openSUSE

CVEs (1,426)

• CVE-2011-3659Feb 1, 2012
  Mozilla Corporation

  Firefox
  risk 0.06cvss —epss 0.37

  Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 might allow remote attackers to execute arbitrary code via vectors related to incorrect AttributeChildRemoved notifications…

• CVE-2015-4870Oct 21, 2015
  Fedoraproject

  Fedora
  risk 0.05cvss —epss 0.30

  Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser.

• CVE-2014-8768Nov 20, 2014
  Tcpdump

  Tcpdump
  risk 0.05cvss —epss 0.20

  Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow remote attackers to cause a denial of service (segmentation fault and crash) via a crafted length value in a Geonet frame.

• CVE-2015-7805Nov 17, 2015
  Libsndfile Project

  Libsndfile
  risk 0.04cvss —epss 0.13

  Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.

• CVE-2014-3004Jun 11, 2014
  Castor Project

  Castor
  risk 0.04cvss —epss 0.08

  The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.

• CVE-2014-2913May 7, 2014
  Nagios

  Remote Plugin Executor
  risk 0.04cvss —epss 0.15

  Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has…

• CVE-2014-0198May 6, 2014
  OpenSSL Project

  OpenSSL
  risk 0.04cvss —epss 0.44

  The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and…

• CVE-2013-0221Nov 23, 2013
  SUSE S.A.

  coreutils
  risk 0.04cvss —epss 0.07

  The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the sort command, when using the (1) -d or (2) -M switch, which triggers a stack-based buffer overflow in the…

• CVE-2012-6303Oct 28, 2013
  Snack

  Sound Toolkit
  risk 0.04cvss —epss 0.10

  Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large chunk size in a WAV file.

• CVE-2013-0233Apr 25, 2013
  Heartcombo

  Devise
  risk 0.04cvss —epss 0.14

  Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be…

• CVE-2013-1861Mar 28, 2013
  MariaDB

  MariaDB
  risk 0.04cvss —epss 0.19

  MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that…

• CVE-2012-4528Dec 28, 2012
  ModSecurity

  mod_security
  risk 0.04cvss —epss 0.13

  The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.

• CVE-2011-4862Dec 25, 2011
  Heimdal

  Heimdal
  risk 0.04cvss —epss 0.95

  Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long…

• CVE-2007-5000Dec 13, 2007
  Apache

  HTTP Server
  risk 0.04cvss —epss 0.47

  Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or…

• CVE-2015-4481Aug 16, 2015
  Mozilla Corporation

  Firefox
  risk 0.03cvss —epss 0.01

  Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.

• CVE-2015-3622May 12, 2015
  GNU

  Libtasn1
  risk 0.03cvss —epss 0.33

  The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.

• CVE-2015-3145Apr 24, 2015
  Curl

  Curl
  risk 0.03cvss —epss 0.38

  The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing…

• CVE-2014-1564Sep 3, 2014
  Mozilla Corporation

  Firefox
  risk 0.03cvss —epss 0.05

  Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS…

• CVE-2014-0128Apr 14, 2014
  Squid Cache

  Squid
  risk 0.03cvss —epss 0.33

  Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.

• CVE-2014-1512Mar 19, 2014
  Mozilla Corporation

  Firefox
  risk 0.03cvss —epss 0.31

  Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary code by triggering extensive memory…