linux

CVEs (3,015)

• CVE-2014-3515Jul 9, 2014
  PHP

  PHP
  risk 0.02cvss —epss 0.30

  The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable…

• CVE-2014-2497Mar 21, 2014
  PHP

  PHP
  risk 0.02cvss —epss 0.22

  The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.

• CVE-2014-2324Mar 14, 2014
  Lighttpd

  Lighttpd
  risk 0.02cvss —epss 0.29

  Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.

• CVE-2012-3955Sep 14, 2012
  Isc

  DHCP
  risk 0.02cvss —epss 0.22

  ISC DHCP 4.1.x before 4.1-ESV-R7 and 4.2.x before 4.2.4-P2 allows remote attackers to cause a denial of service (daemon crash) in opportunistic circumstances by establishing an IPv6 lease in an environment where the lease expiration time is later reduced.

• CVE-2011-1002Feb 22, 2011
  Avahi

  Avahi
  risk 0.02cvss —epss 0.29

  avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet to port 5353. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-2244.

• CVE-2007-0956Apr 6, 2007
  Mit

  krb5
  risk 0.02cvss —epss 0.30

  The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882.

• CVE-2005-2700Sep 6, 2005
  Apache

  mod_ssl
  risk 0.02cvss —epss 0.31

  ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

• CVE-2005-2088Jul 5, 2005
  Apache

  HTTP Server
  risk 0.02cvss —epss 0.20

  The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header…

• CVE-2005-0211May 2, 2005
  Squid Cache

  Squid
  risk 0.02cvss —epss 0.22

  Buffer overflow in wccp.c in Squid 2.5 before 2.5.STABLE7 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long WCCP packet, which is processed by a recvfrom function call that uses an incorrect length parameter.

• CVE-2016-0505Jan 21, 2016
  MariaDB

  MariaDB
  risk 0.01cvss —epss 0.08

  Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Options.

• CVE-2015-8327Dec 17, 2015
  Linux Foundation

  Foomatic Filters
  risk 0.01cvss —epss 0.10

  Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via ` (backtick) characters in a print job.

• CVE-2015-8241Dec 15, 2015
  Xmlsoft

  Libxml2
  risk 0.01cvss —epss 0.07

  The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.

• CVE-2015-7499Dec 15, 2015
  Xmlsoft

  Libxml2
  risk 0.01cvss —epss 0.06

  Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.

• CVE-2015-3196Dec 6, 2015
  OpenSSL Project

  OpenSSL
  risk 0.01cvss —epss 0.13

  ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double…

• CVE-2015-7981Nov 24, 2015
  Libpng

  Libpng
  risk 0.01cvss —epss 0.06

  The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read.

• CVE-2015-8126Nov 13, 2015
  Libpng

  Libpng
  risk 0.01cvss —epss 0.10

  Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application…

• CVE-2015-5214Nov 10, 2015
  Apache

  Openoffice
  risk 0.01cvss —epss 0.10

  LibreOffice before 4.4.6 and 5.x before 5.0.1 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via an index to a non-existent bookmark in a DOC file.

• CVE-2015-5213Nov 10, 2015
  Apache

  Openoffice
  risk 0.01cvss —epss 0.13

  Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a long DOC file, which triggers a buffer overflow.

• CVE-2015-5212Nov 10, 2015
  Apache

  Openoffice
  risk 0.01cvss —epss 0.09

  Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly…

• CVE-2015-4551Nov 10, 2015
  Apache

  Openoffice
  risk 0.01cvss —epss 0.14

  LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links, which might allow remote attackers to obtain sensitive information via a crafted document, which…