Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2015-8926

libarchive: NULL pointer access in RAR parser

The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive.

CVSS 3.0 · 5.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Libarchive Redhat and 1 more
Products
Ubuntu Linux Libarchive Enterprise Linux and 3 more
CVE-2015-8928

libarchive: Heap out of bounds read in mtree parser

The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.

CVSS 3.0 · 5.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Libarchive Redhat and 1 more
Products
Ubuntu Linux Libarchive Enterprise Linux and 3 more
CVE-2015-8935

php: HTTP response splitting in header() function

The sapi_header_op function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line folding without considering browser compatibility, which allows remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer by leveraging (1) %0A%20 or (2) %0D%0A%20 mishandling in the header function.

CVSS 3.0 · 6.1 Medium EPSS 3.2% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2015-8956

kernel: NULL dereference in RFCOMM bind callback

The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 4.2 allows local users to obtain sensitive information or cause a denial of service (NULL pointer dereference) via vectors involving a bind system call on a Bluetooth RFCOMM socket.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Google Linux Redhat
Products
Android Linux Kernel Enterprise Linux and 1 more
CVE-2016-0799

OpenSSL: Fix memory issues in BIO_*printf functions

The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842.

CVSS 3.0 · 9.8 Critical EPSS 32.4% KEV · Not listed
Vendors
Openssl Pulsesecure Redhat
Products
Openssl Client Steel Belted Radius and 3 more
CVE-2016-4979

httpd: X509 client certificate authentication bypass using HTTP/2

The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.

CVSS 3.0 · 7.5 High EPSS 18.8% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Rhel Software Collections
CVE-2016-4985

openstack-ironic: Ironic Node information including credentials exposed to unauthenticated users

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Canonical Redhat
Products
Openstack Ironic Openstack
CVE-2016-0795

libreoffice: Multiple out-of-bounds overflows in lwp filter

LibreOffice before 5.0.5 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro (lwp) document.

CVSS 3.0 · 7.8 High EPSS 2.8% KEV · Not listed
Vendors
Canonical Libreoffice Redhat
Products
Ubuntu Linux Libreoffice Enterprise Linux
CVE-2016-2384

kernel: double-free in usb-audio triggered by invalid USB descriptor

Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.

CVSS 3.0 · 4.6 Medium EPSS 3.7% KEV · Not listed
Vendors
Linux Novell Redhat
Products
Linux Kernel Suse Linux Enterprise Real Time Extension Enterprise Linux and 1 more
CVE-2016-0790

jenkins: Non-constant time comparison of API token (SECURITY-241)

Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a brute-force approach.

CVSS 3.0 · 5.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2016-4995

foreman: Information disclosure in provisioning template previews

Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users with permission to view some hosts to obtain sensitive host configuration information via a URL with a hostname.

CVSS 3.0 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2014-9365

python: failure to validate certificates in the HTTP client with TLS (PEP 476)

The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS 3.0 · 4.7 Medium EPSS 3.0% KEV · Not listed
Vendors
Apple Python Redhat
Products
Mac Os X Python Enterprise Linux and 1 more
CVE-2016-4998

kernel: out of bounds reads when processing IPT_SO_SET_REPLACE setsockopt

The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary.

CVSS 3.0 · 7.1 High EPSS 1.9% KEV · Not listed
Vendors
Canonical Linux Oracle and 1 more
Products
Ubuntu Linux Linux Kernel Linux and 3 more
CVE-2016-2569

squid: some code paths fail to check bounds in string object

Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.

CVSS 3.0 · 7.5 High EPSS 31.2% KEV · Not listed
Vendors
Redhat Squid-cache
Products
Enterprise Linux Squid
CVE-2016-2571

squid: wrong error handling for malformed HTTP responses

http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.

CVSS 3.0 · 7.5 High EPSS 9.3% KEV · Not listed
Vendors
Redhat Squid-cache
Products
Enterprise Linux Squid
CVE-2016-2572

squid: wrong error handling for malformed HTTP responses

http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.

CVSS 3.0 · 7.5 High EPSS 10.2% KEV · Not listed
Vendors
Redhat Squid-cache
Products
Enterprise Linux Squid
CVE-2016-2776

bind: assertion failure in buffer.c while building responses to a specifically constructed request

buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.

CVSS 3.0 · 7.5 High EPSS 89.5% KEV · Not listed
Vendors
Hp Isc Oracle and 1 more
Products
Hp-ux Bind Linux and 7 more
CVE-2016-2790

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 3 more
Products
Firefox Leap Opensuse and 4 more
CVE-2016-2794

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.

CVSS 3.0 · 8.8 High EPSS 3.5% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 3 more
Products
Firefox Leap Opensuse and 4 more