| PreviousNext |
| CVE-2015-9004: Potential privilege escalation. |
2018-04-26 |
| CVE-2017-5669: Potential MMAP protection mechanism bypass. |
2018-04-26 |
| CVE-2017-11473: Buffer overflow potential in ACPI table. |
2018-04-26 |
| CVE-2017-9074: Potential local user denial of service attack. |
2018-04-26 |
| CVE-2017-7187: The Linux kernel through 4.10.4 allows local users to cause a denial of service attack or potentially out-of-bounds write access. |
2018-04-26 |
| CVE-2017-1000365: Linux kernel 2.6.23-4.11.5 size of arguments and env strings. |
2018-04-26 |
| CVE-2017-9075: Potential local user denial of service attack. |
2018-04-26 |
| CVE-2017-1000380: Potential information disclosure. |
2018-04-26 |
| CVE-2017-6951: Potential local user denial of service attack. |
2018-04-26 |
| CVE-2017-7616: Incorrect error handling in the Linux kernel. |
2018-04-26 |
| CVE-2017-6074: Potential denial of service or privilege escalation. |
2018-04-26 |
| CVE-2017-9076: Potential local user denial of service attack. |
2018-04-26 |
| CVE-2010-5329: Potential DOS attack with kernel driver. |
2018-04-26 |
| CVE-2017-14106: Potential DOS attack. |
2018-04-26 |
| CVE-2017-9242: Potential local user denial of service attack. |
2018-04-26 |
| CVE-2017-0605: Linux kernel trace privilege elevation. |
2018-04-26 |
| CVE-2017-6214: Potential DOS attack via vectors involving a TCP packet with the URG flag. |
2018-04-26 |
| CVE-2017-11176: Potential denial of service attack. |
2018-04-26 |
| CVE-2017-7542: Potential denial of service attack. |
2018-04-26 |
| CVE-2017-14489: Potential DOS attack due to incorrect length validation. |
2018-04-26 |
| CVE-2017-5986: Potential DOS attack with threaded applications. |
2018-04-26 |
| DETAILS:
CVE-2015-3183: An HTTP request smuggling attack was possible due to a bug in parsing of chunked requests. A malicious client could force the server to misinterpret the request length, allowing cache poisoning or credential hijacking if an intermediary proxy is in use.
CVE-2015-3185: A design error in the "ap_some_auth_required" function renders the API unusuable in httpd 2.4.x. In particular the API is documented to answering if the request required authentication but only answers if there are Require lines in the applicable configuration. Since 2.4.x Require lines are used for authorization as well and can appear in configurations even when no authentication is required and the request is entirely unrestricted. This could lead to modules using this API to allow access when they should otherwise not do so. API users should use the new ap_some_authn_required API added in 2.4.16 instead.
FIX:
Upgraded Apache httpd to 2.4.16 to fix CVE-2015-3183 and CVE-2015-3185.
RECOMMENDATION:
Upgrade to a software version with the fix. |
2018-04-04 |
| CVE-2017-6508: CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL. |
2018-03-01 |
| NTP before 4.2.8p10 has multiple security vulnerabilities: CVE-2017-6451, CVE-2017-6452, CVE-2017-6462 to CVE-2017-6464, CVE-2017-6455, CVE-2017-6458 to CVE-2017-6460, and CVE-2016-9042. |
2018-02-20 |
| Multiple security vulnerabilities in bash CVE-2016-0634, CVE-2016-7543, and CVE-2016-9401. |
2018-02-20 |
| A race condition was found in the way su handles the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions(CVE-2017-2616). |
2018-02-20 |
| Multiple security vulnerabilities in glibc CVE-2014-9761, CVE-2015-8776, CVE-2015-8778, and CVE-2015-8779. |
2018-02-20 |
| CVE-2017-1000366: glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. |
2018-02-20 |
| CVE-2016-5195: Linux kernel copy-on-write (COW) results in local privilege escalation. |
2018-01-12 |
| CVE-2015-8215 - Linux kernel IPv6 MTU denial of service vulnerability. |
2018-01-12 |
| CVE-2016-5364, CVE-2015-5366: Linux kernel UDP denial of service vulnerabilities. |
2018-01-12 |
| CVE-2004-0230 - Blind reset denial of service attack on TCP connections. |
2018-01-12 |
| CVE-2017-1000368: Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function. |
2017-12-18 |
| CVE-2015-1379: The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash). |
2017-12-15 |
| CVE-2013-0292: dbus-glib: Local privilege escalation due improper filtering of message sender when NameOwnerChanged signal received |
2017-10-31 |
| Several vulnerabilities in the krb5 RPM, as used by various base operating system programs. |
2017-10-31 |
| RedHat Security Advisory RHSA-2014:1436-2 for X11 libraries |
2017-10-31 |
| CVE-2011-2939, CVE-2011-3597: perl vulnerabilities (Unicode memory corruption and Digest attack). |
2017-10-31 |
| CVE-2013-1813: busybox may create directories with 0777 permissions. |
2017-10-31 |
| CVE-2012-0862: xinetd is vulnerable to attacks through tcpmux service. |
2017-10-31 |
| PreviousNext |
