linux

CVEs (10,025)

• CVE-2018-1000041HigFeb 9, 2018
  GNOME Foundation

  Librsvg
  risk 0.00cvss 8.8epss 0.02

  GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear…

• CVE-2018-6767HigFeb 6, 2018
  Wavpack

  Wavpack
  risk 0.00cvss 7.8epss 0.03

  A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.

• CVE-2018-6621MedFeb 5, 2018
  FFmpeg

  Ffmpeg
  risk 0.00cvss 6.5epss 0.02

  The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.

• CVE-2017-18123HigFeb 3, 2018
  Dokuwiki

  Dokuwiki
  risk 0.00cvss 8.6epss 0.03

  The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerability, and allows remote attackers to run arbitrary programs.

• CVE-2018-6360HigJan 28, 2018
  Mpv

  mpv
  risk 0.00cvss 8.8epss 0.03

  mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdl_hook.lua. For example, an…

• CVE-2017-18076HigJan 26, 2018
  Omniauth

  Omniauth
  risk 0.00cvss 7.5epss 0.02

  In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.

• CVE-2017-15132HigJan 25, 2018
  Dovecot (software)

  Dovecot
  risk 0.00cvss 7.5epss 0.03

  A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the…

• CVE-2018-1000005CriJan 24, 2018
  Curl

  Libcurl
  risk 0.00cvss 9.1epss 0.05

  libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The…

• CVE-2017-12187CriJan 24, 2018
  Xorg

  Server
  risk 0.00cvss 9.8epss 0.03

  xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.

• CVE-2017-12186CriJan 24, 2018
  Xorg

  Server
  risk 0.00cvss 9.8epss 0.04

  xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.

• CVE-2017-12185CriJan 24, 2018
  Xorg

  Server
  risk 0.00cvss 9.8epss 0.04

  xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.

• CVE-2017-12184CriJan 24, 2018
  Xorg

  Server
  risk 0.00cvss 9.8epss 0.04

  xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.

• CVE-2017-12183CriJan 24, 2018
  Xorg

  Server
  risk 0.00cvss 9.8epss 0.04

  xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.

• CVE-2017-12182CriJan 24, 2018
  Xorg

  Server
  risk 0.00cvss 9.8epss 0.04

  xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.

• CVE-2017-12181CriJan 24, 2018
  Xorg

  Server
  risk 0.00cvss 9.8epss 0.04

  xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.

• CVE-2017-12180CriJan 24, 2018
  Xorg

  Server
  risk 0.00cvss 9.8epss 0.04

  xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.

• CVE-2017-12179CriJan 24, 2018
  Xorg

  Server
  risk 0.00cvss 9.8epss 0.04

  xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing malicious X client to cause X server to crash or possibly execute arbitrary code.

• CVE-2017-12178CriJan 24, 2018
  Xorg

  Server
  risk 0.00cvss 9.8epss 0.04

  xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.

• CVE-2017-12177CriJan 24, 2018
  Xorg

  Server
  risk 0.00cvss 9.8epss 0.04

  xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.

• CVE-2017-12176CriJan 24, 2018
  Xorg

  Server
  risk 0.00cvss 9.8epss 0.04

  xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.