::__call method in ext/soap/soap.c.

CVSS 3.0 · 9.8 Critical EPSS 6.2% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-5151

chromium-browser: use after free in pdfium

PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux mishandles timers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted PDF document, related to fpdfsdk/javascript/JS_Object.cpp and fpdfsdk/javascript/app.cpp.

CVSS 3.0 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Google Opensuse Redhat
Products
Chrome Leap Rhel Extras
CVE-2016-2830

Mozilla: Favicon network connection persists when page is closed (MFSA 2016-62)

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses.

CVSS 3.0 · 4.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Enterprise Linux
CVE-2015-2775

mailman: directory traversal in MTA transports that deliver programmatically

Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.

CVSS 2.0 · 7.6 High EPSS 7.9% KEV · Not listed
Vendors
Canonical Debian Gnu and 1 more
Products
Ubuntu Linux Debian Linux Mailman and 1 more
CVE-2016-6828

kernel: Use after free in tcp_xmit_retransmit_queue

The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option.

CVSS 3.0 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2016-1634

chromium-browser: use-after-free in Blink

Use-after-free vulnerability in the StyleResolver::appendCSSStyleSheet function in WebKit/Source/core/css/resolver/StyleResolver.cpp in Blink, as used in Google Chrome before 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site that triggers Cascading Style Sheets (CSS) style invalidation during a certain subtree-removal action.

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2016-7859

flash-plugin: multiple code execution issues fixed in APSB16-37

Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.

CVSS 3.0 · 8.8 High EPSS 7.0% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player For Linux Mac Os X and 12 more
CVE-2016-4581

kernel: Slave being first propagated copy causes oops in propagate_mnt

fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a certain case involving a slave mount, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted series of mount system calls.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Oracle and 1 more
Products
Ubuntu Linux Linux Kernel Linux and 2 more
CVE-2015-0293

openssl: assertion failure in SSLv2 servers

The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.

CVSS 2.0 · 5.0 Medium EPSS 21.2% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Jboss Enterprise Application Platform and 5 more
CVE-2014-2525

libyaml: heap-based buffer overflow when parsing URLs

Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.

CVSS 2.0 · 6.8 Medium EPSS 8.8% KEV · Not listed
Vendors
Opensuse Pyyaml Redhat
Products
Leap Opensuse Libyaml and 3 more
CVE-2015-5352

openssh: XSECURITY restrictions bypass under certain conditions in ssh(1)

The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window.

CVSS 2.0 · 4.3 Medium EPSS 4.5% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2015-8683

libtiff: Out-of-bounds when reading CIE Lab image format files

The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image.

CVSS 3.0 · 5.5 Medium EPSS 2.9% KEV · Not listed
Vendors
Debian Libtiff Redhat
Products
Debian Linux Libtiff Enterprise Linux
CVE-2016-7130

php: wddx_deserialize null dereference

The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid base64 binary value, as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document.

CVSS 3.0 · 7.5 High EPSS 6.7% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-7862

flash-plugin: multiple code execution issues fixed in APSB16-37

Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.

CVSS 3.0 · 8.8 High EPSS 7.1% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player For Linux Mac Os X and 12 more
CVE-2015-8665

libtiff: Out-of-bounds read in tif_getimage.c

tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via the SamplesPerPixel tag in a TIFF image.

CVSS 3.0 · 5.5 Medium EPSS 2.9% KEV · Not listed
Vendors
Libtiff Redhat
Products
Libtiff Enterprise Linux
CVE-2015-8664

chromium-browser: Use-After-free in MidiHost

Integer overflow in the WebCursor::Deserialize function in content/common/cursors/webcursor.cc in Google Chrome before 47.0.2526.106 allows remote attackers to cause a denial of service or possibly have unspecified other impact via an RGBA pixel array with crafted dimensions, a different vulnerability than CVE-2015-6792.

CVSS 3.0 · 8.8 High EPSS 5.2% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras