CVE Intelligence

Vulnerabilidades de SUSE

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de SUSE: 109 registro(s), com severidade, exploração e correções.

Linux Enterprise Desktop 40Linux Enterprise Server 27Rancher 21Linux Enterprise Workstation Extension 14Linux Enterprise Software Development Kit 13Linux Enterprise Debuginfo 8Linux Enterprise 7Openstack Cloud 6Rancher Fleet 6Manager Proxy 5Package Hub 5Enterprise Storage 4Neuvector 4Manager Server 3Linux Enterprise High Availability Extension 3Manager 3Linux Enterprise Java 3Studio Onsite 3Harvester 3Linux Enterprise High Performance Computing 2Linux Enterprise Micro 2Linux Enterprise Real Time 2Linux Enterprise Real Time Extension 2Linux Enterprise Module For Legacy 2openSUSE Leap 16.1 2SUSE Manager Proxy LTS 4.3 2SUSE Manager Server LTS 4.3 2openSUSE 2openSUSE Tumbleweed 2Libzypp 2Fleet 2SUSE Linux Enterprise Server for NVIDIA 16.1 2SUSE Linux Enterprise Server 16.1 2Caas Platform 1Manager Retail Branch Server 1Openstack Cloud Crowbar 1Basesystem Module 1Development Tools Module 1Legacy Module 1Linux Enterprise Live Patching 1

Somente exploradas (KEV) →

CVE-2021-4034 Alta · 7.8 KEV Urgente · 86 Exploit público Ransomware CWE-125 28/01/2022
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
CVE-2021-4166 Alta · 7.1 CWE-125 25/12/2021
Out-of-bounds Read in vim/vim
vim is vulnerable to Out-of-bounds Read
CVE-2021-25317 Baixa · 3.3 CWE-276 05/05/2021
cups: ownership of /var/log/cups allows the lp user to create files as root
A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.
CVE-2020-8022 Alta · 7.8 CWE-276 29/06/2020
User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges
A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.
CVE-2019-19925 Alta · 7.5 CWE-434 24/12/2019
zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update...
zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.
CVE-2019-19923 Alta · 7.5 CWE-476 24/12/2019
flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving...
flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).
CVE-2019-19926 Alta · 7.5 CWE-476 22/12/2019
multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as...
multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.
CVE-2019-19880 Alta · 7.5 CWE-476 18/12/2019
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer...
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
CVE-2018-12122 Alta · 7.5 CWE-400 28/11/2018
Uncontrolled Resource Consumption em Nodejs Node.js
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.
CVE-2018-12116 Alta · 7.5 CWE-115 28/11/2018
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If…
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
CVE-2016-5131 Alta · 8.8 CWE-416 23/07/2016
Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743...
Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.
CVE-2016-4171 Crítica · 9.8 KEV Alta · 60 16/06/2016
Adobe Flash Player Remote Code Execution Vulnerability
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.
CVE-2016-0718 Crítica · 9.8 CWE-119 26/05/2016
Buffer Errors (Improper Restriction of Operations within Memory Bounds) em Mozilla Firefox
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
CVE-2016-4117 Crítica · 9.8 KEV Urgente · 100 Exploit público Ransomware 10/05/2016
Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CVE-2016-3718 Média · 5.5 KEV Alta · 61 Exploit público CWE-918 05/05/2016
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
CVE-2016-3715 Média · 5.5 KEV Alta · 61 Exploit público CWE-552 05/05/2016
ImageMagick Arbitrary File Deletion Vulnerability
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
CVE-2016-3714 Alta · 8.4 KEV Urgente · 79 Exploit público CWE-20 05/05/2016
ImageMagick Improper Input Validation Vulnerability
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
CVE-2016-3427 Crítica · 9.8 KEV Alta · 63 CWE-284 21/04/2016
Oracle Java SE and JRockit Unspecified Vulnerability
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVE-2016-1646 Alta · 8.8 KEV Alta · 56 CWE-125 29/03/2016
Google Chromium V8 Out-of-Bounds Read Vulnerability
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
CVE-2016-0752 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-22 16/02/2016
Ruby on Rails Directory Traversal Vulnerability
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
CVE-2015-8651 Alta · 8.8 KEV Alta · 66 CWE-190 28/12/2015
Adobe Flash Player Integer Overflow Vulnerability
Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.
CVE-2015-8126 Alta · 7.5 CWE-120 13/11/2015
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before...
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
CVE-2015-4902 Média · 5.3 KEV Alta · 65 CWE-284 21/10/2015
Oracle Java SE Integrity Check Vulnerability
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.
CVE-2015-7645 Alta · 7.8 KEV Urgente · 74 Exploit público Ransomware 15/10/2015
Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.
CVE-2015-4495 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-346 07/08/2015
Mozilla Firefox Security Feature Bypass Vulnerability
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.