openSUSE

CVEs (1,467)

• CVE-2010-4345HigKEVDec 14, 2010
  Exim

  Exim
  risk 0.67cvss 7.8epss 0.18

  Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.

• CVE-2010-1866CriMay 7, 2010
  PHP

  PHP
  risk 0.67cvss 9.8epss 0.07

  The dechunk filter in PHP 5.3 through 5.3.2, when decoding an HTTP chunked encoding stream, allows context-dependent attackers to cause a denial of service (crash) and possibly trigger memory corruption via a negative chunk size, which bypasses a signed comparison, related to an…

• CVE-2016-5771CriAug 7, 2016
  PHP

  PHP
  risk 0.65cvss 9.8epss 0.15

  spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application…

• CVE-2015-7545CriApr 13, 2016
  Git

  Git
  risk 0.65cvss 9.8epss 0.19

  The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in…

• CVE-2016-1931CriJan 31, 2016
  Mozilla Corporation

  Firefox
  risk 0.65cvss 10.0epss 0.06

  Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to uninitialized memory encountered…

• CVE-2013-6671CriDec 11, 2013
  Mozilla Corporation

  Firefox
  risk 0.65cvss 9.8epss 0.11

  The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code via crafted use of JavaScript code for ordered list elements.

• CVE-2013-5618CriDec 11, 2013
  Mozilla Corporation

  Firefox
  risk 0.65cvss 9.8epss 0.10

  Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute…

• CVE-2013-0641HigKEVFeb 14, 2013
  Adobe Inc.

  Acrobat
  risk 0.65cvss 7.8epss 0.32

  Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.

• CVE-2015-5334CriJan 23, 2020
  LibreSSL

  LibreSSL
  risk 0.64cvss 9.8epss 0.03

  Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute arbitrary code via a crafted X.509 certificate, which triggers a stack-based buffer overflow. Note: this vulnerability…

• CVE-2016-9843CriMay 23, 2017
  Zlib

  Zlib
  risk 0.64cvss 9.8epss 0.06

  The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.

• CVE-2016-9841CriMay 23, 2017
  Zlib

  Zlib
  risk 0.64cvss 9.8epss 0.08

  inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

• CVE-2016-5178CriMay 23, 2017
  Google

  Chrome
  risk 0.64cvss 9.8epss 0.02

  Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.143 allow remote attackers to cause a denial of service or possibly have other impact via unknown vectors.

• CVE-2014-9843CriMar 20, 2017
  ImageMagick

  Imagemagick
  risk 0.64cvss 9.8epss 0.04

  The DecodePSDPixels function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors.

• CVE-2014-9841CriMar 20, 2017
  ImageMagick

  Imagemagick
  risk 0.64cvss 9.8epss 0.04

  The ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors, related to "throwing of exceptions."

• CVE-2014-9852CriMar 17, 2017
  ImageMagick

  Imagemagick
  risk 0.64cvss 9.8epss 0.03

  distribute-cache.c in ImageMagick re-uses objects after they have been destroyed, which allows remote attackers to have unspecified impact via unspecified vectors.

• CVE-2016-7447CriFeb 6, 2017
  Graphicsmagick

  Graphicsmagick
  risk 0.64cvss 9.8epss 0.04

  Heap-based buffer overflow in the EscapeParenthesis function in GraphicsMagick before 1.3.25 allows remote attackers to have unspecified impact via unknown vectors.

• CVE-2016-7446CriFeb 6, 2017
  Graphicsmagick

  Graphicsmagick
  risk 0.64cvss 9.8epss 0.04

  Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This vulnerability exists due to an incomplete patch for CVE-2016-2317.

• CVE-2016-9427CriDec 12, 2016
  Bdwgc

  bdwgc
  risk 0.64cvss 9.8epss 0.04

  Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.

• CVE-2016-4303CriSep 26, 2016
  Es

  Iperf3
  risk 0.64cvss 9.8epss 0.07

  The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.

• CVE-2016-5772CriAug 7, 2016
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.10

  Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted…