Opensuse Leap vulnerabilities, page 5
1,898 vulnerabilities
Known vulnerabilities in Opensuse Leap, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-14463alpinetcpdump+9
EPSS score4.72%
The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 2, a different vulnerability than CVE-2019-15167.CVE-2018-14467alpinetcpdump+8EPSS score3.98%
The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).CVE-2018-14468alpinetcpdump+25EPSS score3.98%
The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print().CVE-2018-14523aubioaubio+5EPSS score1.98%
An issue was discovered in aubio 0.4.6. A buffer over-read can occur in new_aubio_pitchyinfft in pitch/pitchyinfft.c, as demonstrated by aubionotes.CVE-2018-14466alpinetcpdump+8EPSS score3.98%
The Rx parser in tcpdump before 4.9.3 has a buffer over-read in print-rx.c:rx_cache_find() and rx_cache_insert().CVE-2018-14469alpinetcpdump+9EPSS score5.34%
The IKEv1 parser in tcpdump before 4.9.3 has a buffer over-read in print-isakmp.c:ikev1_n_print().CVE-2018-14464alpinetcpdump+8EPSS score3.98%
The LMP parser in tcpdump before 4.9.3 has a buffer over-read in print-lmp.c:lmp_print_data_link_subobjs().CVE-2018-14647alpinepython2+25EPSS score10.91%
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.CVE-2018-14522aubioaubio+5EPSS score1.96%
An issue was discovered in aubio 0.4.6. A SEGV signal can occur in aubio_pitch_set_unit in pitch/pitch.c, as demonstrated by aubionotes.CVE-2018-14498alpinelibjpeg-turbo+17EPSS score3.09%
get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.CVE-2018-14880alpinetcpdump+25EPSS score5.34%
The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr().CVE-2018-14465alpinetcpdump+9EPSS score4.07%
The RSVP parser in tcpdump before 4.9.3 has a buffer over-read in print-rsvp.c:rsvp_obj_print().CVE-2018-14462alpinetcpdump+9EPSS score3.98%
The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().CVE-2018-14881alpinetcpdump+8EPSS score4.76%
The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART).CVE-2018-17294canonicalubuntu_linux+15EPSS score2.72%
The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's length, allowing attackers to cause a denial of service (application crash via out-of-bounds read) by crafting an input file with certain translation dictionaries.CVE-2018-7858canonicalubuntu_linux+15EPSS score0.61%
Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.CVE-2018-18310canonicalubuntu_linux+8EPSS score1.35%
An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.CVE-2018-18335debianchromium+7EPSS score3.90%
Heap buffer overflow in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2018-18544debiangraphicsmagick+16EPSS score2.01%
There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31.CVE-2018-18356canonicalubuntu_linux+15EPSS score3.28%
An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.