Lucene search

K

OpenSUSE Security Vulnerabilities

cve
cve

CVE-2015-7212

Integer overflow in the mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering a graphics operation that requires a large texture...

8.1AI Score

0.039EPSS

2015-12-16 11:59 AM
61
cve
cve

CVE-2015-7211

Mozilla Firefox before 43.0 mishandles the # (number sign) character in a data: URI, which allows remote attackers to spoof web sites via unspecified...

7.1AI Score

0.004EPSS

2015-12-16 11:59 AM
44
cve
cve

CVE-2015-7210

Use-after-free vulnerability in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering attempted use of a data channel that has been closed by a WebRTC...

7.9AI Score

0.057EPSS

2015-12-16 11:59 AM
51
cve
cve

CVE-2015-7208

Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie...

6.6AI Score

0.005EPSS

2015-12-16 11:59 AM
39
cve
cve

CVE-2015-7207

Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls, a...

7.3AI Score

0.005EPSS

2015-12-16 11:59 AM
49
cve
cve

CVE-2015-7205

Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 might allow remote attackers to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a crafted WebRTC RTP...

7.9AI Score

0.018EPSS

2015-12-16 11:59 AM
72
cve
cve

CVE-2015-7204

Mozilla Firefox before 43.0 does not properly store the properties of unboxed objects, which allows remote attackers to execute arbitrary code via crafted JavaScript variable...

7.9AI Score

0.036EPSS

2015-12-16 11:59 AM
76
cve
cve

CVE-2015-7203

Buffer overflow in the DirectWriteFontInfo::LoadFontFamilyData function in gfx/thebes/gfxDWriteFontList.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted font-family...

7.8AI Score

0.044EPSS

2015-12-16 11:59 AM
39
cve
cve

CVE-2015-7202

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown...

8.4AI Score

0.051EPSS

2015-12-16 11:59 AM
49
cve
cve

CVE-2015-7201

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown...

8.6AI Score

0.048EPSS

2015-12-16 11:59 AM
68
cve
cve

CVE-2015-7499

Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified...

7AI Score

0.002EPSS

2015-12-15 09:59 PM
99
cve
cve

CVE-2015-5309

Integer overflow in the terminal emulator in PuTTY before 0.66 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via an ECH (erase characters) escape sequence with a large parameter value, which triggers a buffer...

9.8AI Score

0.021EPSS

2015-12-07 08:59 PM
41
cve
cve

CVE-2015-3195

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory...

5.3CVSS

6.3AI Score

0.018EPSS

2015-12-06 08:59 PM
135
cve
cve

CVE-2015-8078

Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the section_offset variable. NOTE: this vulnerability exists because of an incomplete fix for.....

4.3AI Score

0.018EPSS

2015-12-03 08:59 PM
29
cve
cve

CVE-2015-8077

Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable. NOTE: this vulnerability exists because of an incomplete fix for...

4.3AI Score

0.018EPSS

2015-12-03 08:59 PM
23
cve
cve

CVE-2015-8076

The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap...

4.3AI Score

0.018EPSS

2015-12-03 08:59 PM
33
cve
cve

CVE-2015-0794

modules.d/90crypt/module-setup.sh in the dracut package before 037-17.30.1 in openSUSE 13.2 allows local users to have unspecified impact via a symlink attack on...

6.5AI Score

0.0004EPSS

2015-11-19 08:59 PM
23
cve
cve

CVE-2014-9756

The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex...

6.2AI Score

0.003EPSS

2015-11-19 08:59 PM
44
cve
cve

CVE-2015-7805

Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF...

6.9AI Score

0.11EPSS

2015-11-17 03:59 PM
42
cve
cve

CVE-2015-8126

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly...

7.9AI Score

0.015EPSS

2015-11-13 03:59 AM
150
cve
cve

CVE-2015-8105

Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file...

6.3AI Score

0.002EPSS

2015-11-10 05:59 PM
26
cve
cve

CVE-2015-8041

Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a denial of service (process crash or infinite loop) via a large payload length field value in an (1) WPS or (2) P2P NFC NDEF record, which triggers an...

5.2AI Score

0.027EPSS

2015-11-09 04:59 PM
111
cve
cve

CVE-2015-7940

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve...

8AI Score

0.002EPSS

2015-11-09 04:59 PM
109
cve
cve

CVE-2015-5218

Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global...

8.2AI Score

0.0004EPSS

2015-11-09 04:59 PM
47
cve
cve

CVE-2015-2697

The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS...

6.9AI Score

0.835EPSS

2015-11-09 03:59 AM
66
2
cve
cve

CVE-2015-2696

lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context...

7AI Score

0.17EPSS

2015-11-09 03:59 AM
46
2
cve
cve

CVE-2015-2695

lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context...

7AI Score

0.095EPSS

2015-11-09 03:59 AM
45
2
cve
cve

CVE-2014-9749

Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay...

7.2AI Score

0.003EPSS

2015-11-06 09:59 PM
26
cve
cve

CVE-2015-8036

Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly...

8AI Score

0.013EPSS

2015-11-02 07:59 PM
40
cve
cve

CVE-2015-6031

Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.20150917 allows remote UPNP servers to cause a denial of service (application crash) and possibly execute arbitrary code via an "oversized" XML element...

7.8AI Score

0.004EPSS

2015-11-02 07:59 PM
47
cve
cve

CVE-2015-5291

Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI)...

8.4AI Score

0.013EPSS

2015-11-02 07:59 PM
35
cve
cve

CVE-2015-4625

Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie...

4.7AI Score

0.0004EPSS

2015-10-26 07:59 PM
32
cve
cve

CVE-2015-3256

PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule...

6.5AI Score

0.0004EPSS

2015-10-26 07:59 PM
83
cve
cve

CVE-2015-7674

Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer...

7.9AI Score

0.024EPSS

2015-10-26 05:59 PM
59
cve
cve

CVE-2015-7673

io-tga.c in gdk-pixbuf before 2.32.0 uses heap memory after its allocation failed, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code via a crafted Truevision TGA (TARGA)...

7.8AI Score

0.024EPSS

2015-10-26 05:59 PM
43
cve
cve

CVE-2015-4913

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than...

5.2AI Score

0.002EPSS

2015-10-22 12:00 AM
69
2
cve
cve

CVE-2015-4870

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server :...

5.1AI Score

0.005EPSS

2015-10-21 11:59 PM
86
2
cve
cve

CVE-2015-4861

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server :...

5.1AI Score

0.002EPSS

2015-10-21 11:59 PM
59
cve
cve

CVE-2015-4858

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than...

5.2AI Score

0.002EPSS

2015-10-21 11:59 PM
69
2
cve
cve

CVE-2015-4836

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server :...

5.1AI Score

0.002EPSS

2015-10-21 11:59 PM
63
cve
cve

CVE-2015-4830

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security :...

5.1AI Score

0.001EPSS

2015-10-21 09:59 PM
57
2
cve
cve

CVE-2015-4826

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server :...

4.9AI Score

0.001EPSS

2015-10-21 09:59 PM
61
2
cve
cve

CVE-2015-4815

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server :...

5.1AI Score

0.002EPSS

2015-10-21 09:59 PM
64
2
cve
cve

CVE-2015-4807

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier, when running on Windows, allows remote authenticated users to affect availability via unknown vectors related to Server : Query...

5AI Score

0.002EPSS

2015-10-21 09:59 PM
47
4
cve
cve

CVE-2015-4802

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than...

5.2AI Score

0.002EPSS

2015-10-21 09:59 PM
62
2
cve
cve

CVE-2015-4792

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than...

5.2AI Score

0.002EPSS

2015-10-21 09:59 PM
69
2
cve
cve

CVE-2015-5235

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web...

6.5AI Score

0.004EPSS

2015-10-09 02:59 PM
35
cve
cve

CVE-2015-5234

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line...

6.8AI Score

0.007EPSS

2015-10-09 02:59 PM
27
cve
cve

CVE-2015-5957

Buffer overflow in the DumpSysVar function in var.c in Remind before 3.1.15 allows attackers to have unspecified impact via a long...

6.9AI Score

0.006EPSS

2015-09-28 08:59 PM
28
cve
cve

CVE-2015-5185

The lookupProviders function in providerMgr.c in sblim-sfcb 1.3.4 and 1.3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty className in a...

6.3AI Score

0.021EPSS

2015-09-28 08:59 PM
32
Total number of security vulnerabilities1478