Opensuse Project vulnerabilities, page 3
54 vulnerabilities
Known vulnerabilities in Opensuse Project products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 9 products.
CVE-2014-9849canonicalubuntu_linux+10
EPSS score3.62%
The png coder in ImageMagick allows remote attackers to cause a denial of service (crash).CVE-2014-9843canonicalubuntu_linux+9EPSS score3.93%
The DecodePSDPixels function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors.CVE-2014-9845canonicalubuntu_linux+12EPSS score1.95%
The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib file.CVE-2014-9848canonicalubuntu_linux+11EPSS score3.73%
Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption).CVE-2014-9851canonicalubuntu_linux+10EPSS score3.70%
ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (application crash).CVE-2014-4258ubuntumariadb-5.5+14EPSS score3.51%
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SRINFOSC.CVE-2014-4616alpinepython+11EPSS score7.85%
Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.CVE-2014-3004castor_projectcastor+6EPSS score9.16%
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.CVE-2012-0867debiandebian_linux+10EPSS score2.34%
PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.CVE-2011-4093armin_burgmeiernet6+3EPSS score1.76%
Integer overflow in inc/server.hpp in libnet6 (aka net6) before 1.3.14 might allow remote attackers to hijack connections and gain privileges as other users by making a large number of connections until the overflow occurs and an ID of another user is provided.CVE-2017-17805canonicalubuntu_linux+25EPSS score0.44%
The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable.CVE-2017-17806canonicalubuntu_linux+30EPSS score0.56%
The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.CVE-2017-5938debianviewvc+6EPSS score1.32%
Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the nav_data name.CVE-2017-6542alpineputty+6EPSS score21.82%
The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overflow.