Fedora

CVEs (5,359)

• CVE-2014-9527Jan 6, 2015
  Apache

  Poi
  risk 0.01cvss —epss 0.08

  HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.

• CVE-2014-8964Dec 16, 2014
  Pcre

  Pcre
  risk 0.01cvss —epss 0.07

  Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or have other unspecified impact via a crafted regular expression, related to an assertion that allows zero repeats.

• CVE-2014-8485Dec 9, 2014
  GNU

  Binutils
  risk 0.01cvss —epss 0.07

  The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file.

• CVE-2014-2286Apr 18, 2014
  Asterisk

  Certified Asterisk
  risk 0.01cvss —epss 0.16

  main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute…

• CVE-2013-5610Dec 11, 2013
  Mozilla Corporation

  Firefox
  risk 0.01cvss —epss 0.07

  Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

• CVE-2013-6629Nov 19, 2013
  Google

  Chrome
  risk 0.01cvss —epss 0.10

  The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of…

• CVE-2012-1149Jun 21, 2012
  Libreoffice

  Libreoffice
  risk 0.01cvss —epss 0.14

  Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object,…

• CVE-2012-2089Apr 17, 2012
  Nginx

  Nginx
  risk 0.01cvss —epss 0.10

  Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a…

• CVE-2012-1180Apr 17, 2012
  Nginx

  Nginx
  risk 0.01cvss —epss 0.11

  Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request.

• CVE-2011-4517Dec 15, 2011
  Jasper

  JasPer
  risk 0.01cvss —epss 0.10

  The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory…

• CVE-2011-4516Dec 15, 2011
  Jasper

  JasPer
  risk 0.01cvss —epss 0.10

  Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted numrlvls value in a coding style default (COD) marker…

• CVE-2011-1783Jun 6, 2011
  Apache

  Subversion
  risk 0.01cvss —epss 0.07

  The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is enabled, allows remote attackers to cause a denial of service (infinite loop and memory consumption) in…

• CVE-2011-1752Jun 6, 2011
  Apache

  Subversion
  risk 0.01cvss —epss 0.08

  The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May…

• CVE-2010-4494Dec 7, 2010
  Google

  Chrome
  risk 0.01cvss —epss 0.08

  Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.

• CVE-2010-4180Dec 6, 2010
  OpenSSL Project

  OpenSSL
  risk 0.01cvss —epss 0.10

  OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors…

• CVE-2010-0395Jun 10, 2010
  Apache

  Openoffice
  risk 0.01cvss —epss 0.10

  OpenOffice.org 2.x and 3.0 before 3.2.1 allows user-assisted remote attackers to bypass Python macro security restrictions and execute arbitrary Python code via a crafted OpenDocument Text (ODT) file that triggers code execution when the macro directory structure is previewed.

• CVE-2010-1321May 19, 2010
  Mit

  Kerberos 5
  risk 0.01cvss —epss 0.07

  The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users…

• CVE-2010-0434Mar 5, 2010
  Apache

  HTTP Server
  risk 0.01cvss —epss 0.18

  The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote…

• CVE-2009-3231Sep 17, 2009
  PostgreSQL

  PostgreSQL
  risk 0.01cvss —epss 0.08

  The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.

• CVE-2009-3095Sep 8, 2009
  Apache

  HTTP Server
  risk 0.01cvss —epss 0.13

  The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain…