Fedora

CVEs (790)

• CVE-2016-1254HigDec 5, 2017
  Torproject

  Tor
  risk 0.42cvss 7.5epss 0.03

  Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.

• CVE-2017-12843MedAug 22, 2017
  Cyrus

  IMAP
  risk 0.42cvss 6.5epss 0.01

  Cyrus IMAP before 3.0.3 allows remote authenticated users to write to arbitrary files via a crafted (1) SYNCAPPLY, (2) SYNCGET or (3) SYNCRESTORE command.

• CVE-2017-11368MedAug 9, 2017
  Mit

  Kerberos
  risk 0.42cvss 6.5epss 0.02

  In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

• CVE-2015-5219HigJul 21, 2017
  NTP

  NTP
  risk 0.42cvss 7.5epss 0.06

  The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.

• CVE-2015-5195HigJul 21, 2017
  NTP

  NTP
  risk 0.42cvss 7.5epss 0.07

  ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.

• CVE-2015-5194HigJul 21, 2017
  NTP

  NTP
  risk 0.42cvss 7.5epss 0.06

  The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.

• CVE-2016-9243HigMar 27, 2017
  pyca

  Cryptography
  risk 0.42cvss 7.5epss 0.03

  HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.

• CVE-2016-5404MedSep 7, 2016
  Freeipa

  Freeipa
  risk 0.42cvss 6.5epss 0.03

  The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.

• CVE-2016-2146HigApr 15, 2016
  Fedoraproject

  Fedora
  risk 0.42cvss 7.5epss 0.03

  The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or memory consumption) via a large amount of POST data.

• CVE-2016-2145HigApr 15, 2016
  Fedoraproject

  Fedora
  risk 0.42cvss 7.5epss 0.03

  The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which allows remote attackers to cause a denial of service (segmentation fault and process crash) via a crafted POST data.

• CVE-2016-2041HigFeb 20, 2016
  PhpMyAdmin

  phpMyAdmin
  risk 0.42cvss 7.5epss 0.03

  libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time…

• CVE-2016-1523MedFeb 13, 2016
  Mozilla Corporation

  Firefox
  risk 0.42cvss 6.5epss 0.02

  The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL…

• CVE-2010-2249MedJun 30, 2010
  Libpng

  Libpng
  risk 0.42cvss 6.5epss 0.03

  Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a PNG image containing malformed Physical Scale (aka sCAL) chunks.

• CVE-2010-1637MedJun 22, 2010
  SquirrelMail

  Squirrelmail
  risk 0.42cvss 6.5epss 0.03

  The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.

• CVE-2009-2416MedAug 11, 2009
  Xmlsoft

  Libxml2
  risk 0.42cvss 6.5epss 0.02

  Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as…

• CVE-2008-3281MedAug 27, 2008
  Xmlsoft

  Libxml2
  risk 0.42cvss 6.5epss 0.03

  libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.

• CVE-2019-12098HigMay 15, 2019
  Heimdal

  Heimdal
  risk 0.41cvss 7.4epss 0.02

  In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.

• CVE-2016-4008MedMay 5, 2016
  GNU

  Libtasn1
  risk 0.41cvss 5.9epss 0.30

  The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service (infinite recursion) via a crafted certificate.

• CVE-2016-4482MedMay 23, 2016
  Linux

  Kernel
  risk 0.40cvss 6.2epss 0.01

  The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call.

• CVE-2016-0725MedFeb 22, 2016
  Moodle

  Moodle
  risk 0.40cvss 6.1epss 0.02

  Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search…