This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Oracle First view 2011-10-18
Product Solaris Last view 2018-07-18
Version 10.0 Type Os
Update *  
Edition *  
Language *  
Sofware Edition *  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:o:oracle:solaris

Activity : Overall

Related : CVE

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
  Date Alert Description
4.4 2018-07-18 CVE-2018-2903

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11.3. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Solaris accessible data. CVSS 3.0 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).

3.7 2018-07-18 CVE-2018-2901

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via DHCP to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

7.8 2018-07-18 CVE-2018-2892

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Availability Suite Service). Supported versions that are affected are 10 and 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

7.5 2018-04-18 CVE-2018-2718

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: RPC). Supported versions that are affected are 10 and 11.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via NFS to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

4.2 2018-04-18 CVE-2018-2563

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: LDAP Library). Supported versions that are affected are 10 and 11.3. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).

6.6 2018-01-17 CVE-2018-2717

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: SPARC Platform). Supported versions that are affected are 10 and 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Solaris accessible data as well as unauthorized access to critical data or complete access to all Solaris accessible data. CVSS 3.0 Base Score 6.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).

7.5 2018-01-17 CVE-2018-2710

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 10. Easily exploitable vulnerability allows unauthenticated attacker with network access via ICMP to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

8.8 2016-12-13 CVE-2016-6491

Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote attackers to cause a denial of service (out-of-bounds read, memory leak, and crash) via a crafted image.

7.5 2016-12-13 CVE-2016-5842

MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.

9.8 2016-12-13 CVE-2016-5841

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code via vectors involving the offset variable.

7.5 2016-09-28 CVE-2016-2776

buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.

6.4 2015-02-12 CVE-2014-9512

rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.

7.5 2015-02-08 CVE-2014-9674

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.

5.8 2015-02-08 CVE-2014-9672

Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file.

4.3 2015-02-08 CVE-2014-9671

Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented.

4.3 2015-02-08 CVE-2014-9670

Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row.

6.8 2015-02-08 CVE-2014-9669

Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table.

6.8 2015-02-08 CVE-2014-9666

The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap.

6.8 2015-02-08 CVE-2014-9664

FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c.

7.5 2015-02-08 CVE-2014-9663

The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.

7.5 2015-02-08 CVE-2014-9660

The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.

7.5 2015-02-08 CVE-2014-9659

cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2240.

7.5 2015-02-08 CVE-2014-9658

The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.

7.5 2015-02-08 CVE-2014-9657

The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.

5.8 2015-01-21 CVE-2015-1038

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.

CWE : Common Weakness Enumeration

%idName
31% (5) CWE-125 Out-of-bounds Read
25% (4) CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
12% (2) CWE-189 Numeric Errors
12% (2) CWE-59 Improper Link Resolution Before File Access ('Link Following')
6% (1) CWE-476 NULL Pointer Dereference
6% (1) CWE-190 Integer Overflow or Wraparound
6% (1) CWE-20 Improper Input Validation

Open Source Vulnerability Database (OSVDB)

id Description
76466 Oracle Solaris ZFS Component Unspecified Local DoS (2011-2313)

Snort® IPS/IDS

Date Description
2016-11-08 ISC BIND isc__buffer_add assertion failure denial of service attempt
RuleID : 40344 - Type : PROTOCOL-DNS - Revision : 2

Nessus® Vulnerability Scanner

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2018-08-17 Name: The remote PhotonOS host is missing multiple security updates.
File: PhotonOS_PHSA-2017-0021.nasl - Type: ACT_GATHER_INFO
2017-09-20 Name: The remote Fedora host is missing one or more security updates.
File: fedora_2017-3a568adb31.nasl - Type: ACT_GATHER_INFO
2017-09-19 Name: The remote Fedora host is missing one or more security updates.
File: fedora_2017-8f27031c8f.nasl - Type: ACT_GATHER_INFO
2017-08-03 Name: The remote AIX host has a version of bind installed that is affected by multi...
File: aix_bind_advisory13.nasl - Type: ACT_GATHER_INFO
2017-04-21 Name: The remote OracleVM host is missing one or more security updates.
File: oraclevm_OVMSA-2017-0066.nasl - Type: ACT_GATHER_INFO
2017-02-27 Name: The remote EulerOS host is missing multiple security updates.
File: EulerOS_SA-2016-1052.nasl - Type: ACT_GATHER_INFO
2016-12-20 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL18829561.nasl - Type: ACT_GATHER_INFO
2016-12-01 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201611-21.nasl - Type: ACT_GATHER_INFO
2016-11-22 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-3131-1.nasl - Type: ACT_GATHER_INFO
2016-11-18 Name: The remote AIX host is missing a security patch.
File: aix_IV89831.nasl - Type: ACT_GATHER_INFO
2016-11-18 Name: The remote AIX host is missing a security patch.
File: aix_IV89828.nasl - Type: ACT_GATHER_INFO
2016-11-18 Name: The remote AIX host is missing a security patch.
File: aix_IV89829.nasl - Type: ACT_GATHER_INFO
2016-11-18 Name: The remote AIX host is missing a security patch.
File: aix_IV89830.nasl - Type: ACT_GATHER_INFO
2016-11-18 Name: The remote AIX host is missing a security patch.
File: aix_IV90056.nasl - Type: ACT_GATHER_INFO
2016-11-15 Name: The remote Fedora host is missing a security update.
File: fedora_2016-f6e4e66202.nasl - Type: ACT_GATHER_INFO
2016-11-15 Name: The remote Fedora host is missing a security update.
File: fedora_2016-76bd94ca9e.nasl - Type: ACT_GATHER_INFO
2016-10-26 Name: The remote Red Hat host is missing one or more security updates.
File: redhat-RHSA-2016-2099.nasl - Type: ACT_GATHER_INFO
2016-10-25 Name: The remote Fedora host is missing a security update.
File: fedora_2016-cbef6c8619.nasl - Type: ACT_GATHER_INFO
2016-10-25 Name: The remote Fedora host is missing a security update.
File: fedora_2016-3af8b344f1.nasl - Type: ACT_GATHER_INFO
2016-10-12 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201610-07.nasl - Type: ACT_GATHER_INFO
2016-10-06 Name: The remote Fedora host is missing a security update.
File: fedora_2016-cca77daf70.nasl - Type: ACT_GATHER_INFO
2016-10-06 Name: The remote Debian host is missing a security update.
File: debian_DLA-645.nasl - Type: ACT_GATHER_INFO
2016-10-06 Name: The remote Fedora host is missing a security update.
File: fedora_2016-2d9825f7c1.nasl - Type: ACT_GATHER_INFO
2016-10-05 Name: The remote name server is affected by a denial of service vulnerability.
File: bind9_9104_p3.nasl - Type: ACT_GATHER_INFO
2016-09-29 Name: The remote Scientific Linux host is missing one or more security updates.
File: sl_20160928_bind_on_SL5_x.nasl - Type: ACT_GATHER_INFO