Opensuse vulnerabilities, page 3
3,294 vulnerabilities
Known vulnerabilities in Opensuse products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 71 products.
CVE-2018-19637opensusesupportutils+1
EPSS score0.46%
Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protectionCVE-2018-19052debianlighttpd+10EPSS score13.71%
An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.CVE-2018-19539ubuntujasper+5EPSS score1.95%
An issue was discovered in JasPer 2.0.14. There is an access violation in the function jas_image_readcmpt in libjasper/base/jas_image.c, leading to a denial of service.CVE-2018-19840alpinewavpack+12EPSS score2.30%
The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero.CVE-2018-19638opensusesupportutils+1EPSS score0.40%
In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files.CVE-2018-19865debianqtvirtualkeyboard-opensource-src+5EPSS score2.17%
A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3.CVE-2018-19873canonicalubuntu_linux+6EPSS score3.38%
An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.CVE-2018-19364canonicalubuntu_linux+6EPSS score0.53%
hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.CVE-2018-19491debiangnuplot+5EPSS score1.77%
An issue was discovered in post.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the PS_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot postscript terminal is used as a backend.CVE-2018-19456opensuseleap+6EPSS score2.06%
The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files, as demonstrated by download.sql.CVE-2018-19869debianqtsvg-opensource-src+10EPSS score2.20%
An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp.CVE-2018-19870debianqtbase-opensource-src+4EPSS score2.42%
An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler resulting in a segmentation fault.CVE-2018-19492debiangnuplot+5EPSS score1.78%
An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the cairotrm_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot pngcairo terminal is used as a backend.CVE-2018-19841alpinewavpack+7EPSS score2.54%
The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack.CVE-2018-19639opensusesupportutils+1EPSS score0.50%
If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as root.CVE-2018-19489canonicalubuntu_linux+6EPSS score0.40%
v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming.CVE-2018-19490debiangnuplot+5EPSS score1.77%
An issue was discovered in datafile.c in Gnuplot 5.2.5. This issue allows an attacker to conduct a heap-based buffer overflow with an arbitrary amount of data in df_generate_ascii_array_entry. To exploit this vulnerability, an attacker must pass an overlong string as the right bound of the range argument that is passed to the plot function.CVE-2018-11212chainguardopenjdk-10+34EPSS score4.83%
An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.CVE-2018-11577canonicalubuntu_linux+4EPSS score2.54%
Liblouis 3.5.0 has a Segmentation fault in lou_logPrint in logging.c.CVE-2018-11685canonicalubuntu_linux+4EPSS score2.20%
Liblouis 3.5.0 has a stack-based Buffer Overflow in the function compileHyphenation in compileTranslationTable.c.