Summary
Detail | |||
---|---|---|---|
Vendor | Oracle | First view | 2011-10-18 |
Product | Linux | Last view | 2018-10-09 |
Version | 4 | Type | |
Update | |||
Edition | |||
Language | |||
Sofware Edition | |||
Target Software | |||
Target Hardware | |||
Other |
Activity : Overall
COMMON PLATFORM ENUMERATION: Repartition per Version
Related : CVE
Date | Alert | Description | |
---|---|---|---|
7.5 | 2018-10-09 | CVE-2018-17962 | Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used. |
5.9 | 2017-08-07 | CVE-2015-7852 | ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets. |
6.5 | 2017-08-07 | CVE-2015-7702 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750. |
7.5 | 2017-08-07 | CVE-2015-7701 | Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption). |
7.5 | 2017-08-07 | CVE-2015-7692 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750. |
7.5 | 2017-08-07 | CVE-2015-7691 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750. |
7.5 | 2017-07-24 | CVE-2015-7703 | The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command. |
7.5 | 2016-10-16 | CVE-2016-7039 | The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a related issue to CVE-2016-8666. |
7.5 | 2016-09-28 | CVE-2016-2776 | buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query. |
5.5 | 2016-09-21 | CVE-2016-7166 | libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip file. |
8.6 | 2016-09-21 | CVE-2016-6250 | Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow. |
6.5 | 2016-09-21 | CVE-2016-5844 | Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file. |
7.5 | 2016-09-21 | CVE-2016-5418 | The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file. |
7.5 | 2016-09-21 | CVE-2016-4809 | The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink. |
5.5 | 2016-09-20 | CVE-2015-8922 | The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted 7z file, related to the _7z_folder struct. |
7.5 | 2016-09-16 | CVE-2016-6302 | The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short. |
9.8 | 2016-09-16 | CVE-2016-2182 | The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors. |
7.5 | 2016-09-16 | CVE-2016-2181 | The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c. |
7.5 | 2016-09-16 | CVE-2016-2179 | The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c. |
6.5 | 2016-09-07 | CVE-2016-5404 | The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission. |
9.8 | 2016-08-10 | CVE-2016-5408 | Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-4051. |
5.5 | 2016-08-06 | CVE-2016-6198 | The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service (system crash) via a rename system call, related to fs/namei.c and fs/open.c. |
5.5 | 2016-08-06 | CVE-2016-6197 | fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not properly verify the upper dentry before proceeding with unlink and rename system-call processing, which allows local users to cause a denial of service (system crash) via a rename system call that specifies a self-hardlink. |
5.5 | 2016-08-04 | CVE-2016-5265 | Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory. |
8.8 | 2016-08-04 | CVE-2016-5264 | Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application. |
CWE : Common Weakness Enumeration
% | id | Name |
---|---|---|
27% (36) | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
17% (23) | CWE-20 | Improper Input Validation |
5% (7) | CWE-416 | Use After Free |
5% (7) | CWE-284 | Access Control (Authorization) Issues |
4% (6) | CWE-399 | Resource Management Errors |
3% (5) | CWE-200 | Information Exposure |
3% (5) | CWE-190 | Integer Overflow or Wraparound |
3% (5) | CWE-19 | Data Handling |
3% (4) | CWE-400 | Uncontrolled Resource Consumption ('Resource Exhaustion') |
2% (3) | CWE-787 | Out-of-bounds Write |
2% (3) | CWE-269 | Improper Privilege Management |
2% (3) | CWE-254 | Security Features |
2% (3) | CWE-17 | Code |
1% (2) | CWE-476 | NULL Pointer Dereference |
1% (2) | CWE-362 | Race Condition |
1% (2) | CWE-345 | Insufficient Verification of Data Authenticity |
1% (2) | CWE-264 | Permissions, Privileges, and Access Controls |
1% (2) | CWE-189 | Numeric Errors |
1% (2) | CWE-125 | Out-of-bounds Read |
1% (2) | CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflo... |
1% (2) | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
0% (1) | CWE-772 | Missing Release of Resource after Effective Lifetime |
0% (1) | CWE-754 | Improper Check for Unusual or Exceptional Conditions |
0% (1) | CWE-704 | Incorrect Type Conversion or Cast |
0% (1) | CWE-185 | Incorrect Regular Expression |
Oval Markup Language : Definitions
OvalID | Name |
---|---|
oval:org.mitre.oval:def:24872 | USN-2219-1 -- linux vulnerabilities |
oval:org.mitre.oval:def:24778 | USN-2220-1 -- linux-ec2 vulnerabilities |
oval:org.mitre.oval:def:27184 | ELSA-2014-0981 -- kernel security, bug fix, and enhancement update (important) |
oval:org.mitre.oval:def:26359 | ELSA-2014-3052 -- unbreakable enterprise kernel security update (important) |
oval:org.mitre.oval:def:24863 | USN-2196-1 -- linux vulnerability |
oval:org.mitre.oval:def:24838 | USN-2198-1 -- linux vulnerability |
oval:org.mitre.oval:def:24818 | USN-2197-1 -- linux-ec2 vulnerability |
oval:org.mitre.oval:def:24747 | USN-2204-1 -- linux vulnerability |
oval:org.mitre.oval:def:24706 | USN-2201-1 -- linux-lts-saucy vulnerability |
oval:org.mitre.oval:def:24673 | USN-2199-1 -- linux-lts-quantal vulnerability |
oval:org.mitre.oval:def:24668 | USN-2202-1 -- linux vulnerability |
oval:org.mitre.oval:def:24543 | USN-2203-1 -- linux vulnerability |
oval:org.mitre.oval:def:24445 | USN-2200-1 -- linux-lts-raring vulnerability |
oval:org.mitre.oval:def:25258 | RHSA-2014:0678: kernel security update (Important) |
oval:org.mitre.oval:def:25233 | SUSE-SU-2014:0667-1 -- Security update for Linux Kernel |
oval:org.mitre.oval:def:27162 | ELSA-2014-0678 -- kernel security update (important) |
oval:org.mitre.oval:def:24487 | DSA-2928-1 linux-2.6 - security update |
oval:org.mitre.oval:def:24204 | RHSA-2014:0740: kernel security and bug fix update (Important) |
oval:org.mitre.oval:def:24916 | ELSA-2014:0740: kernel security and bug fix update (Important) |
oval:org.mitre.oval:def:25440 | SUSE-SU-2014:0773-1 -- Security update for Linux Kernel |
oval:org.mitre.oval:def:25438 | SUSE-SU-2014:0772-1 -- Security update for Linux Kernel |
oval:org.mitre.oval:def:26156 | SUSE-SU-2014:0832-1 -- Security update for Linux Kernel |
oval:org.mitre.oval:def:27352 | ELSA-2014-3041 -- unbreakable enterprise kernel security update (important) |
oval:org.mitre.oval:def:27323 | ELSA-2014-0740-1 -- kernel security and bug fix update (important) |
oval:org.mitre.oval:def:27221 | DEPRECATED: ELSA-2014-0740 -- kernel security and bug fix update (important) |
Open Source Vulnerability Database (OSVDB)
id | Description |
---|---|
76808 | Oracle Linux Validated Component Unspecified Remote Issue |
ExploitDB Exploits
id | Description |
---|---|
33516 | Linux kernel 3.14-rc1 <= 3.15-rc4 - Raw Mode PTY Local Echo Race Condition... |
Information Assurance Vulnerability Management (IAVM)
id | Description |
---|---|
2015-A-0199 | Multiple Vulnerabilities in Apple Mac OS X Severity: Category I - VMSKEY: V0061337 |
2015-A-0174 | Multiple Vulnerabilities in Apache HTTP Server Severity: Category I - VMSKEY: V0061135 |
2011-A-0143 | Oracle Linux Security Vulnerability Severity: Category II - VMSKEY: V0030423 |
Snort® IPS/IDS
Date | Description |
---|---|
2018-06-21 | Mozilla Firefox nsHTMLDocument SetBody use-after-free attempt RuleID : 46781 - Type : BROWSER-FIREFOX - Revision : 2 |
2018-06-21 | Mozilla Firefox nsHTMLDocument SetBody use-after-free attempt RuleID : 46767 - Type : BROWSER-FIREFOX - Revision : 4 |
2018-06-21 | Mozilla Firefox nsHTMLDocument SetBody use-after-free attempt RuleID : 46766 - Type : BROWSER-FIREFOX - Revision : 2 |
2018-06-21 | Mozilla Firefox nsHTMLDocument SetBody use-after-free attempt RuleID : 46765 - Type : BROWSER-FIREFOX - Revision : 2 |
2018-03-01 | Squid host header cache poisoning attempt RuleID : 45569 - Type : SERVER-WEBAPP - Revision : 1 |
2017-10-24 | PHP form-based file upload DoS attempt RuleID : 44390 - Type : SERVER-WEBAPP - Revision : 2 |
2017-07-25 | Squid ESI processing buffer overflow attempt RuleID : 43268 - Type : SERVER-WEBAPP - Revision : 2 |
2017-01-12 | Nitro Pro PDF Reader out of bounds write attempt RuleID : 41197 - Type : FILE-PDF - Revision : 5 |
2017-01-12 | Nitro Pro PDF Reader out of bounds write attempt RuleID : 41196 - Type : FILE-PDF - Revision : 5 |
2016-11-08 | Mozilla Firefox CSP report-uri arbitrary file write attempt RuleID : 40363 - Type : BROWSER-FIREFOX - Revision : 2 |
2016-11-08 | ISC BIND isc__buffer_add assertion failure denial of service attempt RuleID : 40344 - Type : PROTOCOL-DNS - Revision : 2 |
2016-09-27 | WordPress pingback gethostbyname heap buffer overflow attempt RuleID : 39925 - Type : SERVER-WEBAPP - Revision : 2 |
2016-07-28 | HttpOxy CGI application vulnerability potential man-in-the-middle attempt RuleID : 39737-community - Type : SERVER-WEBAPP - Revision : 2 |
2016-08-31 | HttpOxy CGI application vulnerability potential man-in-the-middle attempt RuleID : 39737 - Type : SERVER-WEBAPP - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39097 - Type : FILE-IMAGE - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39096 - Type : FILE-IMAGE - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39095 - Type : FILE-IMAGE - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39094 - Type : FILE-IMAGE - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39093 - Type : FILE-IMAGE - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39092 - Type : FILE-IMAGE - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39091 - Type : FILE-IMAGE - Revision : 2 |
2016-07-01 | ImageMagick and GraphicsMagick OpenBlob command injection attempt RuleID : 39090 - Type : FILE-IMAGE - Revision : 2 |
2016-03-14 | NTP arbitrary pidfile and driftfile overwrite attempt RuleID : 37526 - Type : SERVER-OTHER - Revision : 3 |
2016-03-14 | NTP arbitrary pidfile and driftfile overwrite attempt RuleID : 37525 - Type : SERVER-OTHER - Revision : 4 |
2016-03-14 | OpenSSH insecure roaming key exchange attempt RuleID : 37371 - Type : SERVER-OTHER - Revision : 3 |
Nessus® Vulnerability Scanner
id | Description |
---|---|
2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-87f2ace20d.nasl - Type: ACT_GATHER_INFO |
2018-12-01 | Name: The remote Debian host is missing a security update. File: debian_DLA-1599.nasl - Type: ACT_GATHER_INFO |
2018-11-16 | Name: The remote CentOS host is missing one or more security updates. File: centos_RHSA-2018-3083.nasl - Type: ACT_GATHER_INFO |
2018-11-13 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-4338.nasl - Type: ACT_GATHER_INFO |
2018-08-17 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2017-0010.nasl - Type: ACT_GATHER_INFO |
2018-08-17 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2017-0021.nasl - Type: ACT_GATHER_INFO |
2018-08-15 | Name: The remote device is missing a vendor-supplied security patch. File: f5_bigip_SOL53729441.nasl - Type: ACT_GATHER_INFO |
2018-04-10 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201804-06.nasl - Type: ACT_GATHER_INFO |
2018-02-28 | Name: The version of Arista Networks EOS running on the remote device is affected b... File: arista_eos_sa0024.nasl - Type: ACT_GATHER_INFO |
2018-02-28 | Name: The version of Arista Networks EOS running on the remote device is affected b... File: arista_eos_sa0024_4_17.nasl - Type: ACT_GATHER_INFO |
2017-12-04 | Name: The remote host is missing a vendor-supplied security patch. File: check_point_gaia_sk104443.nasl - Type: ACT_GATHER_INFO |
2017-11-03 | Name: The remote host is missing a macOS or Mac OS X security update that fixes mul... File: macosx_SecUpd2017-004.nasl - Type: ACT_GATHER_INFO |
2017-10-03 | Name: The remote host is missing a macOS update that fixes multiple security vulner... File: macos_10_13.nasl - Type: ACT_GATHER_INFO |
2017-08-09 | Name: The remote AIX host has a version of NTP installed that is affected by multip... File: aix_ntp_v3_advisory4.nasl - Type: ACT_GATHER_INFO |
2017-08-09 | Name: The remote AIX host has a version of NTP installed that is affected by multip... File: aix_ntp_v4_advisory4.nasl - Type: ACT_GATHER_INFO |
2017-08-03 | Name: The remote AIX host has a version of bind installed that is affected by a den... File: aix_bind_advisory10.nasl - Type: ACT_GATHER_INFO |
2017-08-03 | Name: The remote AIX host has a version of bind installed that is affected by multi... File: aix_bind_advisory13.nasl - Type: ACT_GATHER_INFO |
2017-07-20 | Name: A web application installed on the remote host is affected by multiple vulner... File: oracle_e-business_cpu_jul_2017.nasl - Type: ACT_GATHER_INFO |
2017-07-20 | Name: An enterprise management application installed on the remote host is affected... File: oracle_enterprise_manager_jul_2017_cpu.nasl - Type: ACT_GATHER_INFO |
2017-07-13 | Name: The remote Virtuozzo host is missing a security update. File: Virtuozzo_VZLSA-2017-0036.nasl - Type: ACT_GATHER_INFO |
2017-06-30 | Name: The remote Red Hat host is missing one or more security updates. File: redhat-RHSA-2017-1658.nasl - Type: ACT_GATHER_INFO |
2017-06-30 | Name: The remote Ubuntu host is missing one or more security-related patches. File: ubuntu_USN-3338-2.nasl - Type: ACT_GATHER_INFO |
2017-06-26 | Name: The Tenable SecurityCenter application on the remote host contains a web serv... File: securitycenter_apache_2_4_25.nasl - Type: ACT_GATHER_INFO |
2017-06-26 | Name: The Tenable SecurityCenter application on the remote host contains an OpenSSL... File: securitycenter_openssl_1_0_1u.nasl - Type: ACT_GATHER_INFO |
2017-06-22 | Name: The remote Ubuntu host is missing one or more security-related patches. File: ubuntu_USN-3338-1.nasl - Type: ACT_GATHER_INFO |