Fedora

CVEs (5,359)

• CVE-2016-4541CriMay 22, 2016
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.06

  The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.

• CVE-2016-4540CriMay 22, 2016
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.06

  The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.

• CVE-2016-4539CriMay 22, 2016
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.06

  The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (buffer under-read and segmentation fault) or possibly have unspecified other impact via crafted XML data in…

• CVE-2016-4538CriMay 22, 2016
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.06

  The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the _zero_, _one_, or _two_ global variable, which allows remote attackers to cause a…

• CVE-2016-4537CriMay 22, 2016
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.06

  The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.

• CVE-2016-4002CriApr 26, 2016
  QEMU

  Qemu
  risk 0.64cvss 9.8epss 0.06

  Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger…

• CVE-2015-8779CriApr 19, 2016
  GNU

  Glibc
  risk 0.64cvss 9.8epss 0.06

  Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.

• CVE-2015-8778CriApr 19, 2016
  GNU

  Glibc
  risk 0.64cvss 9.8epss 0.06

  Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds…

• CVE-2014-9761CriApr 19, 2016
  GNU

  Glibc
  risk 0.64cvss 9.8epss 0.06

  Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function.

• CVE-2016-0729CriApr 7, 2016
  Apache

  Xerces C\+\+
  risk 0.64cvss 9.8epss 0.09

  Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute…

• CVE-2016-1283CriJan 3, 2016
  Pcre

  Pcre
  risk 0.64cvss 9.8epss 0.08

  The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote…

• CVE-2015-8391CriDec 2, 2015
  Pcre

  Pcre
  risk 0.64cvss 9.8epss 0.06

  The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript…

• CVE-2015-8390CriDec 2, 2015
  Pcre

  Pcre
  risk 0.64cvss 9.8epss 0.05

  PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp…

• CVE-2015-8389CriDec 2, 2015
  Pcre

  Pcre
  risk 0.64cvss 9.8epss 0.04

  PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object…

• CVE-2015-8386CriDec 2, 2015
  Pcre

  Pcre
  risk 0.64cvss 9.8epss 0.07

  PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a…

• CVE-2015-8383CriDec 2, 2015
  Pcre

  Pcre
  risk 0.64cvss 9.8epss 0.06

  PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by…

• CVE-2014-1532CriApr 30, 2014
  Mozilla Corporation

  Firefox
  risk 0.64cvss 9.8epss 0.05

  Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a…

• CVE-2014-1524CriApr 30, 2014
  Mozilla Corporation

  Firefox
  risk 0.64cvss 9.8epss 0.08

  The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or…

• CVE-2014-1486CriFeb 6, 2014
  Mozilla Corporation

  Firefox
  risk 0.64cvss 9.8epss 0.07

  Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving unspecified Content-Type values…

• CVE-2014-1477CriFeb 6, 2014
  Mozilla Corporation

  Firefox
  risk 0.64cvss 9.8epss 0.06

  Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly…