CVE-2016-9959

CVE-2016-9959 affects Game Music Emu prior to 0.6.1. The vulnerability allows a remote attacker to cause out-of-bounds 8-bit values in SPC/music processing, as described by NVD. Consequences are stated as enabling potential arbitrary behavior from crafted inputs; exploitation details are not prov...

CVE-2016-4036

CVE-2016-4036 affects the Quagga daemon. The root cause is weak permissions on /etc/quagga, allowing local users to read sensitive configuration files. This is paired with CVE-2016-4049, where bgpd could crash from large route dumps due to missing size checks. Public advisories (Debian/Ubuntu) sh...

CVE-2016-7797

CVE-2016-7797 affects Pacemaker prior to 1.1.15. The issue can allow a remote, unauthenticated attacker (via pacemaker remote) to cause a denial of service resulting in node disconnection. The connected sources corroborate the high-level impact and reference related advisories (e.g., RHSA-2016:25...

CVE-2017-5938

CVE-2017-5938 is a Cross-site scripting (XSS) vulnerability in ViewVC’s nav_path function (lib/viewvc.py). Affected: ViewVC versions before 1.0.14 and 1.1.x before 1.1.26. Impact: remote attackers can inject arbitrary JavaScript/HTML via the nav_data name. Mitigation: upgrade to ViewVC 1.1.26 (or...

CVE-2016-10064

CVE-2016-10064 is rejected; this CVE entry is not a security issue.

CVE-2016-1943

Consolidated details show CVE-2016-1943 affects Mozilla Firefox on Android, where the address bar can be spoofed via the scrollTo method. OpenSUSE release notes (openSUSE-2016-128/0306-1/0309) document Firefox 44.0 and NSS/NSPR updates as fixes, explicitly listing CVE-2016-1943 as part of address...

CVE-2016-6172

CVE-2016-6172 affects the PowerDNS Authoritative Server prior to 4.0.1. A remote primary DNS server can trigger a denial of service by sending oversized AXFR or IXFR responses, leading to memory exhaustion and a crash of secondary servers. The vulnerability is rooted in insufficient restrictions ...

CVE-2016-4478

CVE-2016-4478 affects Atheme

CVE-2016-4579

Libksba - CVE-2016-4579: A vulnerability in Libksba prior to 1.3.4 allows remote attackers to trigger a denial of service via an out-of-bounds read in the BER parsing path (_ksba_ber_parse_tl). Impact is a crash/DoS. Connected sources confirm the issue is present across affected distributions (e....

CVE-2016-5739

CVE-2016-5739 affects phpMyAdmin: Transformation feature vulnerability in 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3. Root cause is omission of no-referrer CSP, enabling CSRF token leakage via Referer header. Impact: potential exposure/read of authentication token enabl...

CVE-2016-6225

CVE-2016-6225 affects Percona XtraBackup’s xbcrypt: versions prior to 2.3.6 (and 2.4.x prior to 2.4.5) fail to properly set the initialization vector (IV) for encryption, enabling context-dependent attackers to potentially obtain sensitive data from encrypted backups via a Chosen-Plaintext attack...

CVE-2016-9436

CVE-2016-9436 affects the w3m HTML rendering component, specifically parsetagx.c, where an improper initialization of values in versions before 0.5.3+git20161009 can lead to a crash when parsing a crafted HTML file (related to a tag). The vulnerability is triggered remotely via crafted input, ca...

CVE-2015-8792

The vulnerability CVE-2015-8792 affects libmatroska in the KaxInternalBlock::ReadData path, where crafted EBML lacing can cause an information leak from the process heap memory. Affected versions are libmatroska prior to 1.4.4; the issue enables partial confidentiality leakage without altering in...

CVE-2023-32182

CVE-2023-32182 describes an improper Link Resolution Before File Access in postfix used by SUSE/OpenSUSE packages (SUSE SLED15/SLES15 SP5 and openSUSE Leap 15.5). The root cause is a link-following issue in the related config_postfix handling that could involve potentially unsafe /tmp usage. Affe...

CVE-2016-5164

Chromium/Chrome vulnerability CVE-2016-5164 is a cross-site scripting (UXSS) issue in Blink’s DevTools component (WebKit/Blink) via V8Debugger.cpp. A crafted web site can inject arbitrary script/HTML into DevTools, as described in the CVE entry. Affected versions include Chrome up to 53.0.2785.89...

CVE-2016-5706

CVE-2016-5706 affects phpMyAdmin, where a denial of service is possible by sending a large array in the scripts parameter. Affected branches are 4.0.x prior to 4.0.10.16, 4.4.x prior to 4.4.15.7, and 4.6.x prior to 4.6.3. The NVD metrics show a CVSS v2 base score of 5.0 (Medium) and CVSS v3 base ...

CVE-2016-5730

Summary : CVE-2016-5730 affects phpMyAdmin 4.0.x prior to 4.0.10.16, 4.4.x prior to 4.4.15.7, and 4.6.x prior to 4.6.3. It enables information disclosure by causing error messages to reveal the full installation path via several vectors: (1) an array value to FormDisplay.php, (2) invalid data to ...

CVE-2016-5746

CVE-2016-5746 affects libstorage, libstorage-ng, and yast-storage. The vulnerability arises from improperly storing passphrases for encrypted storage devices in a temporary file on disk (example path: /tmp/libstorage-XXXXXX/pwdf), which could allow local users to read sensitive information. Conne...

CVE-2016-5731

CVE-2016-5731 is a cross‑site scripting (XSS) vulnerability in the phpMyAdmin OpenID authentication flow. The issue affects phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3, where an OpenID error message can be manipulated to inject arbitrary web script or HTML via...

CVE-2016-0594

CVE-2016-0594 affects Oracle MySQL Server 5.6.21 and earlier. An unspecified vulnerability allows remote authenticated users to affect availability via vectors related to DML. The CVSS v2 base score is 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P); no explicit exploit details or fixed version are provided in ...

CVE-2016-3982

OptiPNG contains an off-by-one error in bmp_rle4_fread() in pngxrbmp.c, affecting versions before 0.7.6. This defect can trigger a heap-based buffer overflow, potentially leading to denial of service or arbitrary code execution when processing crafted BMP/png images. Multiple connected sources co...

CVE-2016-4414

CVE-2016-4414 affects Quassel before 0.12.4, where the onReadyRead function in core/coreauthhandler.cpp is vulnerable. An attacker can trigger a denial of service (NULL pointer dereference and crash) by sending invalid handshake data. Public references in NVD and related advisories confirm the vu...

CVE-2018-10380

CVE-2018-10380 affects kwallet-pam in KDE KWallet prior to 5.12.6, where local users can exploit a symlink to obtain ownership of arbitrary files. The vulnerability stems from insecure permission handling in the PAM module, enabling local privilege elevation with complete confidentiality, integri...

CVE-2013-4118

CVE-2013-4118 affects FreeRDP before 1.1.0-beta1. The vulnerability allows remote attackers to cause a denial of service via unspecified vectors (NULL pointer dereference, app crash). Connected notices confirm the issue across multiple advisories (OpenVAS/Nessus) but do not provide exploit detail...

CVE-2015-3138

CVE-2015-3138 affects tcpdump before version 4.7.4, where print-wb.c can be exploited remotely to cause a denial of service (segmentation fault and process crash). The vulnerability is triggered via crafted input that impacts the WB (print-wb) path. The available description specifies the vulnera...

CVE-2015-8864

CVE-2015-8864 is an XSS vulnerability in Roundcube Webmail, exploitable through a crafted SVG. Affected products are Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5. The issue allows remote attackers to inject arbitrary web script or HTML. The description explicitly notes this is a separate...

CVE-2016-1866

Salt 2015.8.x before 2015.8.4 is vulnerable due to improper handling of clear messages on the minion, enabling a man-in-the-middle to insert packets into the minion-master data stream and execute arbitrary code. A patch is available in Salt 2015.8.4 (and later) to fix this. The CVSS context from ...

CVE-2016-4069

Roundcube Webmail is affected by CVE-2016-4069 (CSRF) in versions before 1.1.5. The vulnerability allows remote attackers to hijack user authentication for requests that download attachments, leading to a denial of service (disk consumption) via unspecified vectors. The available documents do not...

CVE-2016-2042

CVE-2016-2042 affects phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4. A information-disclosure path exists in AES.php and Rijndael.php that, when processing a crafted request, reveals the full installation path in an error message. Impact is partial confidentiality disclosure of server p...

CVE-2016-2043

CVE-2016-2043 affects phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4. The vulnerability is a cross-site scripting (XSS) issue in the goToFinish1NF function of js/normalization.js, allowing remote authenticated users to inject arbitrary web script or HTML via a table name to the normaliza...

CVE-2016-2312

CVE-2016-2312 describes a vulnerability in Plasma-workspace/kscreenlocker where turning all screens off while the lock screen is shown can cause the screen to unlock when a screen is turned back on. The issue is documented across multiple sources (NVD, Debian, Ubuntu, OpenSUSE OSV entries) with t...

CVE-2016-6905

The CVE-2016-6905 issue affects the GD Graphics Library (libgd) read_image_tga in gd_tga.c, with vulnerable code paths present in libgd prior to 2.2.3. The root cause is an out-of-bounds read triggered by processing a crafted TGA image, enabling remote attackers to cause a denial of service. The ...

CVE-2014-9773

CVE-2014-9773 affects Atheme (before 7.2.7); vulnerability found in modules/chanserv/flags.c where remote attackers could modify the Anope FLAGS behavior by registering and dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks. Root cause described as improper handling in that module, ena...

CVE-2016-3992

CVE-2016-3992 affects cronic prior to version 3, enabling local users to write arbitrary files via a symlink attack against cronic.out.$$, cronic.err.$$, or cronic.trace.$$ in /tmp. Root cause: symlink manipulation in temporary files. Practical impact: local privilege or data tampering risk with ...

CVE-2015-7758

Summary of CVE-2015-7758 (Gummi): Gummi 0.6.5 is affected by a local file write via a symlink attack on a temporary dot file whose name imitates an existing file and uses extensions (.aux, .log, .out, .pdf, .toc), e.g., .thesis.tex.aux. The issue arises from predictable temporary filenames in /tm...

CVE-2015-8547

CVE-2015-8547 affects Quassel: the CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp (Quassel 0.10.0) allows remote attackers to crash the application via the /op * command in a query, causing a denial of service. Fedora advisories (FEDORA-2016-3/7f0b1e47ac, etc.) document se...

CVE-2017-9286

The CVE-2017-9286 issue affects openSUSE’s Nextcloud packaging, where upgrading the nextcloud package could allow a local attacker running as wwwrun to escalate to root via an unsafe /srv/www/htdocs handling. The vulnerability stems from a race condition involving a /tmp file during upgrade. Reme...

CVE-2016-5301

CVE-2016-5301 affects libtorrent before 1.1.1, where the parse_chunk_header function can be triggered by a crafted HTTP response or a UPnP broadcast to cause a denial of service (crash). Multiple public advisories and notices (Debian, Ubuntu USN-4790-1, Mageia MGASA-2016-0234, openSUSE openSUSE-2...

CVE-2016-7787

CVE-2016-7787 affects KDE kdebase4-runtime/kdesu: a malicious Unicode terminator can truncate the command line, causing users to see only part of the commands that will be executed as root. This is referenced in NVD/NVD CVE entries and mirrored by Mageia MGASA-2017-0473 and OSV records; remediati...

CVE-2018-12477

The CVE-2018-12477 issue affects Open Build Service’s component obs-service-refresh_patches. The vulnerability stems from improper neutralization of CRLF sequences, allowing an attacker to remotely cause deletion of directories by tricking obs-service-refresh_patches into deleting them. Affected ...

CVE-2020-8014

CVE-2020-8014 is a local privilege escalation in kopano-spamd packaging on openSUSE (Leap 15.1) and openSUSE Tumbleweed. The root cause is a UNIX Symbolic Link (Symlink) Following vulnerability within kopano-spamd packaging, allowing a local attacker with kopano user privileges to escalate to roo...

CVE-2016-4007

CVE-2016-4007 affects the obs-service-extract_file package (and related source validator components) via code/parameter injection in service definitions (unzip with illegal options). Public advisories note the issue was fixed by OBS-related updates: openSUSE/SUSE security notices for obs-service-...

CVE-2016-5759

CVE-2016-5759 affects the mkdumprd script used by kdump environments. The vulnerability arises because mkdumprd can invoke dracut from the current directory (./dracut), enabling a local attacker to trick the administrator into executing code with root privileges. Public sources (NVD, SUSE and Red...

CVE-2012-3534

The vulnerability CVE-2012-3534 affects GNU Gatekeeper (gnugk) prior to version 3.1, where the status port does not limit concurrent connections, enabling a remote attacker to cause a denial of service through a flood of connections. Multiple connected sources corroborate the issue and note remed...

CVE-2017-18215

The CVE-2017-18215 entry concerns the image tool xv, version 3.10a. Affected component: xvpng.c in xv 3.10a. Root cause: memory corruption (out-of-bounds write) when decoding PNG comment fields due to an incorrect length value. Impact: potential crashes or code execution as stated in the sources....

CVE-2016-3100

KDE Frameworks components suffer from a local-privilege issue in kinit prior to v5.23.0: the directory /tmp/xauth-xxx-_y is created with weak permissions (644), enabling local users to read X11 cookies of other users and potentially capture keystrokes or escalate privileges. Remediation: upgrade ...

CVE-2019-3697

The provided documents describe CVE-2019-3697 as a local privilege escalation in openSUSE Leap 15.1, specifically affecting gnump3d packaging. The vulnerability arises from a UNIX symbolic link (symlink) following issue in the packaging process, enabling a local attacker operating as the gnump3d ...

CVE-2019-9772

CVE-2019-9772 affects GNU LibreDWG up to version 0.7 (patches referenced in LibreDWG 0.9.x series). The vulnerability is a NULL pointer dereference in the function dwg_dxf_LEADER in dwg.spec, as described in the CVE entry. Publicly discussed openSUSE/SUSE advisories (openSUSE-SU-2020:0068-1/0068-...