SUSE Linux Enterprise Debuginfo vulnerabilities, page 2
55 vulnerabilities
Known vulnerabilities in SUSE Linux Enterprise Debuginfo, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2015-8779canonicalubuntu_linux+11
EPSS score6.21%
Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.CVE-2015-8567canonicalubuntu_linux+11EPSS score5.56%
Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).CVE-2015-3209aristaeos+36EPSS score9.68%
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.CVE-2016-2315debiangit+9EPSS score17.31%
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.CVE-2016-2318debiangraphicsmagick+8EPSS score1.88%
GraphicsMagick 1.3.23 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted SVG file, related to the (1) DrawImage function in magick/render.c, (2) SVGStartElement function in coders/svg.c, and (3) TraceArcPath function in magick/render.c.CVE-2016-2317debiangraphicsmagick+8EPSS score2.01%
Multiple buffer overflows in GraphicsMagick 1.3.23 allow remote attackers to cause a denial of service (crash) via a crafted SVG file, related to the (1) TracePoint function in magick/render.c, (2) GetToken function in magick/utility.c, and (3) GetTransformTokens function in coders/svg.c.CVE-2016-2324debiangit+9EPSS score18.11%
Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow.CVE-2016-2782debianlinux+29EPSS score1.65%
The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint.CVE-2016-1286canonicalubuntu_linux+15EPSS score62.10%
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c.CVE-2016-1285canonicalubuntu_linux+15EPSS score59.14%
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.CVE-2016-0642canonicalubuntu_linux+22EPSS score1.19%
Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect integrity and availability via vectors related to Federated.CVE-2016-0651ubuntumariadb-5.5+17EPSS score1.35%
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.CVE-2016-0718alpineexpat+34EPSS score13.33%
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.CVE-2016-5118alpineimagemagick+38EPSS score49.98%
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.CVE-2016-5772ubuntuphp5+8EPSS score9.67%
Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.CVE-2016-5244debianlinux+32EPSS score5.52%
The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.CVE-2016-3068debianmercurial+16EPSS score5.41%
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.CVE-2016-3630debianmercurial+9EPSS score4.87%
The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a (1) clone, (2) push, or (3) pull command, related to (a) a list sizing rounding error and (b) short records.CVE-2016-3715canonicalubuntu_linux+33KEVEPSS score75.31%
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.CVE-2016-3069debianmercurial+16EPSS score4.95%
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.