PT-2017-4250 · Redis +1 · Redis +1

Name of the Vulnerable Software and Affected Versions: Redis versions prior to 3.2.7 Description: The issue is related to the networking.c component of the Redis database management system, which lacks a check for POST and Host: strings. This allows for "Cross Protocol Scripting" and can be...

DEBIAN-CVE-2016-8339

A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG S...

CVE-2013-7458

linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .redisclihistory, which allows local users to obtain sensitive information by reading the file...

redis: Integer wraparound in lua_struct.c causing stack-based buffer overflow

An integer-wraparound flaw leading to a stack-based overflow was found in Redis. A user with access to run Lua code in a Redis session could possibly use this flaw to crash the server denial of service or gain code execution outside of the Lua sandbox...

DEBIAN-CVE-2015-4335

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command...