cve.bz

opensuse leap vulnerabilities, newest first, page 30

Filter
  1. 6.8CVE-2017-13077EPSS 2.4%

    Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

  2. 9.8CVE-2017-14491EPSS 86%

    Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

  3. 9.8CVE-2017-14493EPSS 85%

    Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.

  4. 7.5CVE-2015-3138EPSS 2.3%

    print-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service (segmentation fault and process crash).

  5. 7.8CVE-2016-5759EPSS 0.4%

    The mkdumprd script called "dracut" in the current working directory "." allows local users to trick the administrator into executing code as root.

  6. 7.5CVE-2017-6594EPSS 1.8%

    The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging failure to add the previous hop realm to the transit path of issued tickets.

  7. 7.5CVE-2014-3462EPSS 3.1%

    The ".encfs6.xml" configuration file in encfs before 1.7.5 allows remote attackers to access sensitive data by setting "blockMACBytes" to 0 and adding 8 to "blockMACRandBytes".

  8. 5.5CVE-2015-5203EPSS 1.9%

    Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.

  9. 5.5CVE-2015-5221EPSS 2.2%

    Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.

  10. 7.5CVE-2015-5300EPSS 9.1%

    The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the…

  11. 7.5CVE-2015-5219EPSS 6.1%

    The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.

  12. 7.5CVE-2017-9814EPSS 3.4%

    cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) because of mishandling of an unexpected malloc(0) call.

  13. 5.9CVE-2017-8932EPSS 2.2%

    A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted …

  14. 7.8CVE-2017-1000366EPSS 2.7%

    glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have …

  15. 6.5CVE-2017-8871EPSS 13%

    The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file.

  16. 6.5CVE-2017-8834EPSS 3.8%

    The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.

  17. 9.8CVE-2016-9961EPSS 4.4%

    game-music-emu before 0.6.1 mishandles unspecified integer values.

  18. 5.5CVE-2016-9960EPSS 0.5%

    game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash).

  19. 8.8CVE-2017-8386EPSS 12%

    git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users…

  20. 9.8CVE-2016-9843EPSS 5.8%

    The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.

  21. 8.8CVE-2016-9842EPSS 5.2%

    The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

  22. 9.8CVE-2016-9841EPSS 7.5%

    inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

  23. 8.8CVE-2016-9840EPSS 4.9%

    inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

  24. 9.8CVE-2016-5178EPSS 1.9%

    Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.143 allow remote attackers to cause a denial of service or possibly have other impact via unknown vectors.

  25. 8.8CVE-2016-5177EPSS 1.3%

    Use-after-free vulnerability in V8 in Google Chrome before 53.0.2785.143 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via unknown vectors.

  26. 7.8CVE-2016-2347EPSS 3.2%

    Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a crafted archive.

  27. 7.7CVE-2015-8567EPSS 5.6%

    Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).

  28. 6.1CVE-2016-4068EPSS 2.5%

    Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.

  29. 6.1CVE-2015-8864EPSS 2.7%

    Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.

  30. 7.8CVE-2016-9959EPSS 2.3%

    game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.

  31. 7.8CVE-2016-9958EPSS 2.3%

    game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations.

  32. 7.8CVE-2016-9957EPSS 1.9%

    Stack-based buffer overflow in game-music-emu before 0.6.1.

  33. 9.8CVE-2017-6542EPSS 22%

    The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing …

  34. 6.1CVE-2015-8010EPSS 1.5%

    Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.

  35. 9.8CVE-2017-5337EPSS 6.2%

    Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.

  36. 9.8CVE-2017-5336EPSS 7.1%

    Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.

  37. 7.5CVE-2017-5335EPSS 8.0%

    The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.

  38. 9.8CVE-2017-5334EPSS 33%

    Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a…

  39. 7.5CVE-2016-7797EPSS 3.2%

    Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.

  40. 7.5CVE-2016-9399EPSS 3.8%

    The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.

  41. 7.5CVE-2016-9398EPSS 6.0%

    The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.

  42. 7.8CVE-2016-10051EPSS 1.9%

    Use-after-free vulnerability in the ReadPWPImage function in coders/pwp.c in ImageMagick 6.9.5-5 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.

  43. 7.8CVE-2016-10050EPSS 2.1%

    Heap-based buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.9.4-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.

  44. 5.9CVE-2016-6225EPSS 1.1%

    xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector (IV) for encryption, which makes it easier for context-dependent attackers to obtain sensitive information from encrypted bac…

  45. 7.5CVE-2017-6318EPSS 3.0%

    saned in sane-backends 1.0.25 allows remote attackers to obtain sensitive memory information via a crafted SANE_NET_CONTROL_OPTION packet.

  46. 2.7CVE-2017-5930EPSS 15%

    The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.

  47. 7.5CVE-2014-9848EPSS 3.7%

    Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption).

  48. 9.8CVE-2014-9846EPSS 4.9%

    Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact.

  49. 5.5CVE-2014-9845EPSS 1.9%

    The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib file.

  50. 7.5CVE-2014-9854EPSS 3.7%

    coders/tiff.c in ImageMagick allows remote attackers to cause a denial of service (application crash) via vectors related to the "identification of image."