Summary
Detail | |||
---|---|---|---|
Vendor | Oracle | First view | 2014-12-24 |
Product | Linux | Last view | 2016-10-16 |
Version | 7 | Type | Os |
Update | * | ||
Edition | * | ||
Language | * | ||
Sofware Edition | * | ||
Target Software | * | ||
Target Hardware | * | ||
Other | * | ||
CPE Product | cpe:2.3:o:oracle:linux |
Activity : Overall
Related : CVE
Date | Alert | Description | |
---|---|---|---|
7.5 | 2016-10-16 | CVE-2016-7039 | The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a related issue to CVE-2016-8666. |
7.5 | 2016-09-28 | CVE-2016-2776 | buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query. |
5.5 | 2016-09-21 | CVE-2016-7166 | libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip file. |
8.6 | 2016-09-21 | CVE-2016-6250 | Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow. |
6.5 | 2016-09-21 | CVE-2016-5844 | Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file. |
7.5 | 2016-09-21 | CVE-2016-5418 | The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file. |
7.5 | 2016-09-21 | CVE-2016-4809 | The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink. |
5.5 | 2016-09-20 | CVE-2015-8922 | The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted 7z file, related to the _7z_folder struct. |
7.5 | 2016-09-16 | CVE-2016-6302 | The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short. |
9.8 | 2016-09-16 | CVE-2016-2182 | The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors. |
7.5 | 2016-09-16 | CVE-2016-2181 | The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c. |
7.5 | 2016-09-16 | CVE-2016-2179 | The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c. |
6.5 | 2016-09-07 | CVE-2016-5404 | The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission. |
5.5 | 2016-08-04 | CVE-2016-5265 | Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory. |
8.8 | 2016-08-04 | CVE-2016-5264 | Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application. |
8.8 | 2016-08-04 | CVE-2016-5263 | The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformation, which allows remote attackers to execute arbitrary code via a crafted web site that leverages "type confusion." |
6.1 | 2016-08-04 | CVE-2016-5262 | Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox="allow-scripts" attribute value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site. |
8.8 | 2016-08-04 | CVE-2016-5259 | Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via a script that closes its own Service Worker within a nested sync event loop. |
8.8 | 2016-08-04 | CVE-2016-5258 | Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session. |
9.8 | 2016-08-04 | CVE-2016-5254 | Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) by leveraging keyboard access to use the Alt key during selection of top-level menu items. |
8.8 | 2016-08-04 | CVE-2016-5252 | Stack-based buffer underflow in the mozilla::gfx::BasePoint4d function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via crafted two-dimensional graphics data that is mishandled during clipping-region calculations. |
6.3 | 2016-08-04 | CVE-2016-2837 | Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass. |
5.5 | 2016-08-02 | CVE-2016-5403 | The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion. |
7.5 | 2016-07-31 | CVE-2016-2180 | The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command. |
3.7 | 2016-07-21 | CVE-2016-5444 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Connection. |
CWE : Common Weakness Enumeration
% | id | Name |
---|---|---|
34% (31) | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
15% (14) | CWE-20 | Improper Input Validation |
6% (6) | CWE-399 | Resource Management Errors |
6% (6) | CWE-284 | Access Control (Authorization) Issues |
5% (5) | CWE-416 | Use After Free |
5% (5) | CWE-19 | Data Handling |
3% (3) | CWE-254 | Security Features |
3% (3) | CWE-190 | Integer Overflow or Wraparound |
2% (2) | CWE-345 | Insufficient Verification of Data Authenticity |
2% (2) | CWE-264 | Permissions, Privileges, and Access Controls |
2% (2) | CWE-200 | Information Exposure |
2% (2) | CWE-189 | Numeric Errors |
2% (2) | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
2% (2) | CWE-17 | Code |
1% (1) | CWE-787 | Out-of-bounds Write |
1% (1) | CWE-704 | Incorrect Type Conversion or Cast |
1% (1) | CWE-476 | NULL Pointer Dereference |
1% (1) | CWE-400 | Uncontrolled Resource Consumption ('Resource Exhaustion') |
1% (1) | CWE-185 | Incorrect Regular Expression |
1% (1) | CWE-125 | Out-of-bounds Read |
Information Assurance Vulnerability Management (IAVM)
id | Description |
---|---|
2015-A-0199 | Multiple Vulnerabilities in Apple Mac OS X Severity: Category I - VMSKEY: V0061337 |
2015-A-0174 | Multiple Vulnerabilities in Apache HTTP Server Severity: Category I - VMSKEY: V0061135 |
Snort® IPS/IDS
Date | Description |
---|---|
2018-06-21 | Mozilla Firefox nsHTMLDocument SetBody use-after-free attempt RuleID : 46781 - Type : BROWSER-FIREFOX - Revision : 2 |
2018-06-21 | Mozilla Firefox nsHTMLDocument SetBody use-after-free attempt RuleID : 46767 - Type : BROWSER-FIREFOX - Revision : 4 |
2018-06-21 | Mozilla Firefox nsHTMLDocument SetBody use-after-free attempt RuleID : 46766 - Type : BROWSER-FIREFOX - Revision : 2 |
2018-06-21 | Mozilla Firefox nsHTMLDocument SetBody use-after-free attempt RuleID : 46765 - Type : BROWSER-FIREFOX - Revision : 2 |
2018-03-01 | Squid host header cache poisoning attempt RuleID : 45569 - Type : SERVER-WEBAPP - Revision : 1 |
2017-10-24 | PHP form-based file upload DoS attempt RuleID : 44390 - Type : SERVER-WEBAPP - Revision : 2 |
2017-07-25 | Squid ESI processing buffer overflow attempt RuleID : 43268 - Type : SERVER-WEBAPP - Revision : 2 |
2017-01-12 | Nitro Pro PDF Reader out of bounds write attempt RuleID : 41197 - Type : FILE-PDF - Revision : 5 |
2017-01-12 | Nitro Pro PDF Reader out of bounds write attempt RuleID : 41196 - Type : FILE-PDF - Revision : 5 |
2016-11-08 | Mozilla Firefox CSP report-uri arbitrary file write attempt RuleID : 40363 - Type : BROWSER-FIREFOX - Revision : 2 |
2016-11-08 | ISC BIND isc__buffer_add assertion failure denial of service attempt RuleID : 40344 - Type : PROTOCOL-DNS - Revision : 2 |
2016-07-28 | HttpOxy CGI application vulnerability potential man-in-the-middle attempt RuleID : 39737-community - Type : SERVER-WEBAPP - Revision : 2 |
2016-08-31 | HttpOxy CGI application vulnerability potential man-in-the-middle attempt RuleID : 39737 - Type : SERVER-WEBAPP - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39097 - Type : FILE-IMAGE - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39096 - Type : FILE-IMAGE - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39095 - Type : FILE-IMAGE - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39094 - Type : FILE-IMAGE - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39093 - Type : FILE-IMAGE - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39092 - Type : FILE-IMAGE - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39091 - Type : FILE-IMAGE - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39090 - Type : FILE-IMAGE - Revision : 2 |
2016-03-14 | OpenSSH insecure roaming key exchange attempt RuleID : 37371 - Type : SERVER-OTHER - Revision : 3 |
2015-08-11 | PHP core compressed file temp_len buffer overflow attempt RuleID : 35093 - Type : SERVER-OTHER - Revision : 3 |
2015-08-11 | PHP core compressed file temp_len buffer overflow attempt RuleID : 35092 - Type : SERVER-OTHER - Revision : 2 |
Nessus® Vulnerability Scanner
id | Description |
---|---|
2018-08-17 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2017-0010.nasl - Type: ACT_GATHER_INFO |
2018-08-17 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2017-0021.nasl - Type: ACT_GATHER_INFO |
2018-08-15 | Name: The remote device is missing a vendor-supplied security patch. File: f5_bigip_SOL53729441.nasl - Type: ACT_GATHER_INFO |
2018-04-10 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201804-06.nasl - Type: ACT_GATHER_INFO |
2018-02-28 | Name: The version of Arista Networks EOS running on the remote device is affected b... File: arista_eos_sa0024.nasl - Type: ACT_GATHER_INFO |
2018-02-28 | Name: The version of Arista Networks EOS running on the remote device is affected b... File: arista_eos_sa0024_4_17.nasl - Type: ACT_GATHER_INFO |
2017-11-03 | Name: The remote host is missing a macOS or Mac OS X security update that fixes mul... File: macosx_SecUpd2017-004.nasl - Type: ACT_GATHER_INFO |
2017-10-03 | Name: The remote host is missing a macOS update that fixes multiple security vulner... File: macos_10_13.nasl - Type: ACT_GATHER_INFO |
2017-08-03 | Name: The remote AIX host has a version of bind installed that is affected by a den... File: aix_bind_advisory10.nasl - Type: ACT_GATHER_INFO |
2017-08-03 | Name: The remote AIX host has a version of bind installed that is affected by multi... File: aix_bind_advisory13.nasl - Type: ACT_GATHER_INFO |
2017-07-20 | Name: A web application installed on the remote host is affected by multiple vulner... File: oracle_e-business_cpu_jul_2017.nasl - Type: ACT_GATHER_INFO |
2017-07-20 | Name: An enterprise management application installed on the remote host is affected... File: oracle_enterprise_manager_jul_2017_cpu.nasl - Type: ACT_GATHER_INFO |
2017-07-13 | Name: The remote Virtuozzo host is missing a security update. File: Virtuozzo_VZLSA-2017-0036.nasl - Type: ACT_GATHER_INFO |
2017-06-30 | Name: The remote Red Hat host is missing one or more security updates. File: redhat-RHSA-2017-1658.nasl - Type: ACT_GATHER_INFO |
2017-06-30 | Name: The remote Ubuntu host is missing one or more security-related patches. File: ubuntu_USN-3338-2.nasl - Type: ACT_GATHER_INFO |
2017-06-26 | Name: The Tenable SecurityCenter application on the remote host contains a web serv... File: securitycenter_apache_2_4_25.nasl - Type: ACT_GATHER_INFO |
2017-06-26 | Name: The Tenable SecurityCenter application on the remote host contains an OpenSSL... File: securitycenter_openssl_1_0_1u.nasl - Type: ACT_GATHER_INFO |
2017-06-22 | Name: The remote Ubuntu host is missing one or more security-related patches. File: ubuntu_USN-3338-1.nasl - Type: ACT_GATHER_INFO |
2017-06-09 | Name: The remote device is missing a vendor-supplied security patch. File: f5_bigip_SOL53084033.nasl - Type: ACT_GATHER_INFO |
2017-05-10 | Name: The remote Red Hat host is missing one or more security updates. File: redhat-RHSA-2017-1216.nasl - Type: ACT_GATHER_INFO |
2017-05-02 | Name: The remote openSUSE host is missing a security update. File: openSUSE-2017-532.nasl - Type: ACT_GATHER_INFO |
2017-05-02 | Name: An application installed on the remote host is affected by multiple vulnerabi... File: oracle_secure_global_desktop_apr_2017_cpu.nasl - Type: ACT_GATHER_INFO |
2017-05-01 | Name: The remote EulerOS host is missing multiple security updates. File: EulerOS_SA-2016-1002.nasl - Type: ACT_GATHER_INFO |
2017-05-01 | Name: The remote EulerOS host is missing multiple security updates. File: EulerOS_SA-2016-1011.nasl - Type: ACT_GATHER_INFO |
2017-05-01 | Name: The remote EulerOS host is missing multiple security updates. File: EulerOS_SA-2016-1015.nasl - Type: ACT_GATHER_INFO |