linux

CVEs (3,015)

• CVE-2015-0383Jan 21, 2015
  Sun Corporation

  Java SE
  risk 0.00cvss —epss 0.00

  Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related to Hotspot.

• CVE-2015-0381Jan 21, 2015
  Fedoraproject

  Fedora
  risk 0.00cvss —epss 0.05

  Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0382.

• CVE-2015-0377Jan 21, 2015
  Oracle Corporation

  VM Virtualbox
  risk 0.00cvss —epss 0.00

  Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.26, 4.0.28, 4.1.36, and 4.2.28 allows local users to affect availability via unknown vectors related to Core, a different vulnerability than CVE-2015-0418.

• CVE-2015-0374Jan 21, 2015
  Fedoraproject

  Fedora
  risk 0.00cvss —epss 0.03

  Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges : Foreign Key.

• CVE-2013-6892Jan 21, 2015
  Websvn

  Websvn
  risk 0.00cvss —epss 0.01

  WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit.

• CVE-2014-9496Jan 16, 2015
  Libsndfile Project

  Libsndfile
  risk 0.00cvss —epss 0.01

  The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.

• CVE-2014-8738Jan 15, 2015
  GNU

  Binutils
  risk 0.00cvss —epss 0.05

  The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (invalid write, segmentation fault, and crash) via a crafted extended name table in an archive.

• CVE-2015-0564Jan 10, 2015
  Wireshark

  Wireshark
  risk 0.00cvss —epss 0.03

  Buffer underflow in the ssl_decrypt_record function in epan/dissectors/packet-ssl-utils.c in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allows remote attackers to cause a denial of service (application crash) via a crafted packet that is improperly handled during…

• CVE-2014-9585Jan 9, 2015
  Linux

  Kernel
  risk 0.00cvss —epss 0.01

  The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD.

• CVE-2014-9584Jan 9, 2015
  Linux

  Kernel
  risk 0.00cvss —epss 0.00

  The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660…

• CVE-2014-9529Jan 9, 2015
  Linux

  Kernel
  risk 0.00cvss —epss 0.00

  Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key…

• CVE-2014-9272Jan 9, 2015
  Mantisbt

  Mantisbt
  risk 0.00cvss —epss 0.02

  The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol.

• CVE-2014-9269Jan 9, 2015
  Mantisbt

  Mantisbt
  risk 0.00cvss —epss 0.02

  Cross-site scripting (XSS) vulnerability in helper_api.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie.

• CVE-2012-6684Jan 8, 2015
  Redcloth

  Redcloth Library
  risk 0.00cvss —epss 0.02

  Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI.

• CVE-2014-9221Jan 7, 2015
  Strongswan

  Strongswan
  risk 0.00cvss —epss 0.04

  strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.

• CVE-2014-8132Dec 29, 2014
  Libssh

  Libssh
  risk 0.00cvss —epss 0.05

  Double free vulnerability in the ssh_packet_kexinit function in kex.c in libssh 0.5.x and 0.6.x before 0.6.4 allows remote attackers to cause a denial of service via a crafted kexinit packet.

• CVE-2014-5353Dec 16, 2014
  Mit

  Kerberos 5
  risk 0.00cvss —epss 0.05

  The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with…

• CVE-2014-9323Dec 16, 2014
  Firebirdsql

  Firebird
  risk 0.00cvss —epss 0.03

  The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and crash) via an op_response action with a non-empty status.

• CVE-2014-9057Dec 16, 2014
  Movabletype

  Movabletype
  risk 0.00cvss —epss 0.02

  SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

• CVE-2014-6053Dec 15, 2014
  Libvncserver

  Libvncserver
  risk 0.00cvss —epss 0.08

  The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a large amount of ClientCutText data, which allows remote attackers to cause a denial of service (memory consumption or daemon…