CVE-2020-8017

CVE-2020-8017 is a local vulnerability in the cron job shipped with texlive-filesystem affecting SUSE/OpenSUSE platforms. The issue is a race condition that enables link following, permitting local users (in the mktex group) to delete arbitrary files on the system. Affected products/versions incl...

CVE-2015-4826

CVE-2015-4826 affects Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier. The vulnerability is described as unspecified and allows remote authenticated users to affect confidentiality via unknown vectors related to Server: Types. The NVD entry lists a CVSS2 base score of 4.0 (MEDIUM) w...

CVE-2016-1697

CVE-2016-1697 affects Google Chrome (Blink/WebKit) prior to 51.0.2704.79. The FrameLoader::startLoad path in FrameLoader.cpp does not prevent frame navigations during DocumentLoader detach, enabling a remote attacker to bypass the Same Origin Policy via crafted JavaScript. A patch was released in...

CVE-2018-14522

CVE-2018-14522 affects aubio 0.4.6 where aubio_pitch_set_unit in pitch/pitch.c can trigger a SEGV crash. Multiple advisories note the issue as fixed in openSUSE/Aubio updates (e.g., openSUSE-SU-2019:1229, OSV-OPENSU…), with patches moving to aubio 0.4.9+ and related packages. The connected record...

CVE-2019-3690

CVE-2019-3690 originates from the chkstat tool in the permissions package, which followed symlinks before commit, enabling local privilege escalation for attackers with control over a traversed path. Connected advisories confirm this vulnerability in SUSE products and document a fix in the relate...

CVE-2016-0650

CVE-2016-0650 is described in the connected documents as an unspecified vulnerability in Oracle MySQL Server related to the Server: Replication component that could allow a local/remote attacker to impact availability (DoS). The public details indicate the issue affects MySQL/MariaDB families acr...

CVE-2016-2822

Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 are vulnerable to address-bar spoofing. The issue arises from a persistent menu in a SELECT element that can overlay the URL bar, allowing remote attackers to masquerade a malicious site as trusted. Affected products include Firefox des...

CVE-2019-18932

CVE-2019-18932 affects the Squid Analysis Report Generator (sarg) up to version 2.3.11. The root cause is insecure handling of a fixed temporary directory (/tmp/sarg) used by sarg; as root, sarg creates or reuses this directory in an insecure way. An attacker can pre-create /tmp/sarg and place sy...

CVE-2019-2874

CVE-2019-2874 affects Oracle VM VirtualBox (Core) with vulnerable builds before 5.2.32 and before 6.0.10. An attacker with local access and low privileges can log on to the host running VirtualBox to cause a partial denial of service. CVSS v3.1 base score is 3.3 (LOW), vector: LOCAL, LOW attack c...

CVE-2020-14650

CVE-2020-14650 affects Oracle VM VirtualBox (Core) with affected versions prior to 5.2.44, 6.0.24, and 6.1.12. The vulnerability is exploitable locally by a user with logon to the host where VirtualBox runs, potentially granting unauthorized access to data and exposing all VirtualBox accessible d...

CVE-2020-6609

GNU LibreDWG 0.9.3.2564 contains a heap-based buffer over-read in read_pages_map (decode_r2007.c), identified as CVE-2020-6609. Multiple connected advisories confirm this vulnerability and state that fixes were delivered in LibreDWG 0.10, with related CVEs 2020-6610 to 2020-6615 addressed in the ...

CVE-2015-7208

CVE-2015-7208 affects Mozilla Firefox before 43.0. The issue arises from cookies containing vertical tab characters ('\v') being stored, enabling a remote attacker to read HTTP Cookie headers and obtain sensitive information. The vulnerability is tied to the cookie handling/tokenization logic and...

CVE-2016-2797

Graphite 2 before 1.3.6 is affected by CVE-2016-2797 via the TtfUtil::CmapSubtable12Lookup path. The vulnerability exists when Graphite is used by Firefox before 45.0 and Firefox ESR 38.x before 38.7, allowing a crafted Graphite smart font to cause a denial-of-service (buffer over-read) or simila...

CVE-2018-16597

CVE-2018-16597 affects the Linux kernel prior to version 4.8. The issue is an incorrect access check in overlayfs mounts, which could allow a local attacker to modify or truncate files on the underlying filesystem. The connected Nessus/OpenVAS advisories reference kernel updates to fix this vulne...

CVE-2018-18849

CVE-2018-18849 affects QEMU 3.0.0 and is triggered in the SCSI LSI53c895a controller (hw/scsi/lsi53c895a.c) via lsi_do_msgin, allowing out-of-bounds access from an invalid msg_len value. The vulnerability’s impact is an out-of-bounds access, with CVSS indicating low to medium severity (local vect...

CVE-2016-0505

CVE-2016-0505 is an unspecified vulnerability in Oracle MySQL Server and MariaDB that could allow a remote authenticated user to cause a denial of service via unknown vectors related to Options. Affected versions include MySQL 5.5.46 and earlier, 5.6.27 and earlier, 5.7.9 and MariaDB before 5.5.4...

CVE-2016-0609

CVE-2016-0609 is an Oracle MySQL vulnerability affecting multiple branches (MySQL 5.5.46 and earlier; 5.6.27 and earlier; 5.7.9 and MariaDB before 5.5.47; 10.0.x before 10.0.23; 10.1.x before 10.1.10) where remote authenticated users can affect availability via unknown vectors related to privileg...

CVE-2020-6612

CVE-2020-6612 affects GNU LibreDWG, specifically version 0.9.3.2564, where a heap-based buffer over-read occurs in decode_r2007.c in copy_compressed_bytes. Public advisories from openSUSE/OpenSUSE security updates (libredwg 0.10) indicate this is among several fixes addressing CVEs in the 2020-66...

CVE-2020-7041

CVE-2020-7041 affects openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later; tunnel.c incorrectly treats an X509_check_host negative error as success, bypassing certificate hostname validation. This can permit an attacker to misverify credentials. Public advisories indicate fixes in later ope...

CVE-2015-5221

CVE-2015-5221 is a vulnerability in the JasPer JPEG-2000 library (libjasper/mif/mif_cod.c, function mif_process_cmpt). Multiple connected sources confirm a memory safety issue in this area: the core flaw is described as a use-after-free or memory misreference in the mif_process_cmpt path, exploit...

CVE-2016-0600

CVE-2016-0600 is an unspecified vulnerability in Oracle MySQL Server affecting InnoDB across multiple branches: MySQL 5.5.x (≤5.5.46), 5.6.x (≤5.6.27), 5.7.x (≤5.7.9) and MariaDB up to 5.5.46/47, plus 10.0.x ≤10.0.23 and 10.1.x ≤10.1.10. It allows remote authenticated users to cause a denial of s...

CVE-2016-0649

CVE-2016-0649 is cited in IBM Security Bulletins as an unspecified vulnerability in Oracle MySQL Server related to the Server: PS component that could cause a partial availability DoS. Affected product in this IBM bulletin is PowerKVM (versions 2.1 and 3.1); remediation is to apply updates via yu...

CVE-2019-18903

CVE-2019-18903 describes a Use-After-Free in the wicked service across SUSE/openSUSE products. Affected: SUSE Linux Enterprise Server 12 wicked < 0.6.60-2.18.1 and SLES 15 wicked < 0.6.60-28.26.1; openSUSE Leap 15.1 wicked < 0.6.60-lp151.2.9.1; openSUSE Factory wicked

CVE-2019-2876

CVE-2019-2876 affects Oracle VM VirtualBox Core, with affected versions prior to 5.2.32 and prior to 6.0.10. The vulnerability can be triggered by a locally authenticated attacker, enabling a partial denial of service of VirtualBox. The connected sources (openSUSE/SUSE advisories, Gentoo GLSA, De...

CVE-2020-6610

CVE-2020-6610 affects GNU LibreDWG 0.9.3.2564 via an attempted memory allocation overflow in read_sections_map (decode_r2007.c). The issue is documented across multiple sources (NVD entry for CVE-2020-6610 and related OSV/OpenSUSE advisories) and is mitigated by updating libredwg to release 0.10,...

CVE-2015-7211

CVE-2015-7211 (Mozilla Firefox): Firefox before 43.0 mishandles the # character in data: URIs, allowing remote attackers to spoof websites via unspecified vectors. Affected: Mozilla Firefox before 43.0. Root cause: parsing/handling issue in data: URIs leading to spoofing. Impact: potential user d...

CVE-2016-0608

CVE-2016-0608 is an unspecified vulnerability in Oracle MySQL Server and MariaDB affecting multiple tracks (MySQL 5.5.46 and earlier, 5.6.27 and earlier, 5.7.9; MariaDB before 5.5.47; MySQL 10.0.x before 10.0.23; 10.1.x before 10.1.10) that allows remote authenticated users to affect availability...

CVE-2016-4346

CVE-2016-4346 affects PHP prior to 7.0.4. The root cause is an integer overflow in the str_pad function (ext/standard/string.c) that can be triggered by a long input string, leading to a heap-based buffer overflow. Impact described in the sources includes remote denial of service and potentially ...

CVE-2020-7216

The CVE-2020-7216 issue affects openSUSE wicked up to version 0.6.55, caused by a memory leak in ni_dhcp4_parse_response when handling DHCP4 packets without a message type option. This vulnerability permits network attackers to trigger a denial of service. Public references from SUSE security adv...

CVE-2016-0597

CVE-2016-0597 is an unspecified vulnerability in Oracle MySQL Server and MariaDB affecting the optimizer component that could allow remote authenticated users to cause a denial of service via unknown/optimizer-related vectors. The initial records list vulnerable families across MySQL/MariaDB rele...

CVE-2016-0598

CVE-2016-0598 – Oracle MySQL/MariaDB DML-related DoS . The connected sources confirm a vulnerability in Oracle MySQL Server and MariaDB families where remote authenticated users can cause a denial of service via DML-related vectors. Affected versions include MySQL 5.5.46 and earlier, 5.6.27 and e...

CVE-2016-4954

The CVE-2016-4954 entry affects ntpd (NTP v4) and is triggered by the process_packet() function in ntp_proto.c, where NTP 4.x versions before 4.2.8p8 can be caused to enter a peer-variable modification state when it receives spoofed packets from multiple sources, demonstrated by an incorrect leap...

CVE-2016-6161

CVE-2016-6161 affects the GD Graphics Library (libgd); specifically the output function in gd_gif_out.c can trigger an out-of-bounds read via a crafted GIF image, allowing a remote attacker to cause a denial of service. The connected documents consistently describe this issue as a remote vulnerab...

CVE-2020-6614

CVE-2020-6614 affects GNU LibreDWG 0.9.3.2564 with a heap-based buffer over-read in bfr_read (decode.c). Connected advisories show libredwg fixes in OpenSUSE/SUSE updates (0.10 release), addressing this and related CVEs (6609–6615). Affected: openSUSE Leap 15.1 and backports; remediation is upgra...

CVE-2020-8228

CVE-2020-8228 describes a missing rate limit on the signup page in the Nextcloud Preferred Providers app (version 1.7.0), allowing an attacker to repeatedly set the password. The OpenSUSE security advisory (NC-SA-2020-033) and related OSS notes confirm this CVE and indicate it was addressed in th...

CVE-2015-6031

CVE-2015-6031 : A buffer overflow exists in MiniUPnP Client (MiniUPnPc) in the IGDstartelt function within igd_desc_parse.c. Versions before 1.9.20150917 are affected, allowing remote UPNP servers to crash the application and potentially execute arbitrary code via an oversized XML element name. S...

CVE-2016-2833

CVE-2016-2833 affects Mozilla Firefox prior to 47.0, where CSP checks are bypassed for cross-domain Java applets. This CSP bypass could enable remote attackers to perform cross-site scripting (XSS) via a crafted applet. The available connected sources confirm Firefox versions affected and referen...

CVE-2016-2832

CVE-2016-2832 affects Mozilla Firefox prior to 47.0, enabling information disclosure of disabled plugins via CSS pseudo-classes. Connected advisories indicate this vulnerability is addressed in Firefox 47 updates (e.g., openSUSE-2016-714/openSUSE-2016-704 patches). Affected component: CSS pseudo-...

CVE-2018-14523

The CVE-2018-14523 issue affects aubio 0.4.6, where a buffer over-read can occur in new_aubio_pitchyinfft (pitch/pitchyinfft.c). Multiple connected advisories (openSUSE, OSV, GHSA) confirm the vulnerability and indicate that vulnerable aubio versions could crash or potentially leak information. O...

CVE-2016-2828

CVE-2016-2828 is a use-after-free in Mozilla Firefox/WebGL texture handling (texture access after recycle pool destruction) that could allow remote code execution. Public details show impact on Firefox before 47.0 and ESR 45.x before 45.2. Remediation varies by vendor: upgrade Firefox/Firefox ESR...

CVE-2019-18901

CVE-2019-18901 affects SUSE Linux Enterprise Server 12 (mariadb, prior to 10.2.31-3.25.1) and SLE 15 (mariadb, prior to 10.2.31-3.26.1). A UNIX symlink following in mysql-systemd-helper allows local attackers to change permissions of arbitrary files to 0640. The vulnerability is localized (LOCAL)...

CVE-2020-6611

CVE-2020-6611 affects GNU LibreDWG 0.9.3.2564 with a NULL pointer dereference in get_next_owned_entity (dwg.c). The vulnerability can lead to a crash/denial of service. Connected advisories indicate fixes in LibreDWG to release 0.10 (e.g., openSUSE/SUSE updates referencing CVE-2020-6611 and libre...

CVE-2015-7207

CVE-2015-7207 affects Mozilla Firefox before 43.0. The vulnerability arises because the IFRAME Resource Timing API times are not properly restricted, allowing a remote attacker to bypass the Same Origin Policy and exfiltrate data via crafted JavaScript that uses history.back and performance.getEn...

CVE-2016-0596

CVE-2016-0596 is an unspecified vulnerability in Oracle MySQL Server family (MySQL 5.5.46 and earlier, 5.6.27 and earlier; MariaDB before 5.5.47; 10.0.x before 10.0.23; 10.1.x before 10.1.10) that could allow remote authenticated users to affect availability via DML-related vectors. Public source...

CVE-2016-2324

CVE-2016-2324 affects Git prior to 2.7.4. A heap-based buffer overflow is triggered by path-related inputs (e.g., long filenames or deeply nested trees), enabling remote code execution. Public advisories from Debian, Ubuntu, Arch, CentOS, and Cloud Foundry reference two related buffer-overflow vu...

CVE-2019-14524

CVE-2019-14524 is a local, heap-based overflow in Schism Tracker’s MTM loader (fmt_mtm_load_song in fmt/mtm.c) triggered by a large number of song patterns. Affects Schism Tracker up to 20190722. Public advisories (openSUSE GLSA-202107-12 and OpenSUSE-SU-2019:1994) report a fix in patches release...

CVE-2019-9773

CVE-2019-9773 affects GNU LibreDWG, with a heap-based buffer overflow in dwg_decode_eed_data (z dimension) in versions 0.7 and 0.7.1645. Connected advisories show openSUSE/SUSE patches and releases (e.g., libredwg 0.9.3) addressing this family of issues, including corrections for overflows and re...

CVE-2016-0749

CVE-2016-0749 affects SPICE software (remote display system for VMs). The vulnerability stems from the smartcard interaction in SPICE, enabling a remote attacker to cause a heap-based buffer overflow by connecting to a guest VM, potentially crashing the QEMU-KVM host process or executing arbitrar...

CVE-2016-1944

CVE-2016-1944 affects Mozilla Firefox before 44.0 via a flaw in ANGLE’s Buffer11::NativeBuffer11::map, leading to memory corruption and potential denial of service. OpenSUSE/Mozilla advisories around 2016-02 show Firefox 44.0 (NSS 3.21, NSPR 4.11) as part of the fix set, with the issue listed amo...

CVE-2016-6132

CVE-2016-6132 affects the GD Graphics Library (libgd) . The vulnerability exists in the function gdImageCreateFromTgaCtx for libgd versions before 2.2.3 , where processing a crafted TGA file can lead to a remote denial of service via an out-of-bounds read . Impact is described as potentially trig...