Fedora

CVEs (5,358)

• CVE-2015-2059Aug 12, 2015
  Fedoraproject

  Fedora
  risk 0.00cvss —epss 0.03

  The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read.

• CVE-2015-1840Jul 26, 2015
  Fedoraproject

  Fedora
  risk 0.00cvss —epss 0.05

  jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server,…

• CVE-2015-4454Jun 17, 2015
  Cacti (software)

  Cacti
  risk 0.00cvss —epss 0.02

  SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php.

• CVE-2015-4342Jun 17, 2015
  Cacti (software)

  Cacti
  risk 0.00cvss —epss 0.03

  SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.

• CVE-2015-2665Jun 17, 2015
  Cacti (software)

  Cacti
  risk 0.00cvss —epss 0.02

  Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

• CVE-2015-4106Jun 3, 2015
  QEMU

  Qemu
  risk 0.00cvss —epss 0.00

  QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact…

• CVE-2015-2922May 27, 2015
  Linux

  Kernel
  risk 0.00cvss —epss 0.03

  The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement…

• CVE-2015-2666May 27, 2015
  Linux

  Kernel
  risk 0.00cvss —epss 0.00

  Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges…

• CVE-2015-3885May 19, 2015
  Dcraw Project

  Dcraw
  risk 0.00cvss —epss 0.05

  Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.

• CVE-2015-0278May 18, 2015
  Libuv Project

  Libuv
  risk 0.00cvss —epss 0.03

  libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.

• CVE-2015-3451May 12, 2015
  Fedoraproject

  Fedora
  risk 0.00cvss —epss 0.04

  The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.

• CVE-2015-3340Apr 28, 2015
  Xen

  Xen
  risk 0.00cvss —epss 0.01

  Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.

• CVE-2015-0844Apr 14, 2015
  Wesnoth

  Battle For Wesnoth
  risk 0.00cvss —epss 0.02

  The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.

• CVE-2015-2782Apr 8, 2015
  Open-source ARJ archiver

  Open-source ARJ archiver
  risk 0.00cvss —epss 0.06

  Buffer overflow in Open-source ARJ archiver 3.10.22 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ARJ archive.

• CVE-2015-0557Apr 8, 2015
  Arj Software

  Arj Archiver
  risk 0.00cvss —epss 0.03

  Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.

• CVE-2015-0556Apr 8, 2015
  ARJ

  ARJ archiver
  risk 0.00cvss —epss 0.04

  Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.

• CVE-2015-2756Apr 1, 2015
  Xen

  Xen
  risk 0.00cvss —epss 0.00

  QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express…

• CVE-2015-2752Apr 1, 2015
  Xen

  Xen
  risk 0.00cvss —epss 0.00

  The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm).

• CVE-2015-2751Apr 1, 2015
  Xen

  Xen
  risk 0.00cvss —epss 0.02

  Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.

• CVE-2015-1827Mar 30, 2015
  Freeipa

  Freeipa
  risk 0.00cvss —epss 0.03

  The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number…