CVE-2016-4556

Squid 3.x before 3.5.18 and 4.x before 4.0.10 is vulnerable to a double-free in Esi.cc (related to processing Edge Side Includes) which can allow remote servers to trigger a Denial of Service (crash). The issue is confirmed across multiple advisories (e.g., Debian DSA-3625-1, CentOS/RH advisories...

CVE-2016-4581

CVE-2016-4581 affects the Linux kernel: a flaw in mounting propagation where slave mounts can leave the propagation tree in an inconsistent state. Local users could trigger a denial of service via crafted mount calls, causing a NULL pointer dereference and kernel oops. The issue is fixed in kerne...

CVE-2014-3673

The vulnerability CVE-2014-3673 affects the SCTP implementation in the Linux kernel up to version 3.17.2. A malformed ASCONF chunk can be sent by a remote attacker to trigger a denial of service (system crash). Affected components are net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c. Remediat...

CVE-2016-1952

CVE-2016-1952 involves memory-safety vulnerabilities in the Firefox browser engine. Affected software: Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7. Root cause: memory-corruption/memory-safety bugs in the browser engine that can be triggered by parsing/processing malformed or craf...

CVE-2016-1954

CVE-2016-1954 affects Mozilla Firefox and Firefox ESR. The flaw in nsCSPContext::SendReports allows a CSP violation report to specify a local file URL, potentially causing a denial of service (data overwrite) or privilege escalation. Affected versions: Firefox before 45.0 and Firefox ESR 38.x bef...

CVE-2016-2143

CVE-2016-2143 affects the Linux kernel, specifically the fork implementation on s390 platforms. The issue occurs when four page-table levels are used, which can allow a local unprivileged user to crash the system (DoS) or potentially cause other unspecified impacts via crafted applications, relat...

CVE-2016-3500

CVE-2016-3500 is tied to a denial-of-service issue in the JAXP component of OpenJDK/OpenJDK-based Java runtimes, where crafted XML files could cause excessive CPU/memory consumption. The CVE affects multiple OpenJDK variants and is reflected in security advisories for Linux distributions (e.g., A...

CVE-2016-0641

CVE-2016-0641 affects multiple MySQL/MariaDB lineages with a MyISAM-related vulnerability that can impact confidentiality and availability when untrusted local users access certain database components. Affected: Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, 5.7.10 and earlier; MariaDB befo...

CVE-2016-3508

CVE-2016-3508 is confirmed in connected records as a vulnerability in the OpenJDK JAXP component. The issue involves denial of service exposure when parsing XML, caused by the JAXP path not enforcing a limit on entity replacements during XML processing. Some sources also describe related, adjacen...

CVE-2016-3550

CVE-2016-3550 is a OpenJDK/Hotspot related vulnerability that allows remote attackers to affect confidentiality by bypassing sandbox restrictions via Bytecode reading vulnerabilities in OpenJDK’s Hotspot component. The affected products and versions cited include Oracle Java SE 6u115, 7u101, 8u92...

CVE-2016-2800

The Graphite 2 font rendering library is affected by CVE-2016-2800 and CVE-2016-2792. In Graphite 2, the vulnerability resides in graphite2::Slot::getAttr (Slot.cpp) and can be triggered when processing crafted Graphite fonts, as used by Mozilla Firefox prior to 45.0 and Firefox ESR 38.x prior to...

CVE-2015-4861

CVE-2015-4861 is an unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, that allows remote authenticated users to affect availability via unknown InnoDB-related vectors. The connected advisories confirm this CVE among multiple MySQL-related flaws and indic...

CVE-2016-1935

CVE-2016-1935 : Buffer overflow in Mozilla Firefox’s BufferSubData function allows remote code execution via crafted WebGL content. Affected products: Firefox before 44.0 and Firefox ESR 38.x before 38.6. Root cause: buffer overflow while rendering WebGL content. Impact: remote code execution wit...

CVE-2016-0546

CVE-2016-0546 is an unspecified vulnerability in Oracle MySQL Server components (Client) that, per vendor notes, could allow a local attacker to execute arbitrary code with elevated privileges due to a long name/buffer overflow in the mysqlshow utility. Affected: MySQL 5.5.46 and earlier, 5.6.27 ...

CVE-2016-2837

In IBM Storwize V7000 Unified, CVE-2016-2837 affects Mozilla Firefox components embedded via ClearKey CDM in the EME API. A heap-based buffer overflow during video playback could allow remote code execution. Affected versions: 1.5.0.0–1.5.2.4. Remediation: upgrade to 1.5.2.5 or later. If no furth...

CVE-2015-4816

CVE-2015-4816 affects Oracle MySQL Server 5.5.44 and earlier, where an unspecified InnoDB-related vulnerability allows remote authenticated users to affect availability via unknown vectors. The MiracleLinux advisories/NESSUS plugins reference CVE-2015-4816 among a broader set of MySQL/MariaDB iss...

CVE-2015-8391

PCRE library (libpcre) prior to 8.38 is affected by CVE-2015-8391 due to mishandling of certain [: nesting in pcre_compile.c, enabling remote attackers to trigger a denial of service (CPU consumption) via crafted regular expressions (as used by JavaScript RegExp objects in Konqueror). Affected pr...

CVE-2016-1957

CVE-2016-1957 affects Mozilla Firefox prior to 45.0 and Firefox ESR 38.x prior to 38.7, where a memory leak in libstagefright during MPEG-4 processing can be triggered by an array deletion, potentially enabling a denial-of-service via memory consumption. Mitigations in the referenced advisories i...

CVE-2016-1966

CVE-2016-1966 affects Mozilla Firefox and Firefox ESR. The issue is a dangling pointer dereference in NPAPI handling (nsNPObjWrapper::GetNewOrUsed) in dom/plugins/base/nsJSNPRuntime.cpp, allowing a crafted NPAPI plugin to cause a remote crash or arbitrary code execution. Exploitation in the wild ...

CVE-2015-8629

The vulnerability CVE-2015-8629 affects MIT Kerberos 5 (krb5) kadmind: the xdr_nullstring function in kadm_rpc_xdr.c does not reliably verify presence of terminating '\0' in strings, allowing a remote authenticated user to trigger an out-of-bounds read that can disclose sensitive information or c...

CVE-2014-1737

CVE-2014-1737 affects the Linux kernel (through 3.14.3) and its floppy driver (drivers/block/floppy.c). The flaw is in raw_cmd_copyin not handling error conditions during processing of an FDRAWCMD ioctl, enabling local users with write access to /dev/fd to trigger kfree and potentially gain privi...

CVE-2015-8631

CVE-2015-8631 affects MIT Kerberos 5 (krb5) kadmind; a memory leak caused by the code path in kadmin/server/server_stubs.c can be triggered by a request with a NULL principal name. The issue, described as a denial of service via memory exhaustion, occurs in krb5 builds prior to 1.13.4 and in 1.14...

CVE-2016-5259

CVE-2016-5259 : A use-after-free in the Mozilla Firefox function CanonicalizeXPCOMParticipant allows remote code execution via a script that closes its own Service Worker inside a nested sync event loop. Affected: Firefox before 48.0 and Firefox ESR 45.x before 45.3. Impact per sources: arbitrary...

CVE-2016-1973

CVE-2016-1973 is a race condition in GetStaticInstance within Firefox’s WebRTC implementation that can cause a use-after-free in WebRTC components. The issue was found in Mozilla Firefox prior to version 45.0 (Firefox ESR references show similar concerns in the 38.x ESR line). Reported root cause...

CVE-2016-1974

The CVE-2016-1974 issue affects Mozilla Firefox and Firefox ESR, where nsScannerString::AppendUnicodeTo can fail to verify memory allocation success, enabling a remote attacker to crash the browser or potentially execute arbitrary code via crafted Unicode data in HTML/XML/SVG. Affected versions a...

CVE-2016-2792

CVE-2016-2792 affects Graphite2 (graphite2) in Graphite font rendering used by Firefox

CVE-2014-3144

CVE-2014-3144 affects the Linux kernel up to 3.14.3. The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST implementations in the sk_run_filter function (net/core/filter.c) do not properly verify a length value, enabling a local attacker to trigger a denial of service via crafted BPF instruction...

CVE-2014-3687

The provided materials confirm CVE-2014-3687 affects the Linux kernel SCTP implementation (net/sctp/associola.c) up to version 3.17.2. The vulnerability allows remote attackers to cause a denial of service (panic) by sending duplicate ASCONF chunks, triggering an incorrect uncork within the side-...

CVE-2015-0239

CVE-2015-0239 affects the Linux kernel KVM emulation path (arch/x86/kvm/emulate.c). If a guest OS does not initialize SYSENTER MSRs, em_sysenter can trigger using a 16‑bit code segment to emulate SYSENTER, allowing a guest OS user to gain guest privileges or cause a guest crash. The vulnerability...

CVE-2015-4858

Technical details for CVE-2015-4858 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2016-5262

Mozilla Firefox prior to 48.0 and Firefox ESR 45.x prior to 45.3 are affected by an XSS flaw where event-handler attributes of a MARQUEE element inside a sandboxed iframe without sandbox="allow-scripts" are processed, enabling remote XSS via a crafted page. Affected product details and patch info...

CVE-2016-5263

CVE-2016-5263 affects Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3. The vulnerability arises from a type confusion in nsDisplayList::HitTest, which mishandles rendering display transformations and could allow a remote attacker to execute arbitrary code via a crafted website. Remed...

CVE-2016-6198

CVE-2016-6198 affects the Linux kernel (pre-4.5.5) in its OverlayFS path. The bug occurs when a file under OverlayFS is renamed to a self-hardlink, causing post-rename operations to run and potentially crash the kernel. Local users can trigger a denial of service (system crash) via a rename sysca...

CVE-2016-0644

CVE-2016-0644 is an unspecified local-vulnerability in Oracle MySQL/MariaDB affecting DDL paths that can impact availability. Public HOTFIXes exist: MariaDB 10.0.25 (per Debian DSA-3595-1) and MariaDB 5.5.50 (per CentOS CentOS-announce 2016:1602). IBM/PowerKVM advisories also reference this CVE w...

CVE-2016-1930

CVE-2016-1930 affects Mozilla Firefox browser engine (and ESR 38.x) prior to 44.0/38.6, with memory-safety flaws that could lead to denial of service or remote code execution via unspecified vectors. The issue is documented across multiple advisories; affected products include Firefox, Iceweasel/...

CVE-2016-1961

CVE-2016-1961 is a use-after-free in Mozilla Firefox’s HTMLDocument::SetBody (dom/html/nsHTMLDocument.cpp) that could crash the browser and allow remote code execution. Affected products are Firefox before 45.0 and Firefox ESR 38.x before 38.7. The vulnerability stems from mishandling of the root...

CVE-2016-4805

CVE-2016-4805 describes a use-after-free in the Linux kernel’s drivers/net/ppp/ppp_generic.c before 4.5.2. The flaw allows local attackers to trigger memory corruption and potential DoS (system crash) by removing a network namespace, related to ppp_register_net_channel and ppp_unregister_channel....

CVE-2016-5386

Summary: CVE-2016-5386 is the httpoxy vulnerability in Go’s net/http CGI handling up to Go 1.6, where untrusted data in the HTTP_PROXY environment variable could redirect a CGI app’s outbound traffic to an attacker-controlled proxy via a crafted Proxy header. This is triggered by namespace confli...

CVE-2015-4802

Technical details about CVE-2015-4802 are not publicly provided in the supplied documents. Monitor for updates from vendor advisories and security databases to obtain explicit affected versions, impact, and remediation.

CVE-2015-4815

CVE-2015-4815 affects Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier, with remote authenticated access potentially impacting availability via DDL-related vectors. The F5 advisory notes multiple MySQL vulnerabilities across BIG-IP family, describing exposure when MySQL is provisione...

CVE-2015-4836

CVE-2015-4836 is an unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allowing remote authenticated users to affect availability via unknown vectors related to Server : SP. Affected products/versions are Oracle MySQL Server 5.5.x (<=5.5.45) and 5.6.x (

CVE-2016-1964

CVE-2016-1964 is a use-after-free in Mozilla Firefox’s AtomicBaseIncDec during XML transformation handling. Affects Firefox before 45.0 and Firefox ESR 38.x before 38.7; impact includes remote code execution or heap-based denial of service when processing certain XML transformations. The issue ca...

CVE-2016-4053

CVE-2016-4053 in Squid allowed public information disclosure of the server stack layout when processing ESI responses. The issue is documented across multiple advisories (Debian, Red Hat/CentOS, Fedora, Amazon ALAS) with fixes in various branches: Debians fixed squid3 3.1.20-2.2+deb7u5; Jessie/St...

CVE-2015-1779

CVE-2015-1779 affects QEMU with the VNC websocket frame decoder. The issue allows a remote attacker to cause a denial of service by sending oversized websocket payloads or HTTP headers, exhausting CPU and memory. Impact is observed when an attacker accesses a guest’s VNC console over the network....

CVE-2016-0505

CVE-2016-0505 is an unspecified vulnerability in Oracle MySQL Server and MariaDB that could allow a remote authenticated user to cause a denial of service via unknown vectors related to Options. Affected versions include MySQL 5.5.46 and earlier, 5.6.27 and earlier, 5.7.9 and MariaDB before 5.5.4...

CVE-2015-0253

CVE-2015-0253 affects the Apache HTTP Server 2.4.12. The vulnerability arises in the read_request_line function within server/protocol.c, where the protocol structure member is not initialized. This can enable a remote attacker to trigger a denial-of-service via a NULL pointer dereference and cra...

CVE-2015-0275

CVE-2015-0275 affects the Linux kernel ext4 subsystem: the ext4_zero_range function in fs/ext4/extents.c allows local users to trigger a denial of service via a crafted fallocate zero-range request. The linked MiracleLinux/Unity Linux Nessus entries reproduce this: the vulnerability is described ...

CVE-2016-0640

CVE-2016-0640 is an unspecified MySQL/MariaDB server vulnerability affecting DML operations with partial integrity/availability impact. Public notices in 2016 (Debian DSA-3595, CentOS/CentOS-announce, Red Hat advisories) show fixes across MariaDB/MySQL branches (e.g., MariaDB 10.0.x and MySQL 5.5...

CVE-2016-1962

CVE-2016-1962 is a use-after-free in Mozilla Firefox’s mozilla::DataChannelConnection::Close, enabling remote code execution via mishandled WebRTC data-channel connections. Affected: Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7. Consequence: potentially exploitable crash with arbi...

CVE-2016-2797

Graphite 2 before 1.3.6 is affected by CVE-2016-2797 via the TtfUtil::CmapSubtable12Lookup path. The vulnerability exists when Graphite is used by Firefox before 45.0 and Firefox ESR 38.x before 38.7, allowing a crafted Graphite smart font to cause a denial-of-service (buffer over-read) or simila...