CVE-2016-10165

lcms2: Out-of-bounds read in Type_MLU_Read()

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

CVSS 3.1 · 7.1 High EPSS 2.8% KEV · Not listed

Vendors

Canonical Debian Littlecms and 3 more

Products

Ubuntu Linux Debian Linux Little Cms Color Engine and 20 more

CVE-2017-7525

jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

CVSS 3.1 · 9.8 Critical EPSS 37.7% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 2 more

Products

Debian Linux Jackson-databind Oncommand Balance and 27 more

CVE-2017-15095

jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

CVSS 3.1 · 9.8 Critical EPSS 8.4% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 2 more

Products

Debian Linux Jackson-databind Oncommand Balance and 28 more

CVE-2016-9841

zlib: Out-of-bounds pointer arithmetic in inffast.c

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

CVSS 3.1 · 9.8 Critical EPSS 7.5% KEV · Not listed

Vendors

Apple Canonical Debian and 6 more

Products

Iphone Os Mac Os X Tvos and 39 more

CVE-2016-3427

OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVSS 3.1 · 9.8 Critical EPSS 92.3% KEV · Listed

Vendors

Apache Canonical Debian and 5 more

Products

Cassandra Ubuntu Linux Debian Linux and 39 more

CVE-2016-5195

kernel: mm: privilege escalation via MAP_PRIVATE COW breakage

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

CVSS 3.1 · 7.0 High EPSS 83.5% KEV · Listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 21 more

CVE-2015-7848

ntp: multiple integer overflow read access violations

An integer overflow can occur in NTP-dev.4.3.70 leading to an out-of-bounds memory copy operation when processing a specially crafted private mode packet. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon, it leads to an immediate crash.

CVSS 3.1 · 7.5 High EPSS 6.1% KEV · Not listed

Vendors

Netapp Ntp

Products

Clustered Data Ontap Data Ontap Operating In 7-mode Oncommand Balance and 3 more

CVE-2015-7705

ntp: denial of service by trigerring rate limiting on NTP server

The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.

CVSS 3.1 · 9.8 Critical EPSS 12.2% KEV · Not listed

Vendors

Citrix Netapp Ntp and 1 more

Products

Xenserver Clustered Data Ontap Data Ontap and 7 more

CVE-2015-7855

ntp: ASSERT in decodenetnum() on invalid values

The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value.

CVSS 3.1 · 6.5 Medium EPSS 31.2% KEV · Not listed

Vendors

Debian Netapp Ntp and 1 more

Products

Debian Linux Clustered Data Ontap Data Ontap and 8 more

CVE-2017-10268

mysql: Server: Replication unspecified vulnerability (CPU Oct 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 4.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Mariadb Netapp and 2 more

Products

Debian Linux Mariadb Active Iq Unified Manager and 16 more

CVE-2017-10109

OpenJDK: unbounded memory allocation in CodeSource deserialization (Serialization, 8174113)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS 3.1 · 5.3 Medium EPSS 3.1% KEV · Not listed

Vendors

Debian Netapp Oracle and 1 more

Products

Debian Linux Active Iq Unified Manager Cloud Backup and 28 more

CVE-2017-10274

OpenJDK: CardImpl incorrect state handling (Smart Card IO, 8169026)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Smart Card IO). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data as well as unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N).

CVSS 3.1 · 6.8 Medium EPSS 2.6% KEV · Not listed

Vendors

Debian Netapp Oracle and 1 more

Products

Debian Linux Active Iq Unified Manager Cloud Backup and 27 more

CVE-2017-10285

OpenJDK: incorrect privilege use when handling unreferenced objects (RMI, 8174966)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

CVSS 3.1 · 9.6 Critical EPSS 3.1% KEV · Not listed

Vendors

Debian Netapp Oracle and 1 more

Products

Debian Linux Active Iq Unified Manager Cloud Backup and 30 more

CVE-2017-10295

OpenJDK: HTTP client insufficient check for newline in URLs (Networking, 8176751)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.0 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N).

CVSS 3.1 · 4.0 Medium EPSS 2.2% KEV · Not listed

Vendors

Debian Netapp Oracle and 1 more

Products

Debian Linux Active Iq Unified Manager Cloud Backup and 31 more

CVE-2017-10096

OpenJDK: insufficient access control checks in XML transformations (JAXP, 8172469)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

CVSS 3.1 · 9.6 Critical EPSS 2.6% KEV · Not listed

Vendors

Debian Netapp Oracle and 1 more

Products

Debian Linux Active Iq Unified Manager Cloud Backup and 27 more

CVE-2017-10356

OpenJDK: weak protection of key stores against brute forcing (Security, 8181692)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, Java SE Embedded, JRockit executes to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 6.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Netapp Oracle and 1 more

Products

Debian Linux Active Iq Unified Manager Cloud Backup and 30 more

CVE-2017-10384

mysql: Server: DDL unspecified vulnerability (CPU Oct 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.57 and earlier 5.6.37 and earlier 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 6.5 Medium EPSS 3.1% KEV · Not listed

Vendors

Debian Mariadb Netapp and 2 more

Products

Debian Linux Mariadb Active Iq Unified Manager and 16 more

CVE-2015-7691

ntp: incomplete checks in ntp_crypto.c

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.

CVSS 3.1 · 7.5 High EPSS 7.1% KEV · Not listed

Vendors

Debian Netapp Ntp and 2 more

Products

Debian Linux Clustered Data Ontap Data Ontap and 11 more

CVE-2015-7701

ntp: slow memory leak in CRYPTO_ASSOC

Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption).

CVSS 3.1 · 7.5 High EPSS 6.5% KEV · Not listed

Vendors

Debian Netapp Ntp and 2 more

Products

Debian Linux Clustered Data Ontap Data Ontap and 11 more

CVE-2015-7692

ntp: incomplete checks in ntp_crypto.c

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.

CVSS 3.1 · 7.5 High EPSS 6.5% KEV · Not listed

Vendors

Debian Netapp Ntp and 2 more

Products

Debian Linux Clustered Data Ontap Data Ontap and 11 more