Vulnerabilidades de Opensuse

CVE-2016-10165 Alta · 7.1 CWE-125 03/02/2017

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to...

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

CVE-2016-5131 Alta · 8.8 CWE-416 23/07/2016

Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743...

Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.

CVE-2016-4171 Crítica · 9.8 KEV Alta · 60 16/06/2016

Adobe Flash Player Remote Code Execution Vulnerability

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

CVE-2016-0718 Crítica · 9.8 CWE-119 26/05/2016

Buffer Errors (Improper Restriction of Operations within Memory Bounds) em Mozilla Firefox

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

CVE-2016-4117 Crítica · 9.8 KEV Urgente · 100 Exploit público Ransomware 10/05/2016

Adobe Flash Player Arbitrary Code Execution Vulnerability

Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

CVE-2016-3718 Média · 5.5 KEV Alta · 61 Exploit público CWE-918 05/05/2016

ImageMagick Server-Side Request Forgery (SSRF) Vulnerability

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

CVE-2016-3715 Média · 5.5 KEV Alta · 61 Exploit público CWE-552 05/05/2016

ImageMagick Arbitrary File Deletion Vulnerability

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

CVE-2016-3714 Alta · 8.4 KEV Urgente · 79 Exploit público CWE-20 05/05/2016

ImageMagick Improper Input Validation Vulnerability

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

CVE-2016-3427 Crítica · 9.8 KEV Alta · 63 CWE-284 21/04/2016

Oracle Java SE and JRockit Unspecified Vulnerability

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVE-2016-1646 Alta · 8.8 KEV Alta · 56 CWE-125 29/03/2016

Google Chromium V8 Out-of-Bounds Read Vulnerability

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.

CVE-2016-0752 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-22 16/02/2016

Ruby on Rails Directory Traversal Vulnerability

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

CVE-2015-7575 Média · 5.9 CWE-19 09/01/2016

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2...

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.

CVE-2015-8651 Alta · 8.8 KEV Alta · 66 CWE-190 28/12/2015

Adobe Flash Player Integer Overflow Vulnerability

Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.

CVE-2015-8126 Alta · 7.5 CWE-120 13/11/2015

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before...

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

CVE-2015-4902 Média · 5.3 KEV Alta · 65 CWE-284 21/10/2015

Oracle Java SE Integrity Check Vulnerability

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

CVE-2015-7645 Alta · 7.8 KEV Urgente · 74 Exploit público Ransomware 15/10/2015

Adobe Flash Player Arbitrary Code Execution Vulnerability

Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.

CVE-2015-3246 Alta · 7.4 KEV Urgente · 75 Exploit público CWE-264 11/08/2015

Red Hat Libuser Race Condition Vulnerability

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.

CVE-2015-4495 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-346 07/08/2015

Mozilla Firefox Security Feature Bypass Vulnerability

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

CVE-2015-5477 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-19 29/07/2015

ISC BIND Data Processing Errors Vulnerability

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

CVE-2015-2590 Crítica · 9.8 KEV Alta · 63 16/07/2015

Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.

CVE-2015-5123 Crítica · 9.8 KEV Alta · 60 CWE-416 14/07/2015

Adobe Flash Player Use-After-Free Vulnerability

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

CVE-2015-5122 Crítica · 9.8 KEV Urgente · 80 Exploit público CWE-416 14/07/2015

Adobe Flash Player Use-After-Free Vulnerability

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

CVE-2015-5119 Crítica · 9.8 KEV Urgente · 90 Exploit público CWE-416 08/07/2015

Adobe Flash Player Use-After-Free Vulnerability

Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

CVE-2015-3113 Crítica · 9.8 KEV Urgente · 90 Exploit público CWE-787 23/06/2015

Adobe Flash Player Heap-Based Buffer Overflow Vulnerability

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.

CVE-2015-3306 Crítica · 10.0 KEV Urgente · 83 Exploit público CWE-284 18/05/2015

ProFTPD Improper Access Control Vulnerability

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.