VYPR
← OpenSUSE

Vendor CVEs

OpenSUSE

All CVEs

3,309 total · sorted by risk
  • CVE-2015-3164Jul 1, 2015
    Xorg
    Xserver
    risk 0.00cvss —epss 0.00

    The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users to read from or send information to arbitrary X11 clients via vectors involving a UNIX socket.

  • CVE-2015-2141Jul 1, 2015
    Cryptopp
    Crypto\+\+ Library
    risk 0.00cvss —epss 0.03

    The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack.

  • CVE-2015-4146Jun 15, 2015
    W1.fi
    Hostapd
    risk 0.00cvss —epss 0.03

    The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service (crash) via a crafted message.

  • CVE-2015-4145Jun 15, 2015
    W1.fi
    Hostapd
    risk 0.00cvss —epss 0.03

    The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message.

  • CVE-2015-4144Jun 15, 2015
    W1.fi
    Hostapd
    risk 0.00cvss —epss 0.03

    The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message.

  • CVE-2015-4143Jun 15, 2015
    W1.fi
    Hostapd
    risk 0.00cvss —epss 0.04

    The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.

  • CVE-2015-4142Jun 15, 2015
    W1.fi
    Hostapd
    risk 0.00cvss —epss 0.04

    Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds…

  • CVE-2015-4141Jun 15, 2015
    W1.fi
    Hostapd
    risk 0.00cvss —epss 0.03

    The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of service (crash) via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer…

  • CVE-2015-4002Jun 7, 2015
    Linux
    Kernel
    risk 0.00cvss —epss 0.08

    drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code…

  • CVE-2015-4156Jun 2, 2015
    GNU
    Parallel
    risk 0.00cvss —epss 0.00

    GNU Parallel before 20150522 (Nepal), when using (1) --cat or (2) --fifo with --sshlogin, allows local users to write to arbitrary files via a symlink attack on a temporary file.

  • CVE-2015-2718May 14, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The WebChannel.jsm module in Mozilla Firefox before 38.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive webchannel-response data via a crafted web site containing an IFRAME element referencing a different web site that is intended to read this data.

  • CVE-2015-2717May 14, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Integer overflow in libstagefright in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and out-of-bounds read) via an MP4 video file containing invalid metadata.

  • CVE-2015-2715May 14, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) by leveraging improper Media Decoder Thread creation at…

  • CVE-2015-2713May 14, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a document containing…

  • CVE-2015-2712May 14, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The asm.js implementation in Mozilla Firefox before 38.0 does not properly determine heap lengths during identification of cases in which bounds checking may be safely skipped, which allows remote attackers to trigger out-of-bounds write operations and possibly execute arbitrary…

  • CVE-2015-2711May 14, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a referrer META element in cases of context-menu navigation and middle-click navigation, which allows remote attackers to obtain sensitive information by reading web-server Referer logs that contain…

  • CVE-2015-2710May 14, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code via crafted SVG graphics data in conjunction with a crafted Cascading Style Sheets…

  • CVE-2015-2709May 14, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

  • CVE-2015-2708May 14, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code…

  • CVE-2015-3451May 12, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.04

    The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.

  • CVE-2014-3598May 1, 2015
    Python (programming language)
    Pillow
    risk 0.00cvss —epss 0.02

    The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image.

  • CVE-2015-3026Apr 29, 2015
    Xiph.Org
    Icecast
    risk 0.00cvss —epss 0.04

    Icecast before 2.4.2, when a stream_auth handler is defined for URL authentication, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request without login credentials, as demonstrated by a request to…

  • CVE-2015-3340Apr 28, 2015
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.

  • CVE-2015-1863Apr 28, 2015
    W1.fi
    Wpa Supplicant
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.

  • CVE-2015-3336Apr 19, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 42.0.2311.90 does not always ask the user before proceeding with CONTENT_SETTINGS_TYPE_FULLSCREEN and CONTENT_SETTINGS_TYPE_MOUSELOCK changes, which allows user-assisted remote attackers to cause a denial of service (UI disruption) by constructing a crafted…

  • CVE-2015-3335Apr 19, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc in Google Chrome before 42.0.2311.90 does not have RLIMIT_AS and RLIMIT_DATA limits for Native Client (aka NaCl) processes, which might make it easier for remote…

  • CVE-2015-3334Apr 19, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    browser/ui/website_settings/website_settings.cc in Google Chrome before 42.0.2311.90 does not always display "Media: Allowed by you" in a Permissions table after the user has granted camera permission to a web site, which might make it easier for user-assisted remote attackers…

  • CVE-2015-1241Apr 19, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers to trigger unintended UI actions via a crafted web site that conducts a "tapjacking" attack.

  • CVE-2015-0492Apr 16, 2015
    Oracle Corporation
    Javafx
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0484.

  • CVE-2015-0491Apr 16, 2015
    Oracle Corporation
    Java Se
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0459.

  • CVE-2015-0486Apr 16, 2015
    Oracle Corporation
    Java Se
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

  • CVE-2015-0484Apr 16, 2015
    Oracle Corporation
    Java Se
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0492.

  • CVE-2015-0459Apr 16, 2015
    Novell
    Suse Linux Enterprise Desktop
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0491.

  • CVE-2015-0458Apr 16, 2015
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in in Oracle Java SE 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

  • CVE-2015-3041Apr 14, 2015
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2015-3040Apr 14, 2015
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.05

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a…

  • CVE-2015-0360Apr 14, 2015
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2015-0355Apr 14, 2015
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2015-0354Apr 14, 2015
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2015-0353Apr 14, 2015
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2015-0352Apr 14, 2015
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2015-0350Apr 14, 2015
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2015-0347Apr 14, 2015
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2014-9488Apr 14, 2015
    GNU
    Less
    risk 0.00cvss —epss 0.04

    The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.

  • CVE-2015-0799Apr 8, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    The HTTP Alternative Services feature in Mozilla Firefox before 37.0.1 allows man-in-the-middle attackers to bypass an intended X.509 certificate-verification step for an SSL server by specifying that server in the uri-host field of an Alt-Svc HTTP/2 response header.

  • CVE-2015-0812Apr 1, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a…

  • CVE-2015-0811Apr 1, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service (out-of-bounds read) via an image that is improperly handled during transformation.

  • CVE-2015-0808Apr 1, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The webrtc::VPMContentAnalysis::Release function in the WebRTC implementation in Mozilla Firefox before 37.0 uses incompatible approaches to the deallocation of memory for simple-type arrays, which might allow remote attackers to cause a denial of service (memory corruption) via…

  • CVE-2015-0806Apr 1, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to…

  • CVE-2015-0805Apr 1, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a…

Page 53 of 67